From ad898daec7de9ea2c48643119a0fee23537addb5 Mon Sep 17 00:00:00 2001 From: "Felipe R. de Almeida" Date: Thu, 6 Aug 2026 15:11:41 -0300 Subject: [PATCH 1/6] ci: pin semgrep registry rules as snapshots with scheduled update PRs --- .github/workflows/ci-security.yml | 15 +++++++++----- .../workflows/semgrep-package-managers.yml | 20 ++++++++++++------- .github/workflows/semgrep-tests.yml | 4 +++- .github/workflows/semgrep.yml | 11 ++++++---- .gitignore | 3 ++- AGENTS.md | 5 ++++- 6 files changed, 39 insertions(+), 19 deletions(-) diff --git a/.github/workflows/ci-security.yml b/.github/workflows/ci-security.yml index af47c86..b60c7a2 100644 --- a/.github/workflows/ci-security.yml +++ b/.github/workflows/ci-security.yml @@ -19,21 +19,26 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 container: - image: semgrep/semgrep + image: semgrep/semgrep:1.163.0@sha256:7cad2bc2d1e44f87f0bf4be6d1fa23aa90fb72015bebc89fb91385d813987a03 steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + # Registry packs are pinned as snapshots in .semgrep/registry/ + # (refreshed by the semgrep-registry-update workflow), which is + # also excluded from the scan target — vendored upstream rule + # files aren't ours to lint. # exclude all directories already scanned by other jobs - name: Run Semgrep run: | semgrep \ - --config "p/owasp-top-ten" \ - --config "p/security-audit" \ - --config "p/trailofbits" \ - --config "p/github-actions" \ + --config ".semgrep/registry/owasp-top-ten.yaml" \ + --config ".semgrep/registry/security-audit.yaml" \ + --config ".semgrep/registry/trailofbits.yaml" \ + --config ".semgrep/registry/github-actions.yaml" \ --exclude ".semgrep/rules/*.test.yaml" \ + --exclude ".semgrep/registry" \ --error \ --metrics=off \ --verbose \ diff --git a/.github/workflows/semgrep-package-managers.yml b/.github/workflows/semgrep-package-managers.yml index 5e4bd32..bb8980d 100644 --- a/.github/workflows/semgrep-package-managers.yml +++ b/.github/workflows/semgrep-package-managers.yml @@ -28,16 +28,22 @@ jobs: with: fetch-depth: 1 + - name: Checkout .github repo (for pinned registry rule snapshots) + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + repository: PostHog/.github + path: dotgithub-repo + sparse-checkout: | + .semgrep/registry + + # The registry rules are pinned as a snapshot in PostHog/.github + # (.semgrep/registry/, refreshed by the semgrep-registry-update + # workflow) so registry-side rule changes can't break CI here. - name: Run Semgrep run: | semgrep \ - --config "r/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age" \ - --config "r/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown" \ - --config "r/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age" \ - --config "r/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate" \ - --config "r/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age" \ - --config "r/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age" \ - --config "r/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown" \ + --config "dotgithub-repo/.semgrep/registry/package-managers.yaml" \ + --exclude "dotgithub-repo" \ --error \ --metrics=off \ --verbose \ diff --git a/.github/workflows/semgrep-tests.yml b/.github/workflows/semgrep-tests.yml index 3b843c5..22ea7df 100644 --- a/.github/workflows/semgrep-tests.yml +++ b/.github/workflows/semgrep-tests.yml @@ -21,9 +21,11 @@ jobs: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + # Scoped to rules/ — .semgrep/registry/ holds vendored registry + # snapshots, which have no test fixtures. - name: Test custom Semgrep rules run: | - semgrep --test .semgrep/ + semgrep --test .semgrep/rules/ - name: Test Semgrep result reporting run: | diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 56b9a4d..5297322 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -51,12 +51,15 @@ jobs: # Local generic-parser replacements preserve their coverage. Remove both exclusions and the # replacements after https://github.com/semgrep/semgrep-rules/issues/3688 is fixed and the # compatibility fixture passes with p/github-actions under --strict. + # Registry packs are pinned as snapshots in PostHog/.github + # (.semgrep/registry/, refreshed by the semgrep-registry-update + # workflow) so registry-side rule changes can't break CI here. semgrep \ --config "dotgithub-repo/.semgrep/rules/" \ - --config "p/owasp-top-ten" \ - --config "p/security-audit" \ - --config "p/trailofbits" \ - --config "p/github-actions" \ + --config "dotgithub-repo/.semgrep/registry/owasp-top-ten.yaml" \ + --config "dotgithub-repo/.semgrep/registry/security-audit.yaml" \ + --config "dotgithub-repo/.semgrep/registry/trailofbits.yaml" \ + --config "dotgithub-repo/.semgrep/registry/github-actions.yaml" \ --exclude-rule trailofbits.generic.curl-unencrypted-url.curl-unencrypted-url \ --exclude-rule dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile \ --exclude-rule trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport \ diff --git a/.gitignore b/.gitignore index 2f24661..558c56b 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ # Misc .DS_Store -.idea \ No newline at end of file +.idea +__pycache__/ \ No newline at end of file diff --git a/AGENTS.md b/AGENTS.md index b98bcaa..9dd1ad1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -15,15 +15,18 @@ There is no build step and no app. Changes are config (YAML workflows, semgrep r - **The doubled path.** Reusable workflows here are referenced as `PostHog/.github/.github/workflows/.yml@main` — the `.github/.github/` is correct, not a typo. - **`workflow_call` preserves the original event.** When a workflow here is invoked via `workflow_call` from another repo, `github.event_name` keeps the *original* event (e.g. `pull_request`), not `workflow_call`. This is an undocumented special case of the `.github` repo; several workflows branch on it. Read the comments in `flags-project-board.yml` before "fixing" any event-name check. - **`flags-boards.json` is loaded at runtime**, not baked into the workflow SHA — so editing the team→board map doesn't require callers to re-pin. +- **Registry rules are pinned as snapshots.** Scan workflows must never use live `--config p/...` / `--config r/...` registry configs — they resolve at scan time, so a registry-side rule change breaks CI org-wide with no code change. Instead, packs are vendored under `.semgrep/registry/` (generated files — don't hand-edit) and workflows point at those. The `semgrep-registry-update` workflow re-fetches on a schedule, dry-runs added/changed rules against `PostHog/posthog`, notifies Slack, and opens a snapshot-bump PR; *merging that PR is the moment new rules start being enforced*. To add a pack, add it to `.semgrep/registry/sources.json` and run `python3 .github/scripts/semgrep_registry.py sync`. Like `flags-boards.json`, snapshots load from `main` at runtime, so merging applies org-wide without re-pinning. ## Testing No general test suite. The one locally runnable thing is the semgrep rule tests: ```bash -semgrep --test .semgrep/ +semgrep --test .semgrep/rules/ ``` +(Scoped to `rules/` — `.semgrep/registry/` holds vendored registry snapshots with no test fixtures.) + Each rule has a paired `.test.yaml` fixture — update it when you touch a rule. Workflows themselves can't be unit-tested; reusable workflows expose a `script-ref` / ref input (default `main`) so you can point a caller at a branch of this repo while iterating against a real PR. ## Conventions (enforced, match them) From e24709a575047d34f1d78be83897e295b73e8d8b Mon Sep 17 00:00:00 2001 From: "Felipe R. de Almeida" Date: Thu, 6 Aug 2026 15:13:30 -0300 Subject: [PATCH 2/6] ci: pin semgrep registry rules as snapshots with scheduled update PRs --- .github/scripts/semgrep_registry.py | 252 + .github/scripts/test_semgrep_registry.py | 134 + .../workflows/semgrep-package-managers.yml | 2 + .github/workflows/semgrep-registry-update.yml | 204 + .semgrep/registry/README.md | 18 + .semgrep/registry/github-actions.yaml | 778 + .semgrep/registry/go-lang-security.yaml | 3685 ++ .semgrep/registry/golang.yaml | 2564 + .semgrep/registry/javascript.yaml | 7316 +++ .semgrep/registry/owasp-top-ten.yaml | 43429 ++++++++++++++++ .semgrep/registry/package-managers.yaml | 428 + .semgrep/registry/python.yaml | 16155 ++++++ .semgrep/registry/rust-lang-security.yaml | 375 + .semgrep/registry/rust.yaml | 441 + .semgrep/registry/security-audit.yaml | 14189 +++++ .semgrep/registry/sources.json | 21 + .semgrep/registry/trailofbits.yaml | 5616 ++ 17 files changed, 95607 insertions(+) create mode 100644 .github/scripts/semgrep_registry.py create mode 100644 .github/scripts/test_semgrep_registry.py create mode 100644 .github/workflows/semgrep-registry-update.yml create mode 100644 .semgrep/registry/README.md create mode 100644 .semgrep/registry/github-actions.yaml create mode 100644 .semgrep/registry/go-lang-security.yaml create mode 100644 .semgrep/registry/golang.yaml create mode 100644 .semgrep/registry/javascript.yaml create mode 100644 .semgrep/registry/owasp-top-ten.yaml create mode 100644 .semgrep/registry/package-managers.yaml create mode 100644 .semgrep/registry/python.yaml create mode 100644 .semgrep/registry/rust-lang-security.yaml create mode 100644 .semgrep/registry/rust.yaml create mode 100644 .semgrep/registry/security-audit.yaml create mode 100644 .semgrep/registry/sources.json create mode 100644 .semgrep/registry/trailofbits.yaml diff --git a/.github/scripts/semgrep_registry.py b/.github/scripts/semgrep_registry.py new file mode 100644 index 0000000..40fc10e --- /dev/null +++ b/.github/scripts/semgrep_registry.py @@ -0,0 +1,252 @@ +#!/usr/bin/env python3 +"""Vendor Semgrep registry packs as pinned snapshots under .semgrep/registry/. + +Scan workflows point at the snapshot files instead of live `p/...` registry +configs, so a registry-side rule change can never alter CI behavior until a +snapshot update lands on main. The semgrep-registry-update workflow runs +`sync` on a schedule, opens a PR with any changes, and notifies Slack. + +Commands: + sync Fetch every pack in sources.json, rewrite the snapshot + files, and (optionally) write a JSON diff summary. + changed-rules Emit a rules file containing only the added/changed rule + definitions from a `sync` summary, for dry-run scans. + report Render a `sync` summary (plus an optional dry-run scan's + JSON output) as markdown for the update PR body. +""" + +from __future__ import annotations + +import argparse +import json +import sys +import time +import urllib.error +import urllib.request +from pathlib import Path +from typing import Any, Callable + +import yaml + +SEMGREP_URL = "https://semgrep.dev" +FETCH_ATTEMPTS = 3 +FETCH_BACKOFF_SECONDS = 10 +GENERATED_HEADER = ( + "# GENERATED FILE - DO NOT EDIT.\n" + "# Snapshot of Semgrep registry config(s): {sources}\n" + "# Rules are fetched from https://semgrep.dev/c/, deduplicated by rule id,\n" + "# and sorted. Refresh with: python3 .github/scripts/semgrep_registry.py sync\n" + "# (the semgrep-registry-update workflow does this on a schedule).\n" +) + + +def fetch_registry_rules(registry_id: str, urlopen: Callable[..., Any] = urllib.request.urlopen) -> list[dict[str, Any]]: + """Download a registry config (p/ or r/) and return its rules.""" + url = f"{SEMGREP_URL}/c/{registry_id}" + request = urllib.request.Request(url, headers={"User-Agent": "posthog-semgrep-registry-sync"}) + last_error: Exception | None = None + for attempt in range(1, FETCH_ATTEMPTS + 1): + try: + with urlopen(request, timeout=120) as response: + raw = response.read().decode("utf-8") + break + except (urllib.error.URLError, TimeoutError, OSError) as error: + last_error = error + if attempt < FETCH_ATTEMPTS: + print(f"Fetch of {url} failed (attempt {attempt}): {error}; retrying", file=sys.stderr) + time.sleep(FETCH_BACKOFF_SECONDS * attempt) + else: + raise RuntimeError(f"Could not fetch {url} after {FETCH_ATTEMPTS} attempts: {last_error}") + + data = yaml.safe_load(raw) + if not isinstance(data, dict) or not isinstance(data.get("rules"), list): + raise RuntimeError(f"Unexpected response from {url}: no top-level 'rules' list") + rules = data["rules"] + for rule in rules: + if not isinstance(rule, dict) or not isinstance(rule.get("id"), str): + raise RuntimeError(f"Unexpected response from {url}: rule without a string 'id'") + return rules + + +def merge_rules(rule_lists: list[list[dict[str, Any]]]) -> dict[str, dict[str, Any]]: + """Merge rule lists into an id-keyed dict, keeping the first definition of duplicate ids.""" + merged: dict[str, dict[str, Any]] = {} + for rules in rule_lists: + for rule in rules: + merged.setdefault(rule["id"], rule) + return merged + + +def render_snapshot(sources: list[str], rules_by_id: dict[str, dict[str, Any]]) -> str: + header = GENERATED_HEADER.format(sources=", ".join(sources)) + body = yaml.safe_dump( + {"rules": [rules_by_id[rule_id] for rule_id in sorted(rules_by_id)]}, + sort_keys=False, + default_flow_style=False, + allow_unicode=True, + width=120, + ) + return header + body + + +def load_snapshot(path: Path) -> dict[str, dict[str, Any]]: + if not path.is_file(): + return {} + data = yaml.safe_load(path.read_text(encoding="utf-8")) + if not isinstance(data, dict) or not isinstance(data.get("rules"), list): + raise RuntimeError(f"Existing snapshot {path} is not a valid rules file") + return {rule["id"]: rule for rule in data["rules"]} + + +def compute_diff(old: dict[str, dict[str, Any]], new: dict[str, dict[str, Any]]) -> dict[str, list[str]]: + return { + "added": sorted(set(new) - set(old)), + "removed": sorted(set(old) - set(new)), + "changed": sorted(rule_id for rule_id in set(old) & set(new) if old[rule_id] != new[rule_id]), + } + + +def load_sources(registry_dir: Path) -> dict[str, list[str]]: + sources_path = registry_dir / "sources.json" + sources = json.loads(sources_path.read_text(encoding="utf-8")) + if not isinstance(sources, dict) or not all( + isinstance(ids, list) and ids and all(isinstance(i, str) for i in ids) for ids in sources.values() + ): + raise RuntimeError(f"{sources_path} must map snapshot names to non-empty lists of registry ids") + return sources + + +def sync(registry_dir: Path, summary_path: Path | None, urlopen: Callable[..., Any] = urllib.request.urlopen) -> dict[str, Any]: + sources = load_sources(registry_dir) + summary: dict[str, Any] = {"snapshots": {}, "totals": {"added": 0, "removed": 0, "changed": 0}} + + for name in sorted(sources): + registry_ids = sources[name] + snapshot_path = registry_dir / f"{name}.yaml" + new_rules = merge_rules([fetch_registry_rules(registry_id, urlopen) for registry_id in registry_ids]) + old_rules = load_snapshot(snapshot_path) + diff = compute_diff(old_rules, new_rules) + snapshot_path.write_text(render_snapshot(registry_ids, new_rules), encoding="utf-8") + + summary["snapshots"][name] = diff + for key in summary["totals"]: + summary["totals"][key] += len(diff[key]) + print( + f"{name}: {len(new_rules)} rules " + f"(+{len(diff['added'])} added, -{len(diff['removed'])} removed, ~{len(diff['changed'])} changed)" + ) + + summary["changed"] = any(summary["totals"].values()) + if summary_path: + summary_path.write_text(json.dumps(summary, indent=2) + "\n", encoding="utf-8") + return summary + + +def changed_rules(registry_dir: Path, summary_path: Path, out_path: Path) -> int: + """Write a rules file with the definitions of every added/changed rule in the summary.""" + summary = json.loads(summary_path.read_text(encoding="utf-8")) + rules: list[dict[str, Any]] = [] + seen: set[str] = set() + for name, diff in sorted(summary["snapshots"].items()): + wanted = set(diff["added"]) | set(diff["changed"]) + if not wanted: + continue + snapshot = load_snapshot(registry_dir / f"{name}.yaml") + for rule_id in sorted(wanted): + if rule_id in seen: + continue + if rule_id not in snapshot: + raise RuntimeError(f"Rule {rule_id} from summary is missing in snapshot {name}.yaml") + rules.append(snapshot[rule_id]) + seen.add(rule_id) + out_path.write_text( + yaml.safe_dump({"rules": rules}, sort_keys=False, default_flow_style=False, allow_unicode=True, width=120), + encoding="utf-8", + ) + print(f"Wrote {len(rules)} added/changed rule(s) to {out_path}", file=sys.stderr) + print(len(rules)) + return len(rules) + + +def report(summary_path: Path, out_path: Path, dry_run_path: Path | None, dry_run_repo: str) -> None: + """Render the sync summary (and optional dry-run scan output) as markdown.""" + summary = json.loads(summary_path.read_text(encoding="utf-8")) + lines = ["## Semgrep registry snapshot changes", ""] + + totals = summary["totals"] + if not summary.get("changed"): + lines.append("No rule changes.") + else: + lines.append("| Snapshot | Added | Removed | Changed |") + lines.append("| --- | ---: | ---: | ---: |") + for name, diff in sorted(summary["snapshots"].items()): + if any(diff.values()): + lines.append(f"| {name} | {len(diff['added'])} | {len(diff['removed'])} | {len(diff['changed'])} |") + lines.append(f"| **total** | {totals['added']} | {totals['removed']} | {totals['changed']} |") + for kind, label in (("added", "Added"), ("changed", "Changed"), ("removed", "Removed")): + rule_ids = sorted({rule_id for diff in summary["snapshots"].values() for rule_id in diff[kind]}) + if rule_ids: + lines.extend(["", f"### {label} rules", ""]) + lines.extend(f"- `{rule_id}`" for rule_id in rule_ids) + + if dry_run_path is not None: + dry_run = json.loads(dry_run_path.read_text(encoding="utf-8")) + results = dry_run.get("results") or [] + errors = dry_run.get("errors") or [] + lines.extend(["", f"## Dry run of added/changed rules against {dry_run_repo}", ""]) + lines.append(f"{len(results)} finding(s), {len(errors)} analysis error(s).") + if results: + counts: dict[str, int] = {} + for result in results: + counts[result["check_id"]] = counts.get(result["check_id"], 0) + 1 + lines.extend(["", "| Rule | Findings |", "| --- | ---: |"]) + for rule_id, count in sorted(counts.items(), key=lambda item: (-item[1], item[0])): + lines.append(f"| `{rule_id}` | {count} |") + if errors: + lines.extend(["", "Analysis errors (these would break scans if enforced):", ""]) + seen_messages: set[str] = set() + for error in errors: + message = str(error.get("message", "")).split("\n")[0][:200] + if message not in seen_messages: + lines.append(f"- {message}") + seen_messages.add(message) + + out_path.write_text("\n".join(lines) + "\n", encoding="utf-8") + print(f"Wrote report to {out_path}") + + +def main() -> int: + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument( + "--registry-dir", + type=Path, + default=Path(__file__).resolve().parents[2] / ".semgrep" / "registry", + help="Directory holding sources.json and the snapshot files", + ) + subparsers = parser.add_subparsers(dest="command", required=True) + + sync_parser = subparsers.add_parser("sync", help="Fetch packs and rewrite snapshots") + sync_parser.add_argument("--summary", type=Path, help="Write a JSON diff summary to this path") + + changed_parser = subparsers.add_parser("changed-rules", help="Emit added/changed rule definitions from a sync summary") + changed_parser.add_argument("--summary", type=Path, required=True) + changed_parser.add_argument("--out", type=Path, required=True) + + report_parser = subparsers.add_parser("report", help="Render a sync summary as markdown") + report_parser.add_argument("--summary", type=Path, required=True) + report_parser.add_argument("--out", type=Path, required=True) + report_parser.add_argument("--dry-run-json", type=Path, help="Semgrep JSON output from a dry-run scan") + report_parser.add_argument("--dry-run-repo", default="PostHog/posthog") + + arguments = parser.parse_args() + if arguments.command == "sync": + sync(arguments.registry_dir, arguments.summary) + elif arguments.command == "changed-rules": + changed_rules(arguments.registry_dir, arguments.summary, arguments.out) + else: + report(arguments.summary, arguments.out, arguments.dry_run_json, arguments.dry_run_repo) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/.github/scripts/test_semgrep_registry.py b/.github/scripts/test_semgrep_registry.py new file mode 100644 index 0000000..3a54353 --- /dev/null +++ b/.github/scripts/test_semgrep_registry.py @@ -0,0 +1,134 @@ +import io +import json +import tempfile +import unittest +import urllib.request +from pathlib import Path + +import semgrep_registry + + +def rule(rule_id: str, pattern: str = "foo(...)") -> dict: + return {"id": rule_id, "languages": ["python"], "severity": "WARNING", "message": "m", "pattern": pattern} + + +def fake_urlopen(payloads: dict[str, list[dict]]): + def urlopen(request: urllib.request.Request, timeout: int = 0) -> io.BytesIO: + registry_id = request.full_url.split("/c/", 1)[1] + return io.BytesIO(json.dumps({"rules": payloads[registry_id]}).encode("utf-8")) + + return urlopen + + +class DiffTest(unittest.TestCase): + def test_compute_diff(self) -> None: + old = {"a": rule("a"), "b": rule("b"), "c": rule("c")} + new = {"b": rule("b"), "c": rule("c", pattern="bar(...)"), "d": rule("d")} + + self.assertEqual( + semgrep_registry.compute_diff(old, new), + {"added": ["d"], "removed": ["a"], "changed": ["c"]}, + ) + + def test_merge_rules_keeps_first_duplicate(self) -> None: + merged = semgrep_registry.merge_rules([[rule("a", pattern="first")], [rule("a", pattern="second"), rule("b")]]) + + self.assertEqual(sorted(merged), ["a", "b"]) + self.assertEqual(merged["a"]["pattern"], "first") + + def test_snapshot_roundtrip_is_sorted_and_loadable(self) -> None: + rules = {"b": rule("b"), "a": rule("a")} + rendered = semgrep_registry.render_snapshot(["p/test"], rules) + + self.assertTrue(rendered.startswith("# GENERATED FILE")) + self.assertIn("p/test", rendered) + self.assertLess(rendered.index("id: a"), rendered.index("id: b")) + with tempfile.TemporaryDirectory() as directory: + path = Path(directory, "snapshot.yaml") + path.write_text(rendered, encoding="utf-8") + self.assertEqual(semgrep_registry.load_snapshot(path), rules) + + +class SyncTest(unittest.TestCase): + def sync(self, registry_dir: Path, payloads: dict[str, list[dict]]) -> dict: + return semgrep_registry.sync(registry_dir, registry_dir / "summary.json", fake_urlopen(payloads)) + + def test_sync_writes_snapshots_and_diffs(self) -> None: + with tempfile.TemporaryDirectory() as directory: + registry_dir = Path(directory) + (registry_dir / "sources.json").write_text(json.dumps({"test": ["p/one", "p/two"]}), encoding="utf-8") + + first = self.sync(registry_dir, {"p/one": [rule("a")], "p/two": [rule("b")]}) + self.assertTrue(first["changed"]) + self.assertEqual(first["snapshots"]["test"]["added"], ["a", "b"]) + + unchanged = self.sync(registry_dir, {"p/one": [rule("a")], "p/two": [rule("b")]}) + self.assertFalse(unchanged["changed"]) + self.assertEqual(unchanged["totals"], {"added": 0, "removed": 0, "changed": 0}) + + updated = self.sync(registry_dir, {"p/one": [rule("a", pattern="bar(...)")], "p/two": [rule("c")]}) + self.assertTrue(updated["changed"]) + self.assertEqual( + updated["snapshots"]["test"], + {"added": ["c"], "removed": ["b"], "changed": ["a"]}, + ) + self.assertEqual(json.loads((registry_dir / "summary.json").read_text())["totals"]["added"], 1) + + def test_changed_rules_extracts_definitions(self) -> None: + with tempfile.TemporaryDirectory() as directory: + registry_dir = Path(directory) + (registry_dir / "sources.json").write_text(json.dumps({"test": ["p/one"]}), encoding="utf-8") + self.sync(registry_dir, {"p/one": [rule("a"), rule("b")]}) + self.sync(registry_dir, {"p/one": [rule("a"), rule("b", pattern="bar(...)"), rule("c")]}) + + out = registry_dir / "changed.yaml" + count = semgrep_registry.changed_rules(registry_dir, registry_dir / "summary.json", out) + + self.assertEqual(count, 2) + extracted = semgrep_registry.load_snapshot(out) + self.assertEqual(sorted(extracted), ["b", "c"]) + self.assertEqual(extracted["b"]["pattern"], "bar(...)") + + +class ReportTest(unittest.TestCase): + def render(self, summary: dict, dry_run: dict | None = None) -> str: + with tempfile.TemporaryDirectory() as directory: + summary_path = Path(directory, "summary.json") + summary_path.write_text(json.dumps(summary), encoding="utf-8") + dry_run_path = None + if dry_run is not None: + dry_run_path = Path(directory, "dry-run.json") + dry_run_path.write_text(json.dumps(dry_run), encoding="utf-8") + out = Path(directory, "report.md") + semgrep_registry.report(summary_path, out, dry_run_path, "PostHog/posthog") + return out.read_text(encoding="utf-8") + + def test_report_lists_rules_and_dry_run_counts(self) -> None: + markdown = self.render( + { + "changed": True, + "totals": {"added": 1, "removed": 1, "changed": 0}, + "snapshots": {"test": {"added": ["new.rule"], "removed": ["old.rule"], "changed": []}}, + }, + { + "results": [{"check_id": "new.rule"}, {"check_id": "new.rule"}], + "errors": [{"message": "Internal matching error\ndetails"}], + }, + ) + + self.assertIn("| test | 1 | 1 | 0 |", markdown) + self.assertIn("- `new.rule`", markdown) + self.assertIn("- `old.rule`", markdown) + self.assertIn("2 finding(s), 1 analysis error(s).", markdown) + self.assertIn("| `new.rule` | 2 |", markdown) + self.assertIn("- Internal matching error", markdown) + + def test_report_without_changes_or_dry_run(self) -> None: + markdown = self.render({"changed": False, "totals": {"added": 0, "removed": 0, "changed": 0}, "snapshots": {}}) + + self.assertIn("No rule changes.", markdown) + self.assertNotIn("Dry run", markdown) + + +if __name__ == "__main__": + unittest.main() diff --git a/.github/workflows/semgrep-package-managers.yml b/.github/workflows/semgrep-package-managers.yml index bb8980d..a6eb457 100644 --- a/.github/workflows/semgrep-package-managers.yml +++ b/.github/workflows/semgrep-package-managers.yml @@ -27,12 +27,14 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 1 + persist-credentials: false - name: Checkout .github repo (for pinned registry rule snapshots) uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: PostHog/.github path: dotgithub-repo + persist-credentials: false sparse-checkout: | .semgrep/registry diff --git a/.github/workflows/semgrep-registry-update.yml b/.github/workflows/semgrep-registry-update.yml new file mode 100644 index 0000000..50c8c49 --- /dev/null +++ b/.github/workflows/semgrep-registry-update.yml @@ -0,0 +1,204 @@ +# Keeps the pinned Semgrep registry snapshots in .semgrep/registry/ up to date. +# +# Scan workflows across the org run against those snapshots instead of live +# `p/...` registry configs, so a registry-side rule change can never break CI +# on unrelated PRs. This workflow re-fetches the packs on a schedule; when the +# registry has added/removed/changed rules it: +# 1. dry-runs the added/changed rules against PostHog/posthog to measure the +# blast radius (finding counts and analysis errors, without failing), +# 2. opens/updates a PR bumping the snapshots (merging the PR is the moment +# the new rules start being enforced org-wide), +# 3. notifies Slack so @team-security can fix occurrences before merging. +# +# Required configuration: +# - SEMGREP_REGISTRY_BOT_APP_ID / SEMGREP_REGISTRY_BOT_PRIVATE_KEY secrets for +# a GitHub App with Contents (read & write) and Pull requests (read & write) +# on this repository. +# - SEMGREP_REGISTRY_SLACK_BOT_TOKEN secret and SEMGREP_REGISTRY_SLACK_CHANNEL_ID +# repository variable for the Slack notification (skipped when unset). + +name: Semgrep Registry Update + +on: + schedule: + - cron: '0 6 * * 1-5' + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: semgrep-registry-update + +env: + SEMGREP_ENABLE_VERSION_CHECK: 'false' + +jobs: + detect: + runs-on: ubuntu-latest + timeout-minutes: 45 + container: + image: semgrep/semgrep:1.163.0@sha256:7cad2bc2d1e44f87f0bf4be6d1fa23aa90fb72015bebc89fb91385d813987a03 + outputs: + changed: ${{ steps.sync.outputs.changed }} + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Sync registry snapshots + id: sync + run: | + mkdir -p "$RUNNER_TEMP/artifact" + python3 .github/scripts/semgrep_registry.py sync \ + --summary "$RUNNER_TEMP/artifact/summary.json" + changed=$(python3 -c "import json, os; print(str(json.load(open(os.environ['RUNNER_TEMP'] + '/artifact/summary.json'))['changed']).lower())") + echo "changed=$changed" >> "$GITHUB_OUTPUT" + + - name: Build changed-rules config + id: changed-rules + if: steps.sync.outputs.changed == 'true' + run: | + count=$(python3 .github/scripts/semgrep_registry.py changed-rules \ + --summary "$RUNNER_TEMP/artifact/summary.json" \ + --out "$RUNNER_TEMP/changed-rules.yaml") + echo "count=$count" >> "$GITHUB_OUTPUT" + + - name: Checkout PostHog/posthog for the dry run + if: steps.sync.outputs.changed == 'true' && steps.changed-rules.outputs.count != '0' + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + repository: PostHog/posthog + path: posthog-checkout + persist-credentials: false + + # Measures what the added/changed rules would flag today. Never fails: + # the whole point is to see the damage before enforcing anything. + - name: Dry-run added/changed rules against PostHog/posthog + if: steps.sync.outputs.changed == 'true' && steps.changed-rules.outputs.count != '0' + # Run from inside the checkout so posthog's .semgrepignore applies. + run: | + cd posthog-checkout + semgrep \ + --config "$RUNNER_TEMP/changed-rules.yaml" \ + --json-output "$RUNNER_TEMP/artifact/dry-run.json" \ + --metrics=off \ + --jobs 4 \ + --timeout 300 \ + . || true + + - name: Render report + if: steps.sync.outputs.changed == 'true' + run: | + if [ -f "$RUNNER_TEMP/artifact/dry-run.json" ]; then + dry_run_args="--dry-run-json $RUNNER_TEMP/artifact/dry-run.json" + else + dry_run_args="" + fi + # shellcheck disable=SC2086 # dry_run_args is a controlled flag string + python3 .github/scripts/semgrep_registry.py report \ + --summary "$RUNNER_TEMP/artifact/summary.json" \ + --out "$RUNNER_TEMP/artifact/report.md" \ + $dry_run_args + cp -R .semgrep/registry "$RUNNER_TEMP/artifact/registry" + + - name: Upload update artifact + if: steps.sync.outputs.changed == 'true' + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: registry-update + path: ${{ runner.temp }}/artifact + if-no-files-found: error + + propose: + needs: detect + if: needs.detect.outputs.changed == 'true' + runs-on: ubuntu-latest + timeout-minutes: 15 + env: + SLACK_BOT_TOKEN: ${{ secrets.SEMGREP_REGISTRY_SLACK_BOT_TOKEN }} + steps: + - name: Generate GitHub App token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ secrets.SEMGREP_REGISTRY_BOT_APP_ID }} + private-key: ${{ secrets.SEMGREP_REGISTRY_BOT_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write + + # persist-credentials stays on: the push/PR steps below need the + # app token in the git remote. + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + token: ${{ steps.app-token.outputs.token }} + + - name: Download update artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: registry-update + path: ${{ runner.temp }}/artifact + + - name: Apply snapshots + run: | + rm -rf .semgrep/registry + cp -R "$RUNNER_TEMP/artifact/registry" .semgrep/registry + + # A fixed branch keeps this to a single rolling PR: reruns force-push + # the latest snapshots and refresh the body instead of stacking PRs. + - name: Create or update pull request + id: pr + env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} + BRANCH: semgrep-registry-update + TITLE: 'chore(semgrep): update pinned registry rule snapshots' + run: | + git add .semgrep/registry + if git diff --cached --quiet; then + echo "Snapshots already match main; nothing to propose." + echo "url=" >> "$GITHUB_OUTPUT" + exit 0 + fi + git config user.name "semgrep-registry-update[bot]" + git config user.email "semgrep-registry-update[bot]@users.noreply.github.com" + git checkout -b "$BRANCH" + git commit -m "$TITLE" + git push --force origin "$BRANCH" + existing=$(gh pr list --head "$BRANCH" --state open --json url --jq '.[0].url // empty') + if [ -n "$existing" ]; then + gh pr edit "$existing" --body-file "$RUNNER_TEMP/artifact/report.md" + echo "url=$existing" >> "$GITHUB_OUTPUT" + else + url=$(gh pr create --title "$TITLE" --body-file "$RUNNER_TEMP/artifact/report.md" --head "$BRANCH") + echo "url=$url" >> "$GITHUB_OUTPUT" + fi + + - name: Build Slack payload + id: slack-payload + if: steps.pr.outputs.url != '' + env: + PR_URL: ${{ steps.pr.outputs.url }} + SLACK_CHANNEL_ID: ${{ vars.SEMGREP_REGISTRY_SLACK_CHANNEL_ID }} + run: | + jq -n \ + --arg channel "$SLACK_CHANNEL_ID" \ + --arg pr_url "$PR_URL" \ + --slurpfile summary "$RUNNER_TEMP/artifact/summary.json" \ + '{ + channel: $channel, + text: ("Semgrep registry changed: " + + ($summary[0].totals.added | tostring) + " added, " + + ($summary[0].totals.changed | tostring) + " changed, " + + ($summary[0].totals.removed | tostring) + " removed rule(s). " + + "These are NOT enforced until the snapshot PR merges: " + $pr_url) + }' > "$RUNNER_TEMP/slack-payload.json" + + - name: Notify Slack + if: steps.pr.outputs.url != '' && env.SLACK_BOT_TOKEN != '' + uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1 + with: + method: chat.postMessage + token: ${{ secrets.SEMGREP_REGISTRY_SLACK_BOT_TOKEN }} + payload-file-path: ${{ runner.temp }}/slack-payload.json diff --git a/.semgrep/registry/README.md b/.semgrep/registry/README.md new file mode 100644 index 0000000..e9f5959 --- /dev/null +++ b/.semgrep/registry/README.md @@ -0,0 +1,18 @@ +# Pinned Semgrep registry snapshots + +Vendored copies of the Semgrep registry packs used by CI across the org, +fetched anonymously from `https://semgrep.dev/c/`. Scan workflows run +against these files instead of live `p/...` configs so that registry-side +rule changes can never break CI until a snapshot update is reviewed and +merged here. + +- `sources.json` maps each snapshot file to the registry config(s) it pins. +- Every `*.yaml` file is generated — do not edit by hand. Refresh with + `python3 .github/scripts/semgrep_registry.py sync`; the + `semgrep-registry-update` workflow does this on a schedule and opens a PR + with a diff summary and a dry run against `PostHog/posthog`. + +The rules remain the property of their upstream authors (Semgrep, Trail of +Bits, and other registry contributors) under their respective licenses; each +rule's `metadata` carries its `source` / `license` fields where upstream +provides them. diff --git a/.semgrep/registry/github-actions.yaml b/.semgrep/registry/github-actions.yaml new file mode 100644 index 0000000..2a847a9 --- /dev/null +++ b/.semgrep/registry/github-actions.yaml @@ -0,0 +1,778 @@ +# GENERATED FILE - DO NOT EDIT. +# Snapshot of Semgrep registry config(s): p/github-actions +# Rules are fetched from https://semgrep.dev/c/, deduplicated by rule id, +# and sorted. Refresh with: python3 .github/scripts/semgrep_registry.py sync +# (the semgrep-registry-update workflow does this on a schedule). +rules: +- id: yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands + languages: + - yaml + severity: WARNING + message: The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` + and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified + by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the + system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen + code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files + for more information. + metadata: + cwe: + - 'CWE-749: Exposed Dangerous Method or Function' + owasp: A06:2017 - Security Misconfiguration + references: + - https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/ + - https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w + - https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files + category: security + technology: + - github-actions + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Dangerous Method or Function + source: https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands + shortlink: https://sg.run/qq78 + semgrep.dev: + rule: + r_id: 13412 + rv_id: 947039 + rule_id: EwUQ9x + version_id: jQTzq34 + url: https://semgrep.dev/playground/r/jQTzq34/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands + origin: community + patterns: + - pattern-either: + - patterns: + - pattern-inside: '{env: ...}' + - pattern: 'ACTIONS_ALLOW_UNSECURE_COMMANDS: true' +- id: yaml.github-actions.security.audit.unsafe-add-mask-workflow-command.unsafe-add-mask-workflow-command + patterns: + - pattern-regex: '::add-mask::' + languages: + - yaml + severity: WARNING + message: GitHub Actions provides the **'add-mask'** workflow command to mask sensitive data in the workflow logs. If **'add-mask'** + is not used or if workflow commands have been stopped, sensitive data can leaked into the workflow logs. An attacker could + simply copy the workflow to another branch and add the following payload `echo "::stop-commands::$stopMarker"` to stop + workflow command processing ([described here](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#stopping-and-starting-workflow-commands)), + which will cause the secret token to be exposed despite the **'add-mask'** usage. For more information, please refer to + the [GitHub documentation](https://github.com/actions/toolkit/blob/main/docs/commands.md#register-a-secret). + metadata: + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + owasp: A06:2017 - Security Misconfiguration + category: security + technology: + - github-actions + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: LOW + vulnerability_class: + - Dangerous Method or Function + references: + - https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/ + - https://github.com/actions/runner/issues/159 + - https://github.com/actions/runner/issues/475 + - https://github.com/actions/runner/issues/807 + - https://0xn3va.gitbook.io/cheat-sheets/ci-cd/github/actions#misuse-of-sensitive-data-in-workflows + - https://github.com/github/docs/blob/main/content/actions/using-workflows/workflow-commands-for-github-actions.md#masking-a-value-in-a-log + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/yaml.github-actions.security.audit.unsafe-add-mask-workflow-command.unsafe-add-mask-workflow-command + shortlink: https://sg.run/lBYDo + semgrep.dev: + rule: + r_id: 138057 + rv_id: 947040 + rule_id: GdUvn8y + version_id: 1QToZdr + url: https://semgrep.dev/playground/r/1QToZdr/yaml.github-actions.security.audit.unsafe-add-mask-workflow-command.unsafe-add-mask-workflow-command + origin: community +- id: yaml.github-actions.security.curl-eval.curl-eval + languages: + - yaml + message: Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could + inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If + you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity. + metadata: + category: security + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections + technology: + - github-actions + - bash + - curl + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + confidence: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval + shortlink: https://sg.run/9r7r + semgrep.dev: + rule: + r_id: 14967 + rv_id: 1263926 + rule_id: X5Udrd + version_id: YDTZe7K + url: https://semgrep.dev/playground/r/YDTZe7K/yaml.github-actions.security.curl-eval.curl-eval + origin: community + patterns: + - pattern-inside: 'steps: [...]' + - pattern-inside: "- run: ...\n ...\n" + - pattern: 'run: $SHELL' + - metavariable-pattern: + language: bash + metavariable: $SHELL + patterns: + - pattern: '$DATA=<... curl ...> + + ... + + eval <... $DATA ...> + + ' + severity: ERROR +- id: yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor + languages: + - yaml + message: The Shai-hulud backdoor creates a purposefully vulnerable github action with the name `discussion.yaml`. + paths: + include: + - '**/.github/workflows/discussion.yaml' + metadata: + category: security + cwe: + - 'CWE-509: Replicating Malicious Code (Virus or Worm)' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + technology: + - github-actions + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source_rule_url: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack + references: + - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains + source: https://semgrep.dev/r/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor + shortlink: https://sg.run/JdYPZ + semgrep.dev: + rule: + r_id: 238946 + rv_id: 1263927 + rule_id: 7KUDRPj + version_id: 6xT29ol + url: https://semgrep.dev/playground/r/6xT29ol/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor + origin: community + patterns: + - pattern-inside: 'steps: [...]' + - pattern-inside: "- run: ...\n ...\n" + - pattern: 'run: $SHELL' + - metavariable-pattern: + language: generic + metavariable: $SHELL + patterns: + - pattern-either: + - pattern: ${{ github.event.issue.title }} + - pattern: ${{ github.event.issue.body }} + - pattern: ${{ github.event.pull_request.title }} + - pattern: ${{ github.event.pull_request.body }} + - pattern: ${{ github.event.comment.body }} + - pattern: ${{ github.event.review.body }} + - pattern: ${{ github.event.review_comment.body }} + - pattern: ${{ github.event.pages. ... .page_name}} + - pattern: ${{ github.event.head_commit.message }} + - pattern: ${{ github.event.head_commit.author.email }} + - pattern: ${{ github.event.head_commit.author.name }} + - pattern: ${{ github.event.commits ... .author.email }} + - pattern: ${{ github.event.commits ... .author.name }} + - pattern: ${{ github.event.pull_request.head.ref }} + - pattern: ${{ github.event.pull_request.head.label }} + - pattern: ${{ github.event.pull_request.head.repo.default_branch }} + - pattern: ${{ github.head_ref }} + - pattern: ${{ github.event.inputs ... }} + - pattern: ${{ github.event.discussion.title }} + - pattern: ${{ github.event.discussion.body }} + - pattern: ${{ inputs ... }} + severity: ERROR +- id: yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell + languages: + - yaml + message: A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | bash" + install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in + your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it. + metadata: + category: security + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A03:2021 - Injection + - A03:2025 - Injection + references: + - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions + - https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ + technology: + - github-actions + - bash + - curl + cwe2021-top25: true + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell + shortlink: https://sg.run/GR8K1 + semgrep.dev: + rule: + r_id: 309392 + rv_id: 1443456 + rule_id: x8UAgrE + version_id: 9lT3zYb + url: https://semgrep.dev/playground/r/9lT3zYb/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell + origin: community + patterns: + - pattern-inside: 'steps: [...]' + - pattern-inside: "- run: ...\n ...\n" + - pattern: 'run: $SHELL' + - metavariable-pattern: + language: bash + metavariable: $SHELL + patterns: + - pattern-either: + - pattern: curl ... | $CMD ... + - pattern: wget ... | $CMD ... + - metavariable-regex: + metavariable: $CMD + regex: ^(bash|sh|python3?|ruby|perl)$ + severity: ERROR +- id: yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret + languages: + - yaml + message: 'A secret is exposed in the workflow-level `env:` block, making it available to every job and step in this workflow + — including any untrusted code run in pull-request workflows. Scope secrets as narrowly as possible: prefer step-level + `env:` so the secret is only available where it is actually needed.' + metadata: + category: security + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-secrets + - https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow + technology: + - github-actions + subcategory: + - audit + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret + shortlink: https://sg.run/Rrn12 + semgrep.dev: + rule: + r_id: 309393 + rv_id: 1443457 + rule_id: OrUnq7z + version_id: yeTqX9r + url: https://semgrep.dev/playground/r/yeTqX9r/yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret + origin: community + patterns: + - pattern-inside: "env:\n ...\n" + - pattern-regex: \$\{\{\s*secrets\. + - pattern-not-inside: 'jobs: ...' + severity: WARNING +- id: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag + message: 'GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by + the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin + the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.' + severity: WARNING + languages: + - yaml + metadata: + category: security + cwe: + - 'CWE-1357: Reliance on Insufficiently Trustworthy Component' + - 'CWE-353: Missing Support for Integrity Check' + owasp: + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software and Data Integrity Failures + references: + - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions + technology: + - github-actions + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + - Other + source: https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag + shortlink: https://sg.run/2LgAL + semgrep.dev: + rule: + r_id: 288863 + rv_id: 1413422 + rule_id: GdUxYDx + version_id: xyTRDAd + url: https://semgrep.dev/playground/r/xyTRDAd/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag + origin: community + patterns: + - pattern-inside: '{steps: ...}' + - pattern: 'uses: "$ACTION" + + ' + - metavariable-pattern: + metavariable: $ACTION + language: generic + patterns: + - pattern-not-regex: ^\./ + - pattern-not-regex: ^docker:// + - pattern-not-regex: '@[0-9a-f]{40}(\s|$)' +- id: yaml.github-actions.security.github-script-injection.github-script-injection + languages: + - yaml + message: 'Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`''s `script:` step + could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` + context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment + variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes + the environment variable, like this: "$ENVVAR".' + metadata: + category: security + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections + - https://securitylab.github.com/research/github-actions-untrusted-input/ + - https://github.com/actions/github-script + technology: + - github-actions + cwe2022-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection + shortlink: https://sg.run/g1G0 + semgrep.dev: + rule: + r_id: 31441 + rv_id: 1501843 + rule_id: OrUQvK + version_id: e1TboJK + url: https://semgrep.dev/playground/r/e1TboJK/yaml.github-actions.security.github-script-injection.github-script-injection + origin: community + patterns: + - pattern-inside: 'steps: [...]' + - pattern-inside: 'uses: $ACTION + + ... + + ' + - pattern-inside: "with:\n ...\n script: ...\n ...\n" + - pattern: 'script: $SHELL' + - metavariable-regex: + metavariable: $ACTION + regex: actions/github-script@.* + - metavariable-pattern: + language: generic + metavariable: $SHELL + patterns: + - pattern-either: + - pattern: ${{ ... github.event.issue.title ... }} + - pattern: ${{ ... github.event.issue.body ... }} + - pattern: ${{ ... github.event.pull_request.title ... }} + - pattern: ${{ ... github.event.pull_request.body ... }} + - pattern: ${{ ... github.event.comment.body ... }} + - pattern: ${{ ... github.event.review.body ... }} + - pattern: ${{ ... github.event.review_comment.body ... }} + - pattern: ${{ ... github.event.pages ... .page_name ... }} + - pattern: ${{ ... github.event.head_commit.message ... }} + - pattern: ${{ ... github.event.head_commit.author.email ... }} + - pattern: ${{ ... github.event.head_commit.author.name ... }} + - pattern: ${{ ... github.event.commits ... .author.email ... }} + - pattern: ${{ ... github.event.commits ... .author.name ... }} + - pattern: ${{ ... github.event.commits ... .message ... }} + - pattern: ${{ ... github.event.pull_request.head.ref ... }} + - pattern: ${{ ... github.event.pull_request.head.label ... }} + - pattern: ${{ ... github.event.pull_request.head.repo.default_branch ... }} + - pattern: ${{ ... github.ref ... }} + - pattern: ${{ ... github.base_ref ... }} + - pattern: ${{ ... github.head_ref ... }} + - pattern: ${{ ... github.ref_name ... }} + - pattern: ${{ ... github.event.inputs ... }} + - pattern: ${{ ... github.event.discussion.title ... }} + - pattern: ${{ ... github.event.discussion.body ... }} + - pattern: ${{ ... github.event.workflow_run.head_branch ... }} + - pattern: ${{ ... github.event.workflow_run.head_commit.message ... }} + - pattern: ${{ ... github.event.milestone.title ... }} + - pattern: ${{ ... github.event.milestone.description ... }} + - pattern: ${{ ... github.event.project_card.note ... }} + - pattern: ${{ ... github.event.project.name ... }} + - pattern: ${{ ... github.event.project_column.name ... }} + - pattern: ${{ ... github.event.release.name ... }} + - pattern: ${{ ... github.event.release.body ... }} + - pattern: ${{ ... github.event.deployment.ref ... }} + - pattern: ${{ ... inputs ... }} + - pattern-not: ${{ ... github.event.issue.title && ... }} + - pattern-not: ${{ ... github.event.issue.body && ... }} + - pattern-not: ${{ ... github.event.pull_request.title && ... }} + - pattern-not: ${{ ... github.event.pull_request.body && ... }} + - pattern-not: ${{ ... github.event.comment.body && ... }} + - pattern-not: ${{ ... github.event.review.body && ... }} + - pattern-not: ${{ ... github.event.review_comment.body && ... }} + - pattern-not: ${{ ... github.event.pages ... .page_name && ... }} + - pattern-not: ${{ ... github.event.head_commit.message && ... }} + - pattern-not: ${{ ... github.event.head_commit.author.email && ... }} + - pattern-not: ${{ ... github.event.head_commit.author.name && ... }} + - pattern-not: ${{ ... github.event.commits ... .author.email && ... }} + - pattern-not: ${{ ... github.event.commits ... .author.name && ... }} + - pattern-not: ${{ ... github.event.commits ... .message && ... }} + - pattern-not: ${{ ... github.event.pull_request.head.ref && ... }} + - pattern-not: ${{ ... github.event.pull_request.head.label && ... }} + - pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch && ... }} + - pattern-not: ${{ ... github.ref && ... }} + - pattern-not: ${{ ... github.base_ref && ... }} + - pattern-not: ${{ ... github.head_ref && ... }} + - pattern-not: ${{ ... github.ref_name && ... }} + - pattern-not: ${{ ... github.event.inputs && ... }} + - pattern-not: ${{ ... github.event.discussion.title && ... }} + - pattern-not: ${{ ... github.event.discussion.body && ... }} + - pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }} + - pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ... }} + - pattern-not: ${{ ... github.event.milestone.title && ... }} + - pattern-not: ${{ ... github.event.milestone.description && ... }} + - pattern-not: ${{ ... github.event.project_card.note && ... }} + - pattern-not: ${{ ... github.event.project.name && ... }} + - pattern-not: ${{ ... github.event.project_column.name && ... }} + - pattern-not: ${{ ... github.event.release.name && ... }} + - pattern-not: ${{ ... github.event.release.body && ... }} + - pattern-not: ${{ ... github.event.deployment.ref && ... }} + severity: ERROR +- id: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout + languages: + - yaml + message: This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. + When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all + repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming + PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You + may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let + an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or + dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from + the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ + for additional mitigations. + metadata: + category: security + owasp: + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software and Data Integrity Failures + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + references: + - https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ + - https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target + - https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md + technology: + - github-actions + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout + shortlink: https://sg.run/jkdn + semgrep.dev: + rule: + r_id: 13365 + rv_id: 1413423 + rule_id: d8Ulkd + version_id: O9TQ2nX + url: https://semgrep.dev/playground/r/O9TQ2nX/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout + origin: community + patterns: + - pattern-either: + - pattern-inside: "on:\n ...\n pull_request_target: ...\n ...\n...\n" + - pattern-inside: 'on: [..., pull_request_target, ...] + + ... + + ' + - pattern-inside: 'on: pull_request_target + + ... + + ' + - pattern-inside: "jobs:\n ...\n $JOBNAME:\n ...\n steps:\n ...\n" + - pattern: "...\nuses: \"$ACTION\"\nwith:\n ...\n ref: $EXPR\n" + - metavariable-regex: + metavariable: $ACTION + regex: actions/checkout@.* + - metavariable-pattern: + language: generic + metavariable: $EXPR + patterns: + - pattern-inside: ${{ ... }} + - pattern-either: + - pattern: github.event.pull_request ... + - pattern: github.head_ref ... + severity: ERROR +- id: yaml.github-actions.security.run-shell-injection.run-shell-injection + languages: + - yaml + message: 'Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to + inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have + arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` + to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment + variable, like this: "$ENVVAR".' + metadata: + category: security + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections + - https://securitylab.github.com/research/github-actions-untrusted-input/ + technology: + - github-actions + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection + shortlink: https://sg.run/pkzk + semgrep.dev: + rule: + r_id: 13162 + rv_id: 1501844 + rule_id: v8UjQj + version_id: vdTowy6 + url: https://semgrep.dev/playground/r/vdTowy6/yaml.github-actions.security.run-shell-injection.run-shell-injection + origin: community + patterns: + - pattern-inside: 'steps: [...]' + - pattern-inside: "- run: ...\n ...\n" + - pattern: 'run: $SHELL' + - metavariable-pattern: + language: generic + metavariable: $SHELL + patterns: + - pattern-either: + - pattern: ${{ ... github.event.issue.title ... }} + - pattern: ${{ ... github.event.issue.body ... }} + - pattern: ${{ ... github.event.pull_request.title ... }} + - pattern: ${{ ... github.event.pull_request.body ... }} + - pattern: ${{ ... github.event.comment.body ... }} + - pattern: ${{ ... github.event.review.body ... }} + - pattern: ${{ ... github.event.review_comment.body ... }} + - pattern: ${{ ... github.event.pages ... .page_name ... }} + - pattern: ${{ ... github.event.head_commit.message ... }} + - pattern: ${{ ... github.event.head_commit.author.email ... }} + - pattern: ${{ ... github.event.head_commit.author.name ... }} + - pattern: ${{ ... github.event.commits ... .author.email ... }} + - pattern: ${{ ... github.event.commits ... .author.name ... }} + - pattern: ${{ ... github.event.commits ... .message ... }} + - pattern: ${{ ... github.event.pull_request.head.ref ... }} + - pattern: ${{ ... github.event.pull_request.head.label ... }} + - pattern: ${{ ... github.event.pull_request.head.repo.default_branch ... }} + - pattern: ${{ ... github.ref ... }} + - pattern: ${{ ... github.base_ref ... }} + - pattern: ${{ ... github.head_ref ... }} + - pattern: ${{ ... github.ref_name ... }} + - pattern: ${{ ... github.event.inputs ... }} + - pattern: ${{ ... github.event.discussion.title ... }} + - pattern: ${{ ... github.event.discussion.body ... }} + - pattern: ${{ ... github.event.workflow_run.head_branch ... }} + - pattern: ${{ ... github.event.workflow_run.head_commit.message ... }} + - pattern: ${{ ... github.event.milestone.title ... }} + - pattern: ${{ ... github.event.milestone.description ... }} + - pattern: ${{ ... github.event.project_card.note ... }} + - pattern: ${{ ... github.event.project.name ... }} + - pattern: ${{ ... github.event.project_column.name ... }} + - pattern: ${{ ... github.event.release.name ... }} + - pattern: ${{ ... github.event.release.body ... }} + - pattern: ${{ ... github.event.deployment.ref ... }} + - pattern: ${{ ... inputs ... }} + - pattern-not: ${{ ... github.event.issue.title && ... }} + - pattern-not: ${{ ... github.event.issue.body && ... }} + - pattern-not: ${{ ... github.event.pull_request.title && ... }} + - pattern-not: ${{ ... github.event.pull_request.body && ... }} + - pattern-not: ${{ ... github.event.comment.body && ... }} + - pattern-not: ${{ ... github.event.review.body && ... }} + - pattern-not: ${{ ... github.event.review_comment.body && ... }} + - pattern-not: ${{ ... github.event.pages ... .page_name && ... }} + - pattern-not: ${{ ... github.event.head_commit.message && ... }} + - pattern-not: ${{ ... github.event.head_commit.author.email && ... }} + - pattern-not: ${{ ... github.event.head_commit.author.name && ... }} + - pattern-not: ${{ ... github.event.commits ... .author.email && ... }} + - pattern-not: ${{ ... github.event.commits ... .author.name && ... }} + - pattern-not: ${{ ... github.event.commits ... .message && ... }} + - pattern-not: ${{ ... github.event.pull_request.head.ref && ... }} + - pattern-not: ${{ ... github.event.pull_request.head.label && ... }} + - pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch && ... }} + - pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ... }} + - pattern-not: ${{ ... github.ref && ... }} + - pattern-not: ${{ ... github.base_ref && ... }} + - pattern-not: ${{ ... github.head_ref && ... }} + - pattern-not: ${{ ... github.ref_name && ... }} + - pattern-not: ${{ ... github.event.inputs && ... }} + - pattern-not: ${{ ... github.event.discussion.title && ... }} + - pattern-not: ${{ ... github.event.discussion.body && ... }} + - pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }} + - pattern-not: ${{ ... github.event.milestone.title && ... }} + - pattern-not: ${{ ... github.event.milestone.description && ... }} + - pattern-not: ${{ ... github.event.project_card.note && ... }} + - pattern-not: ${{ ... github.event.project.name && ... }} + - pattern-not: ${{ ... github.event.project_column.name && ... }} + - pattern-not: ${{ ... github.event.release.name && ... }} + - pattern-not: ${{ ... github.event.release.body && ... }} + - pattern-not: ${{ ... github.event.deployment.ref && ... }} + severity: ERROR +- id: yaml.github-actions.security.secrets-inherit.secrets-inherit + languages: + - yaml + severity: ERROR + message: 'This workflow uses `secrets: inherit` to pass all of the calling workflow''s secrets to a reusable workflow. This + violates the principle of least privilege because the called workflow receives access to every secret in the repository, + not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access + to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` + map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`.' + metadata: + category: security + cwe: + - 'CWE-250: Execution with Unnecessary Privileges' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow + - https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions + technology: + - github-actions + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/yaml.github-actions.security.secrets-inherit.secrets-inherit + shortlink: https://sg.run/X2PZB + semgrep.dev: + rule: + r_id: 288864 + rv_id: 1413424 + rule_id: ReUQnKg + version_id: e1T42L1 + url: https://semgrep.dev/playground/r/e1T42L1/yaml.github-actions.security.secrets-inherit.secrets-inherit + origin: community + patterns: + - pattern-inside: "jobs:\n ...\n" + - pattern: 'secrets: inherit' +- id: yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout + languages: + - yaml + message: This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When + using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository + secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, + by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently + executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository + secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts + (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please + see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations. + metadata: + category: security + owasp: A01:2017 - Injection + cwe: 'CWE-913: Improper Control of Dynamically-Managed Code Resources' + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + subcategory: + - vuln + references: + - https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ + - https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md + - https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability + technology: + - github-actions + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout + shortlink: https://sg.run/A0p6 + semgrep.dev: + rule: + r_id: 35494 + rv_id: 947046 + rule_id: 4bU8E4 + version_id: kbTYRwl + url: https://semgrep.dev/playground/r/kbTYRwl/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout + origin: community + patterns: + - pattern-inside: "on:\n ...\n workflow_run: ...\n ...\n...\n" + - pattern-inside: "jobs:\n ...\n $JOBNAME:\n ...\n steps:\n ...\n" + - pattern: "...\nuses: \"$ACTION\"\nwith:\n ...\n ref: $EXPR\n" + - metavariable-regex: + metavariable: $ACTION + regex: actions/checkout@.* + - metavariable-pattern: + language: generic + metavariable: $EXPR + patterns: + - pattern: ${{ github.event.workflow_run ... }} + severity: WARNING diff --git a/.semgrep/registry/go-lang-security.yaml b/.semgrep/registry/go-lang-security.yaml new file mode 100644 index 0000000..7e4f6df --- /dev/null +++ b/.semgrep/registry/go-lang-security.yaml @@ -0,0 +1,3685 @@ +# GENERATED FILE - DO NOT EDIT. +# Snapshot of Semgrep registry config(s): r/go.lang.security +# Rules are fetched from https://semgrep.dev/c/, deduplicated by rule id, +# and sorted. Refresh with: python3 .github/scripts/semgrep_registry.py sync +# (the semgrep-registry-update workflow does this on a schedule). +rules: +- id: go.lang.security.audit.crypto.bad_imports.insecure-module-used + message: The package `net/http/cgi` is on the import blocklist. The package is vulnerable to httpoxy attacks (CVE-2015-5386). + It is recommended to use `net/http` or a web framework to build a web application instead. + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + source-rule-url: https://github.com/securego/gosec + references: + - https://godoc.org/golang.org/x/crypto/sha3 + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used + shortlink: https://sg.run/l2gj + semgrep.dev: + rule: + r_id: 9113 + rv_id: 1262921 + rule_id: yyUnov + version_id: 2KTv2vJ + url: https://semgrep.dev/playground/r/2KTv2vJ/go.lang.security.audit.crypto.bad_imports.insecure-module-used + origin: community + languages: + - go + severity: WARNING + pattern-either: + - patterns: + - pattern-inside: 'import "net/http/cgi" + + ... + + ' + - pattern: 'cgi.$FUNC(...) + + ' +- id: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key + message: Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' + package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn + more about the problem and how to fix it. + metadata: + cwe: + - 'CWE-322: Key Exchange without Entity Authentication' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec + references: + - https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ + - https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key + shortlink: https://sg.run/Yv6X + semgrep.dev: + rule: + r_id: 9114 + rv_id: 1262922 + rule_id: r6UrW9 + version_id: X0TzyzN + url: https://semgrep.dev/playground/r/X0TzyzN/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key + origin: community + languages: + - go + severity: WARNING + pattern: ssh.InsecureIgnoreHostKey() +- id: go.lang.security.audit.crypto.math_random.math-random-used + metadata: + cwe: + - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used + shortlink: https://sg.run/6nK6 + semgrep.dev: + rule: + r_id: 9115 + rv_id: 1262923 + rule_id: bwUwy8 + version_id: jQTn5nj + url: https://semgrep.dev/playground/r/jQTn5nj/go.lang.security.audit.crypto.math_random.math-random-used + origin: community + message: Do not use `math/rand`. Use `crypto/rand` instead. + languages: + - go + severity: WARNING + patterns: + - pattern-either: + - pattern: 'import $RAND "$MATH" + + ' + - pattern: 'import "$MATH" + + ' + - metavariable-regex: + metavariable: $MATH + regex: ^(math/rand(\/v[0-9]+)*)$ + - pattern-either: + - pattern-inside: '... + + rand.$FUNC(...) + + ' + - pattern-inside: '... + + $RAND.$FUNC(...) + + ' + - focus-metavariable: + - $MATH + fix: 'crypto/rand + + ' +- id: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + message: '`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as + the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where + it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer + 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13'' to the TLS configuration + to bump the minimum version to TLS 1.3.' + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go + references: + - https://go.dev/doc/go1.22#minor_library_changes + - https://pkg.go.dev/crypto/tls#:~:text=MinVersion + - https://www.us-cert.gov/ncas/alerts/TA14-290A + category: security + technology: + - go + confidence: HIGH + subcategory: + - audit + likelihood: MEDIUM + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + shortlink: https://sg.run/oxEN + semgrep.dev: + rule: + r_id: 9116 + rv_id: 1262924 + rule_id: NbUk4X + version_id: 1QTypyp + url: https://semgrep.dev/playground/r/1QTypyp/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + origin: community + languages: + - go + severity: WARNING + patterns: + - pattern: 'tls.Config{ $...CONF } + + ' + - pattern-not: 'tls.Config{..., MinVersion: ..., ...} + + ' + fix: 'tls.Config{ $...CONF, MinVersion: tls.VersionTLS13 } + + ' +- id: go.lang.security.audit.crypto.sha224-hash.sha224-hash + pattern-either: + - patterns: + - pattern-inside: 'import "crypto/sha256" + + ... + + ' + - pattern-either: + - pattern: 'sha256.New224() + + ' + - pattern: 'sha256.Sum224(...) + + ' + - patterns: + - pattern-inside: 'import "golang.org/x/crypto/sha3" + + ... + + ' + - pattern-either: + - pattern: 'sha3.New224() + + ' + - pattern: 'sha3.Sum224(...) + + ' + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating + to a stronger hash function such as SHA-384 or higher to ensure compliance and security. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + category: security + technology: + - go + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf + - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/go.lang.security.audit.crypto.sha224-hash.sha224-hash + shortlink: https://sg.run/ReJwY + semgrep.dev: + rule: + r_id: 151749 + rv_id: 1262925 + rule_id: GdUvElR + version_id: 9lT4b4w + url: https://semgrep.dev/playground/r/9lT4b4w/go.lang.security.audit.crypto.sha224-hash.sha224-hash + origin: community +- id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + message: SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use + 'tls.VersionTLS13'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go + references: + - https://golang.org/doc/go1.14#crypto/tls + - https://www.us-cert.gov/ncas/alerts/TA14-290A + category: security + technology: + - go + confidence: HIGH + subcategory: + - vuln + likelihood: MEDIUM + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + shortlink: https://sg.run/zvE1 + semgrep.dev: + rule: + r_id: 9117 + rv_id: 1262926 + rule_id: kxUkJ2 + version_id: yeTxpxj + url: https://semgrep.dev/playground/r/yeTxpxj/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + origin: community + languages: + - go + severity: WARNING + fix-regex: + regex: VersionSSL30 + replacement: VersionTLS13 + pattern: 'tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}' +- id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher + message: Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' + to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other + cipher suites to use. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go + references: + - https://golang.org/pkg/crypto/tls/#InsecureCipherSuites + category: security + technology: + - go + confidence: HIGH + subcategory: + - vuln + likelihood: HIGH + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher + shortlink: https://sg.run/px8N + semgrep.dev: + rule: + r_id: 9118 + rv_id: 1262927 + rule_id: wdUJYk + version_id: rxTAKAZ + url: https://semgrep.dev/playground/r/rxTAKAZ/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher + origin: community + languages: + - go + severity: WARNING + pattern-either: + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}} + + ' + - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...} + + ' +- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES + message: Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use + AES instead. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + source-rule-url: https://github.com/securego/gosec#available-rules + category: security + technology: + - go + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES + shortlink: https://sg.run/jREA + semgrep.dev: + rule: + r_id: 9121 + rv_id: 1262930 + rule_id: eqU8B3 + version_id: kbTzGzA + url: https://semgrep.dev/playground/r/kbTzGzA/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES + origin: community + patterns: + - pattern-inside: 'import "crypto/des" + + ... + + ' + - pattern-either: + - pattern: 'des.NewTripleDESCipher(...) + + ' + - pattern: 'des.NewCipher(...) + + ' +- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use SHA256 or SHA3 instead. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + source-rule-url: https://github.com/securego/gosec#available-rules + category: security + technology: + - go + confidence: MEDIUM + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 + shortlink: https://sg.run/2xB5 + semgrep.dev: + rule: + r_id: 9119 + rv_id: 1262928 + rule_id: x8Un6q + version_id: bZT535Y + url: https://semgrep.dev/playground/r/bZT535Y/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 + origin: community + patterns: + - pattern-inside: 'import "crypto/md5" + + ... + + ' + - pattern-either: + - pattern: 'md5.New() + + ' + - pattern: 'md5.Sum(...) + + ' +- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 + message: Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + source-rule-url: https://github.com/securego/gosec#available-rules + category: security + technology: + - go + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 + shortlink: https://sg.run/1ZAD + semgrep.dev: + rule: + r_id: 9122 + rv_id: 1262931 + rule_id: v8Unl0 + version_id: w8TRoRQ + url: https://semgrep.dev/playground/r/w8TRoRQ/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 + origin: community + patterns: + - pattern-inside: 'import "crypto/rc4" + + ... + + ' + - pattern: rc4.NewCipher(...) +- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + source-rule-url: https://github.com/securego/gosec#available-rules + category: security + technology: + - go + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 + shortlink: https://sg.run/XBYA + semgrep.dev: + rule: + r_id: 9120 + rv_id: 1262929 + rule_id: OrU31O + version_id: NdTzyz1 + url: https://semgrep.dev/playground/r/NdTzyz1/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 + origin: community + patterns: + - pattern-inside: 'import "crypto/sha1" + + ... + + ' + - pattern-either: + - pattern: 'sha1.New() + + ' + - pattern: 'sha1.Sum(...) + + ' +- id: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key + message: RSA keys should be at least 2048 bits + languages: + - go + severity: WARNING + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec/blob/master/rules/rsa.go + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms + category: security + technology: + - go + confidence: HIGH + subcategory: + - audit + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key + shortlink: https://sg.run/9oY4 + semgrep.dev: + rule: + r_id: 9123 + rv_id: 1262932 + rule_id: d8UjY3 + version_id: xyTjz8L + url: https://semgrep.dev/playground/r/xyTjz8L/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key + origin: community + patterns: + - pattern-either: + - pattern: 'rsa.GenerateKey(..., $BITS) + + ' + - pattern: 'rsa.GenerateMultiPrimeKey(..., $BITS) + + ' + - metavariable-comparison: + metavariable: $BITS + comparison: $BITS < 2048 + - focus-metavariable: + - $BITS + fix: '2048 + + ' +- id: go.lang.security.audit.dangerous-command-write.dangerous-command-write + patterns: + - pattern: '$CW.Write($BYTE) + + ' + - pattern-inside: '$CW,$ERR := $CMD.StdinPipe() + + ... + + ' + - pattern-not: '$CW.Write("...") + + ' + - pattern-not: '$CW.Write([]byte("...")) + + ' + - pattern-not: '$CW.Write([]byte("..."+"...")) + + ' + - pattern-not-inside: '$BYTE = []byte("..."); + + ... + + ' + - pattern-not-inside: '$BYTE = []byte("..."+"..."); + + ... + + ' + - pattern-inside: 'import "os/exec" + + ... + + ' + message: Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this + call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary + code. + severity: ERROR + languages: + - go + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + category: security + technology: + - go + confidence: LOW + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/go.lang.security.audit.dangerous-command-write.dangerous-command-write + shortlink: https://sg.run/Bko5 + semgrep.dev: + rule: + r_id: 9107 + rv_id: 1262933 + rule_id: pKUOZ9 + version_id: O9Tpx8N + url: https://semgrep.dev/playground/r/O9Tpx8N/go.lang.security.audit.dangerous-command-write.dangerous-command-write + origin: community +- id: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd + patterns: + - pattern-either: + - patterns: + - pattern: 'exec.Cmd {...,Path: $CMD,...} + + ' + - pattern-not: 'exec.Cmd {...,Path: "...",...} + + ' + - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); + + ... + + ' + - pattern-not-inside: '$CMD = "..."; + + ... + + ' + - patterns: + - pattern: 'exec.Cmd {...,Args: $ARGS,...} + + ' + - pattern-not: 'exec.Cmd {...,Args: []string{...},...} + + ' + - pattern-not-inside: '$ARGS = []string{"...",...}; + + ... + + ' + - pattern-not-inside: '$CMD = "..."; + + ... + + $ARGS = []string{$CMD,...}; + + ... + + ' + - pattern-not-inside: '$CMD = exec.LookPath("..."); + + ... + + $ARGS = []string{$CMD,...}; + + ... + + ' + - patterns: + - pattern: 'exec.Cmd {...,Args: []string{$CMD,...},...} + + ' + - pattern-not: 'exec.Cmd {...,Args: []string{"...",...},...} + + ' + - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); + + ... + + ' + - pattern-not-inside: '$CMD = "..."; + + ... + + ' + - patterns: + - pattern-either: + - pattern: 'exec.Cmd {...,Args: []string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...},...} + + ' + - patterns: + - pattern: 'exec.Cmd {...,Args: []string{$CMD,"-c",$EXE,...},...} + + ' + - pattern-inside: '$CMD,$ERR := exec.LookPath("=~/(sh|bash|ksh|csh|tcsh|zsh)/"); + + ... + + ' + - pattern-not: 'exec.Cmd {...,Args: []string{"...","...","...",...},...} + + ' + - pattern-not-inside: '$EXE = "..."; + + ... + + ' + - pattern-inside: 'import "os/exec" + + ... + + ' + message: Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this + call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary + code. + metadata: + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - go + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd + shortlink: https://sg.run/Dorj + semgrep.dev: + rule: + r_id: 9108 + rv_id: 1262934 + rule_id: 2ZUb8l + version_id: e1Tyjeg + url: https://semgrep.dev/playground/r/e1Tyjeg/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd + origin: community + severity: ERROR + languages: + - go +- id: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command + patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: 'exec.Command($CMD,...) + + ' + - pattern: 'exec.CommandContext($CTX,$CMD,...) + + ' + - pattern-not: 'exec.Command("...",...) + + ' + - pattern-not: 'exec.CommandContext($CTX,"...",...) + + ' + - patterns: + - pattern-either: + - pattern: 'exec.Command("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$CMD,...) + + ' + - pattern: 'exec.CommandContext($CTX,"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$CMD,...) + + ' + - pattern-not: 'exec.Command("...","...","...",...) + + ' + - pattern-not: 'exec.CommandContext($CTX,"...","...","...",...) + + ' + - pattern-either: + - pattern: 'exec.Command("=~/\/bin\/env/","=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$CMD,...) + + ' + - pattern: 'exec.CommandContext($CTX,"=~/\/bin\/env/","=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$CMD,...) + + ' + - pattern-inside: 'import "os/exec" + + ... + + ' + - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); + + ... + + ' + - pattern-not-inside: '$CMD = "..."; + + ... + + ' + message: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach + this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary + code. + metadata: + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - go + confidence: LOW + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command + shortlink: https://sg.run/W8lA + semgrep.dev: + rule: + r_id: 9109 + rv_id: 1262935 + rule_id: X5U8RQ + version_id: vdT06Xp + url: https://semgrep.dev/playground/r/vdT06Xp/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command + origin: community + severity: ERROR + languages: + - go +- id: go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec + patterns: + - pattern-either: + - patterns: + - pattern: 'syscall.$METHOD($BIN,...) + + ' + - pattern-not: 'syscall.$METHOD("...",...) + + ' + - pattern-not-inside: '$BIN,$ERR := exec.LookPath("..."); + + ... + + ' + - pattern-not-inside: '$BIN = "..."; + + ... + + ' + - patterns: + - pattern: 'syscall.$METHOD($BIN,$ARGS,...) + + ' + - pattern-not: 'syscall.$METHOD($BIN,[]string{"...",...},...) + + ' + - pattern-not-inside: '$ARGS := []string{"...",...}; + + ... + + ' + - pattern-not-inside: '$CMD = "..."; + + ... + + $ARGS = []string{$CMD,...}; + + ... + + ' + - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); + + ... + + $ARGS = []string{$CMD,...}; + + ... + + ' + - patterns: + - pattern: 'syscall.$METHOD($BIN,[]string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...},...) + + ' + - pattern-not: 'syscall.$METHOD($BIN,[]string{"...","...","...",...},...) + + ' + - patterns: + - pattern: 'syscall.$METHOD($BIN,$ARGS,...) + + ' + - pattern-either: + - pattern-inside: '$ARGS := []string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...}; + + ... + + ' + - pattern-inside: '$CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/"; + + ... + + $ARGS = []string{$CMD,"-c",$EXE,...}; + + ... + + ' + - pattern-inside: '$CMD,$ERR := exec.LookPath("=~/(sh|bash|ksh|csh|tcsh|zsh)/"); + + ... + + $ARGS = []string{$CMD,"-c",$EXE,...}; + + ... + + ' + - pattern-not-inside: '$ARGS := []string{"...","...","...",...}; + + ... + + ' + - pattern-not-inside: '$CMD = "..."; + + ... + + $ARGS = []string{$CMD,"...","...",...}; + + ... + + ' + - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); + + ... + + $ARGS = []string{$CMD,"...","...",...}; + + ... + + ' + - pattern-inside: 'import "syscall" + + ... + + ' + - metavariable-regex: + metavariable: $METHOD + regex: (Exec|ForkExec) + message: Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this + call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary + code. + metadata: + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - go + confidence: LOW + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec + shortlink: https://sg.run/0QRb + semgrep.dev: + rule: + r_id: 9110 + rv_id: 1262936 + rule_id: j2UvPl + version_id: d6Tyx3j + url: https://semgrep.dev/playground/r/d6Tyx3j/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec + origin: community + severity: ERROR + languages: + - go +- id: go.lang.security.audit.database.string-formatted-query.string-formatted-query + languages: + - go + message: String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. + Audit this call to ensure the SQL is not manipulable by external data. + severity: WARNING + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + source-rule-url: https://github.com/securego/gosec + category: security + technology: + - go + confidence: LOW + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query + shortlink: https://sg.run/ydEr + semgrep.dev: + rule: + r_id: 9124 + rv_id: 1262937 + rule_id: ZqU5bD + version_id: ZRTKA2q + url: https://semgrep.dev/playground/r/ZRTKA2q/go.lang.security.audit.database.string-formatted-query.string-formatted-query + origin: community + patterns: + - metavariable-regex: + metavariable: $OBJ + regex: (?i).*(db|database) + - pattern-not-inside: '$VAR = "..." + "..." + + ... + + $OBJ.$SINK(..., $VAR, ...) + + ' + - pattern-not: $OBJ.Exec("...") + - pattern-not: $OBJ.ExecContext($CTX, "...") + - pattern-not: $OBJ.Query("...") + - pattern-not: $OBJ.QueryContext($CTX, "...") + - pattern-not: $OBJ.QueryRow("...") + - pattern-not: $OBJ.QueryRow($CTX, "...") + - pattern-not: $OBJ.QueryRowContext($CTX, "...") + - pattern-either: + - pattern: $OBJ.Exec($X + ...) + - pattern: $OBJ.ExecContext($CTX, $X + ...) + - pattern: $OBJ.Query($X + ...) + - pattern: $OBJ.QueryContext($CTX, $X + ...) + - pattern: $OBJ.QueryRow($X + ...) + - pattern: $OBJ.QueryRow($CTX, $X + ...) + - pattern: $OBJ.QueryRowContext($CTX, $X + ...) + - pattern: $OBJ.Exec(fmt.$P("...", ...)) + - pattern: $OBJ.ExecContext($CTX, fmt.$P("...", ...)) + - pattern: $OBJ.Query(fmt.$P("...", ...)) + - pattern: $OBJ.QueryContext($CTX, fmt.$P("...", ...)) + - pattern: $OBJ.QueryRow(fmt.$P("...", ...)) + - pattern: $OBJ.QueryRow($CTX, fmt.$U("...", ...)) + - pattern: $OBJ.QueryRowContext($CTX, fmt.$P("...", ...)) + - patterns: + - pattern-either: + - pattern: $QUERY = fmt.Fprintf($F, "$SQLSTR", ...) + - pattern: $QUERY = fmt.Sprintf("$SQLSTR", ...) + - pattern: $QUERY = fmt.Printf("$SQLSTR", ...) + - pattern: $QUERY = $X + ... + - pattern-either: + - pattern-inside: "func $FUNC(...) {\n ...\n $OBJ.Query($QUERY, ...)\n ...\n}\n" + - pattern-inside: "func $FUNC(...) {\n ...\n $OBJ.ExecContext($CTX, $QUERY, ...)\n ...\n}\n" + - pattern-inside: "func $FUNC(...) {\n ...\n $OBJ.Exec($QUERY, ...)\n ...\n}\n" + - pattern-inside: "func $FUNC(...) {\n ...\n $OBJ.QueryRow($CTX, $QUERY)\n ...\n}\n" + - pattern-inside: "func $FUNC(...) {\n ...\n $OBJ.QueryRow($QUERY)\n ...\n}\n" + - pattern-inside: "func $FUNC(...) {\n ...\n $OBJ.QueryContext($CTX, $QUERY)\n ...\n}\n" + - pattern-inside: "func $FUNC(...) {\n ...\n $OBJ.QueryRowContext($CTX, $QUERY, ...)\n ...\n}\n" +- id: go.lang.security.audit.md5-used-as-password.md5-used-as-password + languages: + - go + severity: WARNING + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked + by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` + package. + options: + interfile: true + metadata: + category: security + technology: + - md5 + references: + - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html + - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords + - https://github.com/returntocorp/semgrep-rules/issues/1609 + - https://pkg.go.dev/golang.org/x/crypto/bcrypt + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password + shortlink: https://sg.run/4eOE + semgrep.dev: + rule: + r_id: 14688 + rv_id: 1262938 + rule_id: 4bU1Wj + version_id: nWT2L9r + url: https://semgrep.dev/playground/r/nWT2L9r/go.lang.security.audit.md5-used-as-password.md5-used-as-password + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: md5.New + - pattern: md5.Sum + pattern-sinks: + - patterns: + - pattern: $FUNCTION(...) + - metavariable-regex: + metavariable: $FUNCTION + regex: (?i)(.*password.*) +- id: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces + message: Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server + publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty + string. + languages: + - go + severity: WARNING + metadata: + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://github.com/securego/gosec + category: security + technology: + - go + confidence: HIGH + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces + shortlink: https://sg.run/rdE0 + semgrep.dev: + rule: + r_id: 9125 + rv_id: 1262939 + rule_id: nJUz3J + version_id: ExTExoK + url: https://semgrep.dev/playground/r/ExTExoK/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces + origin: community + pattern-either: + - pattern: tls.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) + - pattern: net.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) + - pattern: tls.Listen($NETWORK, "=~/^:.*$/", ...) + - pattern: net.Listen($NETWORK, "=~/^:.*$/", ...) +- id: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + patterns: + - pattern-not-inside: "http.Cookie{\n ...,\n HttpOnly: true,\n ...,\n}\n" + - pattern: "http.Cookie{\n ...,\n}\n" + message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the + browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by + setting 'HttpOnly' to 'true' in the Cookie. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go + - https://golang.org/src/net/http/cookie.go + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + shortlink: https://sg.run/b73e + semgrep.dev: + rule: + r_id: 9126 + rv_id: 1262940 + rule_id: EwU2Z6 + version_id: 7ZTE3BW + url: https://semgrep.dev/playground/r/7ZTE3BW/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + origin: community + fix-regex: + regex: (HttpOnly\s*:\s+)false + replacement: \1true + severity: WARNING + languages: + - go +- id: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure + patterns: + - pattern-not-inside: "http.Cookie{\n ...,\n Secure: true,\n ...,\n}\n" + - pattern: "http.Cookie{\n ...,\n}\n" + message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client + from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' + in the Options struct. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go + - https://golang.org/src/net/http/cookie.go + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure + shortlink: https://sg.run/N4G7 + semgrep.dev: + rule: + r_id: 9127 + rv_id: 1262941 + rule_id: 7KUQ8X + version_id: LjTkgGE + url: https://semgrep.dev/playground/r/LjTkgGE/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure + origin: community + fix-regex: + regex: (Secure\s*:\s+)false + replacement: \1true + severity: WARNING + languages: + - go +- id: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace + message: Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for + '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events + occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined. + metadata: + cwe: + - 'CWE-913: Improper Control of Dynamically-Managed Code Resources' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://github.com/returntocorp/semgrep-rules/issues/518 + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace + shortlink: https://sg.run/kXEK + semgrep.dev: + rule: + r_id: 9128 + rv_id: 1262942 + rule_id: L1Uyjp + version_id: 8KT5rNv + url: https://semgrep.dev/playground/r/8KT5rNv/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace + origin: community + patterns: + - pattern-not-inside: 'package $PACKAGE + + ... + + &httptrace.ClientTrace { ... } + + ... + + ' + - pattern: httptrace.WithClientTrace($ANY, $TRACE) + severity: WARNING + languages: + - go +- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string + message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely + sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://golang.org/pkg/html/template/#HTML + category: security + technology: + - go + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string + shortlink: https://sg.run/weE0 + semgrep.dev: + rule: + r_id: 9129 + rv_id: 1262943 + rule_id: 8GUjDW + version_id: gETB7Pe + url: https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string + origin: community + languages: + - go + severity: WARNING + patterns: + - pattern-not: template.HTML("..." + "...") + - pattern-either: + - pattern: template.HTML($T + $X, ...) + - pattern: template.HTML(fmt.$P("...", ...), ...) + - pattern: '$T = "..." + + ... + + $T = $FXN(..., $T, ...) + + ... + + template.HTML($T, ...) + + ' + - pattern: '$T = fmt.$P("...", ...) + + ... + + template.HTML($T, ...) + + ' + - pattern: '$T, $ERR = fmt.$P("...", ...) + + ... + + template.HTML($T, ...) + + ' + - pattern: '$T = $X + $Y + + ... + + template.HTML($T, ...) + + ' + - pattern: '$T = "..." + + ... + + $OTHER, $ERR = fmt.$P(..., $T, ...) + + ... + + template.HTML($OTHER, ...)' +- id: go.lang.security.audit.net.fs-directory-listing.fs-directory-listing + message: 'Detected usage of ''http.FileServer'' as handler: this allows directory listing and an attacker could navigate + through directories looking for sensitive files. Be sure to disable directory listing or restrict access to specific directories/files.' + severity: WARNING + languages: + - go + patterns: + - pattern-either: + - patterns: + - pattern-inside: '$FS := http.FileServer(...) + + ... + + ' + - pattern-either: + - pattern: 'http.ListenAndServe(..., $FS) + + ' + - pattern: 'http.ListenAndServeTLS(..., $FS) + + ' + - pattern: 'http.Handle(..., $FS) + + ' + - pattern: 'http.HandleFunc(..., $FS) + + ' + - patterns: + - pattern: 'http.$FN(..., http.FileServer(...)) + + ' + - metavariable-regex: + metavariable: $FN + regex: (ListenAndServe|ListenAndServeTLS|Handle|HandleFunc) + metadata: + category: security + cwe: + - 'CWE-548: Exposure of Information Through Directory Listing' + owasp: + - A06:2017 - Security Misconfiguration + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://github.com/OWASP/Go-SCP + - https://cwe.mitre.org/data/definitions/548.html + confidence: MEDIUM + technology: + - go + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing + shortlink: https://sg.run/4R8x + semgrep.dev: + rule: + r_id: 21300 + rv_id: 1262944 + rule_id: 5rU9JO + version_id: QkTGqX0 + url: https://semgrep.dev/playground/r/QkTGqX0/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing + origin: community +- id: go.lang.security.audit.net.pprof.pprof-debug-exposure + metadata: + cwe: + - 'CWE-489: Active Debug Code' + owasp: A06:2017 - Security Misconfiguration + source-rule-url: https://github.com/securego/gosec#available-rules + references: + - https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ + category: security + technology: + - go + confidence: LOW + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Active Debug Code + source: https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure + shortlink: https://sg.run/x1Ep + semgrep.dev: + rule: + r_id: 9130 + rv_id: 945583 + rule_id: gxU1Kp + version_id: 9lTy168 + url: https://semgrep.dev/playground/r/9lTy168/go.lang.security.audit.net.pprof.pprof-debug-exposure + origin: community + message: The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the + server. Instead, use `import "net/http/pprof"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ + for more information and mitigation. + languages: + - go + severity: WARNING + patterns: + - pattern-inside: 'import _ "net/http/pprof" + + ... + + ' + - pattern-inside: "func $ANY(...) {\n ...\n}\n" + - pattern-not-inside: '$MUX = http.NewServeMux(...) + + ... + + http.ListenAndServe($ADDR, $MUX) + + ' + - pattern-not: http.ListenAndServe("=~/^localhost.*/", ...) + - pattern-not: http.ListenAndServe("=~/^127[.]0[.]0[.]1.*/", ...) + - pattern: http.ListenAndServe(...) +- id: go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr + message: Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. + Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing + it into the template. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://golang.org/pkg/html/template/#HTMLAttr + category: security + technology: + - go + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr + shortlink: https://sg.run/OPRp + semgrep.dev: + rule: + r_id: 9131 + rv_id: 1262945 + rule_id: QrUz9R + version_id: 3ZT4XRr + url: https://semgrep.dev/playground/r/3ZT4XRr/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr + origin: community + languages: + - go + severity: WARNING + pattern-either: + - pattern: template.HTMLAttr($T + $X, ...) + - pattern: template.HTMLAttr(fmt.$P("...", ...), ...) + - pattern: '$T = "..." + + ... + + $T = $FXN(..., $T, ...) + + ... + + template.HTMLAttr($T, ...) + + ' + - pattern: '$T = fmt.$P("...", ...) + + ... + + template.HTMLAttr($T, ...) + + ' + - pattern: '$T, $ERR = fmt.$P("...", ...) + + ... + + template.HTMLAttr($T, ...) + + ' + - pattern: '$T = $X + $Y + + ... + + template.HTMLAttr($T, ...) + + ' + - pattern: '$T = "..." + + ... + + $OTHER, $ERR = fmt.$P(..., $T, ...) + + ... + + template.HTMLAttr($OTHER, ...)' +- id: go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js + message: Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely + sure there is no user-controlled data in this template. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://golang.org/pkg/html/template/#JS + category: security + technology: + - go + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js + shortlink: https://sg.run/eLNl + semgrep.dev: + rule: + r_id: 9132 + rv_id: 1262946 + rule_id: 3qUP8K + version_id: 44TEj9E + url: https://semgrep.dev/playground/r/44TEj9E/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js + origin: community + languages: + - go + severity: WARNING + pattern-either: + - pattern: template.JS($T + $X, ...) + - pattern: template.JS(fmt.$P("...", ...), ...) + - pattern: '$T = "..." + + ... + + $T = $FXN(..., $T, ...) + + ... + + template.JS($T, ...) + + ' + - pattern: '$T = fmt.$P("...", ...) + + ... + + template.JS($T, ...) + + ' + - pattern: '$T, $ERR = fmt.$P("...", ...) + + ... + + template.JS($T, ...) + + ' + - pattern: '$T = $X + $Y + + ... + + template.JS($T, ...) + + ' + - pattern: '$T = "..." + + ... + + $OTHER, $ERR = fmt.$P(..., $T, ...) + + ... + + template.JS($OTHER, ...) + + ' +- id: go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url + message: Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this + could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this + function or make sure that no user-controlled input is coming into the function. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://golang.org/pkg/html/template/#URL + category: security + technology: + - go + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url + shortlink: https://sg.run/vzE4 + semgrep.dev: + rule: + r_id: 9133 + rv_id: 1262947 + rule_id: 4bUkDW + version_id: PkTR3zz + url: https://semgrep.dev/playground/r/PkTR3zz/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url + origin: community + languages: + - go + severity: WARNING + pattern-either: + - pattern: template.URL($T + $X, ...) + - pattern: template.URL(fmt.$P("...", ...), ...) + - pattern: '$T = "..." + + ... + + $T = $FXN(..., $T, ...) + + ... + + template.URL($T, ...) + + ' + - pattern: '$T = fmt.$P("...", ...) + + ... + + template.URL($T, ...) + + ' + - pattern: '$T, $ERR = fmt.$P("...", ...) + + ... + + template.URL($T, ...) + + ' + - pattern: '$T = $X + $Y + + ... + + template.URL($T, ...) + + ' + - pattern: '$T = "..." + + ... + + $OTHER, $ERR = fmt.$P(..., $T, ...) + + ... + + template.URL($OTHER, ...)' +- id: go.lang.security.audit.net.use-tls.use-tls + pattern: http.ListenAndServe($ADDR, $HANDLER) + fix: http.ListenAndServeTLS($ADDR, certFile, keyFile, $HANDLER) + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://golang.org/pkg/net/http/#ListenAndServeTLS + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls + shortlink: https://sg.run/dKbY + semgrep.dev: + rule: + r_id: 9134 + rv_id: 1262948 + rule_id: PeUZ8X + version_id: JdTzxkn + url: https://semgrep.dev/playground/r/JdTzxkn/go.lang.security.audit.net.use-tls.use-tls + origin: community + message: Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS + for more information. + languages: + - go + severity: WARNING +- id: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf + patterns: + - pattern-inside: "func $FUNC(..., $W http.ResponseWriter, ...) {\n ...\n var $TEMPLATE = \"...\"\n ...\n $W.Write([]byte(fmt.$PRINTF($TEMPLATE,\ + \ ...)), ...)\n ...\n}\n" + - pattern-either: + - pattern: '$PARAMS = r.URL.Query() + + ... + + $DATA, $ERR := $PARAMS[...] + + ... + + $INTERM = $ANYTHING(..., $DATA, ...) + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) + + ' + - pattern: '$PARAMS = r.URL.Query() + + ... + + $DATA, $ERR := $PARAMS[...] + + ... + + $INTERM = $DATA[...] + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) + + ' + - pattern: '$DATA, $ERR := r.URL.Query()[...] + + ... + + $INTERM = $DATA[...] + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) + + ' + - pattern: '$DATA, $ERR := r.URL.Query()[...] + + ... + + $INTERM = $ANYTHING(..., $DATA, ...) + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) + + ' + - pattern: '$PARAMS = r.URL.Query() + + ... + + $DATA, $ERR := $PARAMS[...] + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $DATA, ...))) + + ' + message: Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and + should not be done. If you must do this, ensure your data is sanitized or escaped. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - go + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf + shortlink: https://sg.run/Zvon + semgrep.dev: + rule: + r_id: 9135 + rv_id: 1262949 + rule_id: JDUyXB + version_id: 5PTo1qr + url: https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf + origin: community + severity: WARNING + languages: + - go +- id: go.lang.security.audit.reflect-makefunc.reflect-makefunc + message: '''reflect.MakeFunc'' detected. This will sidestep protections that are normally afforded by Go''s type system. + Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will + have a serious security vulnerability.' + metadata: + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-913: Improper Control of Dynamically-Managed Code Resources' + category: security + technology: + - go + confidence: LOW + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc + shortlink: https://sg.run/KlPd + semgrep.dev: + rule: + r_id: 9111 + rv_id: 1262950 + rule_id: 10UKGb + version_id: GxTkeqB + url: https://semgrep.dev/playground/r/GxTkeqB/go.lang.security.audit.reflect-makefunc.reflect-makefunc + origin: community + severity: ERROR + pattern: reflect.MakeFunc(...) + languages: + - go +- id: go.lang.security.audit.sqli.gosql-sqli.gosql-sqli + patterns: + - pattern-either: + - patterns: + - pattern: $DB.$METHOD(...,$QUERY,...) + - pattern-either: + - pattern-inside: '$QUERY = $X + $Y + + ... + + ' + - pattern-inside: '$QUERY += $X + + ... + + ' + - pattern-inside: '$QUERY = fmt.Sprintf("...", $PARAM1, ...) + + ... + + ' + - pattern-not-inside: '$QUERY += "..." + + ... + + ' + - pattern-not-inside: '$QUERY = "..." + "..." + + ... + + ' + - pattern: $DB.$METHOD(..., $X + $Y, ...) + - pattern: $DB.$METHOD(..., fmt.Sprintf("...", $PARAM1, ...), ...) + - pattern-either: + - pattern-inside: '$DB, ... = sql.Open(...) + + ... + + ' + - pattern-inside: "func $FUNCNAME(..., $DB *sql.DB, ...) {\n ...\n}\n" + - pattern-not: $DB.$METHOD(..., "..." + "...", ...) + - metavariable-regex: + metavariable: $METHOD + regex: ^(Exec|ExecContent|Query|QueryContext|QueryRow|QueryRowContext)$ + languages: + - go + message: Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead + to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use + parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' + calls. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://golang.org/pkg/database/sql/ + category: security + technology: + - go + confidence: LOW + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli + shortlink: https://sg.run/YgOX + semgrep.dev: + rule: + r_id: 10258 + rv_id: 1262951 + rule_id: YGUrnQ + version_id: RGT0Lpr + url: https://semgrep.dev/playground/r/RGT0Lpr/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli + origin: community + severity: ERROR +- id: go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli + patterns: + - pattern-inside: "import (\n ...\n \"$IMPORT\"\n)\n...\n" + - metavariable-regex: + metavariable: $IMPORT + regex: .*go-pg + - pattern-either: + - patterns: + - pattern: $DB.$METHOD(...,$QUERY,...) + - pattern-either: + - pattern-inside: '$QUERY = $X + $Y + + ... + + ' + - pattern-inside: '$QUERY += $X + + ... + + ' + - pattern-inside: '$QUERY = fmt.Sprintf("...", $PARAM1, ...) + + ... + + ' + - pattern-not-inside: '$QUERY += "..." + + ... + + ' + - pattern-not-inside: '$QUERY = "..." + "..." + + ... + + ' + - pattern: '$DB.$INTFUNC1(...).$METHOD(..., $X + $Y, ...).$INTFUNC2(...) + + ' + - pattern: '$DB.$METHOD(..., fmt.Sprintf("...", $PARAM1, ...), ...) + + ' + - pattern-inside: '$DB = pg.Connect(...) + + ... + + ' + - pattern-inside: "func $FUNCNAME(..., $DB *pg.DB, ...) {\n ...\n}\n" + - pattern-not-inside: '$QUERY = fmt.Sprintf("...", ...,"...", ...) + + ... + + ' + - pattern-not-inside: '$QUERY += "..." + + ... + + ' + - pattern-not: $DB.$METHOD(...,"...",...) + - pattern-not: '$DB.$INTFUNC1(...).$METHOD(..., "...", ...).$INTFUNC2(...) + + ' + - pattern-not-inside: '$QUERY = "..." + "..." + + ' + - pattern-not: '"..." + + ' + - pattern-not: path.Join(...) + - pattern-not: filepath.Join(...) + - metavariable-regex: + metavariable: $METHOD + regex: ^(Where|WhereOr|Join|GroupExpr|OrderExpr|ColumnExpr)$ + languages: + - go + message: Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL + injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use + strings concatenated with user-controlled input. Instead, use parameterized statements. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://pg.uptrace.dev/queries/ + category: security + technology: + - go-pg + confidence: LOW + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli + shortlink: https://sg.run/6rA6 + semgrep.dev: + rule: + r_id: 10259 + rv_id: 1262952 + rule_id: 6JUqQ1 + version_id: A8Tgdqn + url: https://semgrep.dev/playground/r/A8Tgdqn/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli + origin: community + severity: ERROR +- id: go.lang.security.audit.sqli.pg-sqli.pg-sqli + languages: + - go + message: 'Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection + if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries + instead of string concatenation. You can use parameterized queries like so: ''(SELECT ? FROM table, data1)''' + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://pg.uptrace.dev/ + - https://pkg.go.dev/github.com/go-pg/pg/v10 + category: security + technology: + - go-pg + confidence: LOW + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.lang.security.audit.sqli.pg-sqli.pg-sqli + shortlink: https://sg.run/Al94 + semgrep.dev: + rule: + r_id: 10294 + rv_id: 1262953 + rule_id: AbUWXY + version_id: BjTkZbQ + url: https://semgrep.dev/playground/r/BjTkZbQ/go.lang.security.audit.sqli.pg-sqli.pg-sqli + origin: community + severity: ERROR + patterns: + - pattern-either: + - patterns: + - pattern: '$DB.$METHOD(...,$QUERY,...) + + ' + - pattern-either: + - pattern-inside: '$QUERY = $X + $Y + + ... + + ' + - pattern-inside: '$QUERY += $X + + ... + + ' + - pattern-inside: '$QUERY = fmt.Sprintf("...", $PARAM1, ...) + + ... + + ' + - pattern-not-inside: '$QUERY += "..." + + ... + + ' + - pattern-not-inside: '$QUERY = "..." + "..." + + ... + + ' + - pattern: $DB.$METHOD(..., $X + $Y, ...) + - pattern: $DB.$METHOD(..., fmt.Sprintf("...", $PARAM1, ...), ...) + - pattern-either: + - pattern-inside: '$DB = pg.Connect(...) + + ... + + ' + - pattern-inside: "func $FUNCNAME(..., $DB *pg.DB, ...) {\n ...\n}\n" + - pattern-not: $DB.$METHOD(..., "..." + "...", ...) + - metavariable-regex: + metavariable: $METHOD + regex: ^(Exec|ExecContext|ExecOne|ExecOneContext|Query|QueryOne|QueryContext|QueryOneContext)$ +- id: go.lang.security.audit.sqli.pgx-sqli.pgx-sqli + languages: + - go + message: 'Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection + if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries + instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)' + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://github.com/jackc/pgx + - https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool + category: security + technology: + - pgx + confidence: LOW + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli + shortlink: https://sg.run/okKN + semgrep.dev: + rule: + r_id: 10260 + rv_id: 1262954 + rule_id: oqUz92 + version_id: DkTRbkL + url: https://semgrep.dev/playground/r/DkTRbkL/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli + origin: community + patterns: + - pattern-either: + - patterns: + - pattern: $DB.$METHOD(...,$QUERY,...) + - pattern-either: + - pattern-inside: '$QUERY = $X + $Y + + ... + + ' + - pattern-inside: '$QUERY += $X + + ... + + ' + - pattern-inside: '$QUERY = fmt.Sprintf("...", $PARAM1, ...) + + ... + + ' + - pattern-not-inside: '$QUERY += "..." + + ... + + ' + - pattern-not-inside: '$QUERY = "..." + "..." + + ... + + ' + - pattern: $DB.$METHOD(..., $X + $Y, ...) + - pattern: $DB.$METHOD(..., fmt.Sprintf("...", $PARAM1, ...), ...) + - pattern-either: + - pattern-inside: '$DB, ... = pgx.Connect(...) + + ... + + ' + - pattern-inside: '$DB, ... = pgx.NewConnPool(...) + + ... + + ' + - pattern-inside: '$DB, ... = pgx.ConnectConfig(...) + + ... + + ' + - pattern-inside: "func $FUNCNAME(..., $DB *pgx.Conn, ...) {\n ...\n}\n" + - pattern-not: $DB.$METHOD(..., "..." + "...", ...) + - metavariable-regex: + metavariable: $METHOD + regex: ^(Exec|ExecEx|Query|QueryEx|QueryRow|QueryRowEx)$ + severity: ERROR +- id: go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name + patterns: + - pattern-either: + - pattern: '$SMTH.MethodByName($NAME,...) + + ' + - pattern: '$SMTH.FieldByName($NAME,...) + + ' + - pattern-not: '$SMTH.MethodByName("...",...) + + ' + - pattern-not: '$SMTH.FieldByName("...",...) + + ' + - pattern-inside: 'import "reflect" + + ... + + ' + message: If an attacker can supply values that the application then uses to determine which method or field to invoke, the + potential exists for the attacker to create control flow paths through the application that were not intended by the application + developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause + the application to behave in an unexpected manner. + metadata: + cwe: + - 'CWE-470: Use of Externally-Controlled Input to Select Classes or Code (''Unsafe Reflection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - go + confidence: LOW + references: + - https://owasp.org/Top10/A03_2021-Injection + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name + shortlink: https://sg.run/R8Xv + semgrep.dev: + rule: + r_id: 10005 + rv_id: 1262955 + rule_id: BYUBdJ + version_id: WrTqK8e + url: https://semgrep.dev/playground/r/WrTqK8e/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name + origin: community + severity: WARNING + languages: + - go +- id: go.lang.security.audit.unsafe.use-of-unsafe-block + message: Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, + but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by + an attacker. Only use this package if you absolutely know what you're doing. + languages: + - go + severity: WARNING + metadata: + cwe: + - 'CWE-242: Use of Inherently Dangerous Function' + source_rule_url: https://github.com/securego/gosec/blob/master/rules/unsafe.go + category: security + technology: + - go + confidence: LOW + references: + - https://cwe.mitre.org/data/definitions/242.html + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Dangerous Method or Function + source: https://semgrep.dev/r/go.lang.security.audit.unsafe.use-of-unsafe-block + shortlink: https://sg.run/qxEx + semgrep.dev: + rule: + r_id: 9112 + rv_id: 945595 + rule_id: 9AU1p1 + version_id: ZRT35Wd + url: https://semgrep.dev/playground/r/ZRT35Wd/go.lang.security.audit.unsafe.use-of-unsafe-block + origin: community + pattern: unsafe.$FUNC(...) +- id: go.lang.security.audit.xss.import-text-template.import-text-template + message: When working with web applications that involve rendering user-generated content, it's important to properly escape + any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not automatically + escape HTML content, which can leave your application vulnerable to these types of attacks. To mitigate this risk, it's recommended + to use the `html/template` package instead, which provides built-in functionality for HTML escaping. By using `html/template` + to render your HTML content, you can help to ensure that your web application is more secure and less susceptible to + XSS vulnerabilities. + metadata: + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + references: + - https://www.veracode.com/blog/secure-development/use-golang-these-mistakes-could-compromise-your-apps-security + category: security + technology: + - go + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.xss.import-text-template.import-text-template + shortlink: https://sg.run/ndEO + semgrep.dev: + rule: + r_id: 9136 + rv_id: 1262956 + rule_id: 5rUOZQ + version_id: 0bTKzok + url: https://semgrep.dev/playground/r/0bTKzok/go.lang.security.audit.xss.import-text-template.import-text-template + origin: community + severity: WARNING + patterns: + - pattern: 'import "$IMPORT" + + ' + - metavariable-regex: + metavariable: $IMPORT + regex: ^(text/template)$ + - focus-metavariable: $IMPORT + fix: 'html/template + + ' + languages: + - go +- id: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter + languages: + - go + message: Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents + cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. + metadata: + category: security + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ + technology: + - go + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter + shortlink: https://sg.run/EkbA + semgrep.dev: + rule: + r_id: 9137 + rv_id: 1262957 + rule_id: GdU71y + version_id: K3TKkoB + url: https://semgrep.dev/playground/r/K3TKkoB/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter + origin: community + patterns: + - pattern-either: + - pattern-inside: "func $HANDLER(..., $WRITER http.ResponseWriter, ...) {\n ...\n}\n" + - pattern-inside: "func $HANDLER(..., $WRITER *http.ResponseWriter, ...) {\n ...\n}\n" + - pattern-inside: "func(..., $WRITER http.ResponseWriter, ...) {\n ...\n}\n" + - pattern-either: + - pattern: $WRITER.Write(...) + - pattern: (*$WRITER).Write(...) + - pattern-not: $WRITER.Write([]byte("...")) + severity: WARNING +- id: go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter + message: Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site + scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. + metadata: + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + references: + - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ + category: security + technology: + - go + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter + shortlink: https://sg.run/7oqR + semgrep.dev: + rule: + r_id: 9138 + rv_id: 1262958 + rule_id: ReUgyJ + version_id: qkTR7OP + url: https://semgrep.dev/playground/r/qkTR7OP/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter + origin: community + severity: WARNING + patterns: + - pattern-either: + - pattern-inside: "func $HANDLER(..., $WRITER http.ResponseWriter, ...) {\n ...\n}\n" + - pattern-inside: "func(..., $WRITER http.ResponseWriter, ...) {\n ...\n}\n" + - pattern-not: fmt.$PRINTF($WRITER, "...") + - pattern: fmt.$PRINTF($WRITER, ...) + languages: + - go +- id: go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag + message: Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting + (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit + tags instead. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://github.com/golang/go/issues/19669 + - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ + category: security + technology: + - generic + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag + shortlink: https://sg.run/LwJJ + semgrep.dev: + rule: + r_id: 9139 + rv_id: 1262959 + rule_id: AbUzBB + version_id: l4TJRZK + url: https://semgrep.dev/playground/r/l4TJRZK/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag + origin: community + languages: + - generic + severity: WARNING + paths: + include: + - '*.html' + - '*.thtml' + - '*.gohtml' + - '*.tmpl' + - '*.tpl' + pattern: <{{ ... }} ... > +- id: go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string + message: Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site + scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. + Instead, obtain this variable outside of the template string and ensure your template is properly escaped. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://github.com/golang/go/issues/9200#issuecomment-66100328 + - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ + category: security + technology: + - generic + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string + shortlink: https://sg.run/8yl7 + semgrep.dev: + rule: + r_id: 9140 + rv_id: 1262960 + rule_id: BYUNR6 + version_id: YDTZeEB + url: https://semgrep.dev/playground/r/YDTZeEB/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string + origin: community + languages: + - generic + severity: WARNING + paths: + include: + - '*.html' + - '*.thtml' + - '*.gohtml' + - '*.tmpl' + - '*.tpl' + patterns: + - pattern-inside: + - pattern: '` ... {{ ... }} ...`' +- id: go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter + message: Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents + cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. + metadata: + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + references: + - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ + - https://golang.org/pkg/io/#WriteString + category: security + technology: + - go + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter + shortlink: https://sg.run/gLwn + semgrep.dev: + rule: + r_id: 9141 + rv_id: 1262961 + rule_id: DbUpEr + version_id: 6xT2983 + url: https://semgrep.dev/playground/r/6xT2983/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter + origin: community + severity: WARNING + patterns: + - pattern-either: + - pattern-inside: "func $HANDLER(..., $WRITER http.ResponseWriter, ...) {\n ...\n}\n" + - pattern-inside: "func(..., $WRITER http.ResponseWriter, ...) {\n ...\n}\n" + - pattern-not: io.WriteString($WRITER, "...") + - pattern: io.WriteString($WRITER, $STRING) + languages: + - go +- id: go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter + message: Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site + scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. + metadata: + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + references: + - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ + category: security + technology: + - go + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter + shortlink: https://sg.run/Q5BP + semgrep.dev: + rule: + r_id: 9142 + rv_id: 1262962 + rule_id: WAUoLp + version_id: o5TbDdq + url: https://semgrep.dev/playground/r/o5TbDdq/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter + origin: community + severity: WARNING + patterns: + - pattern-either: + - pattern-inside: "func $HANDLER(..., $WRITER http.ResponseWriter, ...) {\n ...\n}\n" + - pattern-inside: "func(..., $WRITER http.ResponseWriter, ...) {\n ...\n}\n" + - pattern: '$WRITER.Write(<... fmt.$PRINTF(...) ...>, ...) + + ' + languages: + - go +- id: go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type + message: Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar + does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach + this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://golang.org/pkg/html/template/#HTML + - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33 + category: security + technology: + - go + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type + shortlink: https://sg.run/3xDb + semgrep.dev: + rule: + r_id: 9143 + rv_id: 1262963 + rule_id: 0oU5n3 + version_id: zyTb2Lz + url: https://semgrep.dev/playground/r/zyTb2Lz/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type + origin: community + languages: + - go + severity: WARNING + patterns: + - pattern-not: template.$ANY("..." + "...") + - pattern-not: template.$ANY("...") + - pattern-either: + - pattern: template.HTML(...) + - pattern: template.CSS(...) + - pattern: template.HTMLAttr(...) + - pattern: template.JS(...) + - pattern: template.JSStr(...) + - pattern: template.Srcset(...) + - pattern: template.URL(...) +- id: go.lang.security.audit.xxe.parsing-external-entities-enabled.parsing-external-entities-enabled + patterns: + - pattern-inside: 'import ("github.com/lestrrat-go/libxml2/parser") + + ... + + ' + - pattern: $PARSER := parser.New(parser.XMLParseNoEnt) + message: Detected enabling of "XMLParseNoEnt", which allows parsing of external entities and can lead to XXE if user controlled + data is parsed by the library. Instead, do not enable "XMLParseNoEnt" or be sure to adequately sanitize user-controlled + data when it is being parsed by this library. + languages: + - go + severity: WARNING + metadata: + category: security + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://knowledge-base.secureflag.com/vulnerabilities/xml_injection/xml_entity_expansion_go_lang.html + - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing + technology: + - libxml2 + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/go.lang.security.audit.xxe.parsing-external-entities-enabled.parsing-external-entities-enabled + shortlink: https://sg.run/A51w + semgrep.dev: + rule: + r_id: 18794 + rv_id: 1262964 + rule_id: WAUdLP + version_id: pZT03n5 + url: https://semgrep.dev/playground/r/pZT03n5/go.lang.security.audit.xxe.parsing-external-entities-enabled.parsing-external-entities-enabled + origin: community +- id: go.lang.security.bad_tmp.bad-tmp-file-creation + message: File creation in shared tmp directory without using `io.CreateTemp`. + languages: + - go + severity: WARNING + metadata: + cwe: + - 'CWE-377: Insecure Temporary File' + source-rule-url: https://github.com/securego/gosec + category: security + technology: + - go + confidence: LOW + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + - https://pkg.go.dev/io/ioutil#TempFile + - https://pkg.go.dev/os#CreateTemp + - https://github.com/securego/gosec/blob/5fd2a370447223541cddb35da8d1bc707b7bb153/rules/tempfiles.go#L67 + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation + shortlink: https://sg.run/Gejn + semgrep.dev: + rule: + r_id: 9104 + rv_id: 1262965 + rule_id: 6JUjnL + version_id: 2KTv2pJ + url: https://semgrep.dev/playground/r/2KTv2pJ/go.lang.security.bad_tmp.bad-tmp-file-creation + origin: community + pattern-either: + - pattern: ioutil.WriteFile("=~//tmp/.*$/", ...) + - pattern: os.Create("=~//tmp/.*$/", ...) + - pattern: os.WriteFile("=~//tmp/.*$/", ...) +- id: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb + message: 'Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate + this attack. `io.CopyN()` can specify a size. ' + severity: WARNING + languages: + - go + patterns: + - pattern-either: + - pattern: io.Copy(...) + - pattern: io.CopyBuffer(...) + - pattern-either: + - pattern-inside: 'gzip.NewReader(...) + + ... + + ' + - pattern-inside: 'zlib.NewReader(...) + + ... + + ' + - pattern-inside: 'zlib.NewReaderDict(...) + + ... + + ' + - pattern-inside: 'bzip2.NewReader(...) + + ... + + ' + - pattern-inside: 'flate.NewReader(...) + + ... + + ' + - pattern-inside: 'flate.NewReaderDict(...) + + ... + + ' + - pattern-inside: 'lzw.NewReader(...) + + ... + + ' + - pattern-inside: 'tar.NewReader(...) + + ... + + ' + - pattern-inside: 'zip.NewReader(...) + + ... + + ' + - pattern-inside: 'zip.OpenReader(...) + + ... + + ' + fix-regex: + regex: (.*)(Copy|CopyBuffer)\((.*?),(.*?)(\)|,.*\)) + replacement: \1CopyN(\3, \4, 1024*1024*256) + metadata: + cwe: + - 'CWE-400: Uncontrolled Resource Consumption' + source-rule-url: https://github.com/securego/gosec + references: + - https://golang.org/pkg/io/#CopyN + - https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go + category: security + technology: + - go + confidence: LOW + cwe2022-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Denial-of-Service (DoS) + source: https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb + shortlink: https://sg.run/RodK + semgrep.dev: + rule: + r_id: 9105 + rv_id: 945606 + rule_id: oqUeqn + version_id: JdTDye5 + url: https://semgrep.dev/playground/r/JdTDye5/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb + origin: community +- id: go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface + languages: + - go + message: Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security vulnerabilities + (CWE-502). Use a concrete struct type instead. + severity: WARNING + metadata: + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + category: security + technology: + - go + confidence: HIGH + likelihood: MEDIUM + impact: HIGH + subcategory: + - vuln + references: + - https://cwe.mitre.org/data/definitions/502.html + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface + shortlink: https://sg.run/6WbKL + semgrep.dev: + rule: + r_id: 274359 + rv_id: 1409387 + rule_id: 4bUAQDG + version_id: ZRTDkjk + url: https://semgrep.dev/playground/r/ZRTDkjk/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface + origin: community + patterns: + - pattern-either: + - pattern: 'var $VAR interface{} + + ... + + json.Unmarshal($DATA, &$VAR) + + ' + - pattern: 'var $VAR interface{} + + ... + + yaml.Unmarshal($DATA, &$VAR) + + ' + - pattern: 'var $VAR interface{} + + ... + + xml.Unmarshal($DATA, &$VAR) + + ' +- id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse + message: '`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest + path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal + attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path, + "/")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.' + severity: ERROR + languages: + - go + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + pattern-sinks: + - patterns: + - pattern-either: + - pattern: filepath.Clean($...INNER) + - pattern: path.Clean($...INNER) + pattern-sanitizers: + - pattern-either: + - pattern: '"/" + ... + + ' + fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/"))) + options: + interfile: true + metadata: + references: + - https://pkg.go.dev/path#Clean + - http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html + - https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/ + - https://dzx.cz/2021/04/02/go_path_traversal/ + - https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - go + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse + shortlink: https://sg.run/ZKzw + semgrep.dev: + rule: + r_id: 18235 + rv_id: 1262967 + rule_id: qNUQJe + version_id: jQTn5Bj + url: https://semgrep.dev/playground/r/jQTn5Bj/go.lang.security.filepath-clean-misuse.filepath-clean-misuse + origin: community +- id: go.lang.security.injection.open-redirect.open-redirect + languages: + - go + severity: WARNING + message: An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, + potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input + to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices + to restrict the URL to domains in an allowlist. + options: + interfile: true + metadata: + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + references: + - https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html + category: security + technology: + - go + confidence: HIGH + description: An HTTP redirect was found to be crafted from user-input leading to an open redirect vulnerability + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect + shortlink: https://sg.run/2ZW45 + semgrep.dev: + rule: + r_id: 113619 + rv_id: 945608 + rule_id: DbU6RlN + version_id: GxTP7J7 + url: https://semgrep.dev/playground/r/GxTP7J7/go.lang.security.injection.open-redirect.open-redirect + origin: community + mode: taint + pattern-sources: + - label: INPUT + patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + - label: CLEAN + requires: INPUT + patterns: + - pattern-either: + - pattern: '"$URLSTR" + $INPUT + + ' + - patterns: + - pattern-either: + - pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...) + - pattern: fmt.Sprintf("$URLSTR", $INPUT, ...) + - pattern: fmt.Printf("$URLSTR", $INPUT, ...) + - metavariable-regex: + metavariable: $URLSTR + regex: .*//[a-zA-Z0-10]+\..* + pattern-sinks: + - requires: INPUT and not CLEAN + patterns: + - pattern: http.Redirect($W, $REQ, $URL, ...) + - focus-metavariable: $URL +- id: go.lang.security.injection.raw-html-format.raw-html-format + languages: + - go + severity: WARNING + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect + that the HTML is rendered safely. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - go + references: + - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format + shortlink: https://sg.run/3r1G + semgrep.dev: + rule: + r_id: 14443 + rv_id: 1262968 + rule_id: PeUonQ + version_id: 1QTyp2p + url: https://semgrep.dev/playground/r/1QTyp2p/go.lang.security.injection.raw-html-format.raw-html-format + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + pattern-sanitizers: + - pattern: html.EscapeString(...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: fmt.Printf("$HTMLSTR", ...) + - pattern: fmt.Sprintf("$HTMLSTR", ...) + - pattern: fmt.Fprintf($W, "$HTMLSTR", ...) + - pattern: '"$HTMLSTR" + ...' + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... +- id: go.lang.security.injection.tainted-sql-string.tainted-sql-string + languages: + - go + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using + prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of + SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements + (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library. + options: + interfile: true + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://golang.org/doc/database/sql-injection + - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/ + category: security + technology: + - go + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/PbEq + semgrep.dev: + rule: + r_id: 14689 + rv_id: 1409388 + rule_id: PeUoqy + version_id: nWTQ5qD + url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string + origin: community + mode: taint + severity: ERROR + pattern-sources: + - patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$SQLSTR" + ... + + ' + - patterns: + - pattern-inside: '$VAR = "$SQLSTR"; + + ... + + ' + - pattern: $VAR += ... + - patterns: + - pattern-inside: 'var $SB strings.Builder + + ... + + ' + - pattern-inside: '$SB.WriteString("$SQLSTR") + + ... + + $SB.String(...) + + ' + - pattern: '$SB.WriteString(...) + + ' + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(select|delete|insert|create|update|alter|drop).* + - patterns: + - pattern-either: + - pattern: fmt.Fprintf($F, "$SQLSTR", ...) + - pattern: fmt.Sprintf("$SQLSTR", ...) + - pattern: fmt.Printf("$SQLSTR", ...) + - metavariable-regex: + metavariable: $SQLSTR + regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* + pattern-sanitizers: + - pattern-either: + - pattern: strconv.Atoi(...) + - pattern: '($X: bool) + + ' +- id: go.lang.security.injection.tainted-url-host.tainted-url-host + languages: + - go + message: A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) + vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft + the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the + request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist. + options: + interfile: true + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://goteleport.com/blog/ssrf-attacks/ + category: security + technology: + - go + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host + shortlink: https://sg.run/5DjW + semgrep.dev: + rule: + r_id: 14391 + rv_id: 1262970 + rule_id: AbUQLr + version_id: yeTxpOj + url: https://semgrep.dev/playground/r/yeTxpOj/go.lang.security.injection.tainted-url-host.tainted-url-host + origin: community + mode: taint + pattern-sources: + - label: INPUT + patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + - label: CLEAN + requires: INPUT + patterns: + - pattern-either: + - pattern: '"$URLSTR" + $INPUT + + ' + - patterns: + - pattern-either: + - pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...) + - pattern: fmt.Sprintf("$URLSTR", $INPUT, ...) + - pattern: fmt.Printf("$URLSTR", $INPUT, ...) + - metavariable-regex: + metavariable: $URLSTR + regex: .*//[a-zA-Z0-10]+\..* + pattern-sinks: + - requires: INPUT and not CLEAN + patterns: + - pattern-either: + - patterns: + - pattern-either: + - patterns: + - pattern-inside: '$CLIENT := &http.Client{...} + + ... + + ' + - pattern: $CLIENT.$METHOD($URL, ...) + - pattern: http.$METHOD($URL, ...) + - metavariable-regex: + metavariable: $METHOD + regex: ^(Get|Head|Post|PostForm)$ + - patterns: + - pattern: 'http.NewRequest("$METHOD", $URL, ...) + + ' + - metavariable-regex: + metavariable: $METHOD + regex: ^(GET|HEAD|POST|POSTFORM)$ + - focus-metavariable: $URL + severity: WARNING +- id: go.lang.security.reverseproxy-director.reverseproxy-director + message: ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director. + languages: + - go + severity: WARNING + patterns: + - pattern-inside: 'import "net/http/httputil" + + ... + + ' + - pattern-either: + - pattern: $PROXY.Director = $FUNC + - patterns: + - pattern-inside: "httputil.ReverseProxy{\n ...\n}\n" + - pattern: 'Director: $FUNC + + ' + metadata: + cwe: + - 'CWE-115: Misinterpretation of Input' + category: security + subcategory: + - audit + technology: + - go + confidence: MEDIUM + likelihood: LOW + impact: LOW + references: + - https://github.com/golang/go/issues/50580 + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director + shortlink: https://sg.run/9AYYR + semgrep.dev: + rule: + r_id: 146567 + rv_id: 945612 + rule_id: zdUKzzA + version_id: DkTNpvx + url: https://semgrep.dev/playground/r/DkTNpvx/go.lang.security.reverseproxy-director.reverseproxy-director + origin: community +- id: go.lang.security.shared-url-struct-mutation.shared-url-struct-mutation + message: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. + languages: + - go + severity: WARNING + patterns: + - pattern-inside: 'import "net/url" + + ... + + ' + - pattern-not-inside: '... = url.Parse(...) + + ... + + ' + - pattern-not-inside: '... = url.ParseRequestURI(...) + + ... + + ' + - pattern-not-inside: '... = url.URL{...} + + ... + + ' + - pattern-not-inside: 'var $URL *$X.URL + + ... + + ' + - pattern-either: + - pattern: $URL.RawQuery = ... + - pattern: $URL.Path = ... + - pattern: $URL.RawPath = ... + - pattern: $URL.Fragment = ... + - pattern: $URL.RawFragment = ... + - pattern: $URL.Scheme = ... + - pattern: $URL.Opaque = ... + - pattern: $URL.Host = ... + - pattern: $URL.User = ... + - metavariable-pattern: + metavariable: $URL + patterns: + - pattern-not: $X.$Y + - pattern-not: $X[...] + metadata: + cwe: + - 'CWE-436: Interpretation Conflict' + category: security + subcategory: + - audit + technology: + - go + confidence: LOW + likelihood: LOW + impact: LOW + references: + - https://github.com/golang/go/issues/63777 + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/go.lang.security.shared-url-struct-mutation.shared-url-struct-mutation + shortlink: https://sg.run/yyEEd + semgrep.dev: + rule: + r_id: 146568 + rv_id: 945613 + rule_id: pKU1EEO + version_id: WrTEojd + url: https://semgrep.dev/playground/r/WrTEojd/go.lang.security.shared-url-struct-mutation.shared-url-struct-mutation + origin: community +- id: go.lang.security.zip.path-traversal-inside-zip-extraction + message: File traversal when extracting zip archive + metadata: + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + source_rule_url: https://github.com/securego/gosec/issues/205 + category: security + technology: + - go + confidence: LOW + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction + shortlink: https://sg.run/Av64 + semgrep.dev: + rule: + r_id: 9106 + rv_id: 1262971 + rule_id: zdUkoR + version_id: rxTAK1Z + url: https://semgrep.dev/playground/r/rxTAK1Z/go.lang.security.zip.path-traversal-inside-zip-extraction + origin: community + languages: + - go + severity: WARNING + pattern: "reader, $ERR := zip.OpenReader($ARCHIVE)\n...\nfor _, $FILE := range reader.File {\n ...\n path := filepath.Join($TARGET,\ + \ $FILE.Name)\n ...\n}\n" diff --git a/.semgrep/registry/golang.yaml b/.semgrep/registry/golang.yaml new file mode 100644 index 0000000..a6aad0d --- /dev/null +++ b/.semgrep/registry/golang.yaml @@ -0,0 +1,2564 @@ +# GENERATED FILE - DO NOT EDIT. +# Snapshot of Semgrep registry config(s): p/golang +# Rules are fetched from https://semgrep.dev/c/, deduplicated by rule id, +# and sorted. Refresh with: python3 .github/scripts/semgrep_registry.py sync +# (the semgrep-registry-update workflow does this on a schedule). +rules: +- id: go.aws-lambda.security.database-sqli.database-sqli + languages: + - go + message: Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls. + mode: taint + metadata: + references: + - https://pkg.go.dev/database/sql#DB.Query + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - database + - sql + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli + shortlink: https://sg.run/e5e8 + semgrep.dev: + rule: + r_id: 18232 + rv_id: 1262909 + rule_id: WAUdJ7 + version_id: BjTkZkQ + url: https://semgrep.dev/playground/r/BjTkZkQ/go.aws-lambda.security.database-sqli.database-sqli + origin: community + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $DB.Exec($QUERY,...) + - pattern: $DB.ExecContent($QUERY,...) + - pattern: $DB.Query($QUERY,...) + - pattern: $DB.QueryContext($QUERY,...) + - pattern: $DB.QueryRow($QUERY,...) + - pattern: $DB.QueryRowContext($QUERY,...) + - pattern-inside: 'import "database/sql" + + ... + + ' + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: 'func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...} + + ... + + lambda.Start($HANDLER, ...) + + ' + - patterns: + - pattern-inside: 'func $HANDLER($EVENT $TYPE) {...} + + ... + + lambda.Start($HANDLER, ...) + + ' + - pattern-not-inside: 'func $HANDLER($EVENT context.Context) {...} + + ... + + lambda.Start($HANDLER, ...) + + ' + - focus-metavariable: $EVENT + severity: WARNING +- id: go.aws-lambda.security.tainted-sql-string.tainted-sql-string + languages: + - go + severity: ERROR + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction + could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the + database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider + using an object-relational mapper (ORM) such as Sequelize which will protect your queries. + metadata: + references: + - https://owasp.org/www-community/attacks/SQL_Injection + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/vX3Y + semgrep.dev: + rule: + r_id: 18233 + rv_id: 1262910 + rule_id: 0oUwqg + version_id: DkTRbRL + url: https://semgrep.dev/playground/r/DkTRbRL/go.aws-lambda.security.tainted-sql-string.tainted-sql-string + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: 'func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...} + + ... + + lambda.Start($HANDLER, ...) + + ' + - patterns: + - pattern-inside: 'func $HANDLER($EVENT $TYPE) {...} + + ... + + lambda.Start($HANDLER, ...) + + ' + - pattern-not-inside: 'func $HANDLER($EVENT context.Context) {...} + + ... + + lambda.Start($HANDLER, ...) + + ' + - focus-metavariable: $EVENT + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: '"$SQLSTR" + ... + + ' + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(\s*select|\s*delete|\s*insert|\s*create|\s*update|\s*alter|\s*drop).* + - patterns: + - pattern-either: + - pattern: fmt.Fprintf($F, "$SQLSTR", ...) + - pattern: fmt.Sprintf("$SQLSTR", ...) + - pattern: fmt.Printf("$SQLSTR", ...) + - metavariable-regex: + metavariable: $SQLSTR + regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* + - pattern-not-inside: 'log.$PRINT(...) + + ' + pattern-sanitizers: + - pattern: strconv.Atoi(...) +- id: go.gorilla.security.audit.handler-assignment-from-multiple-sources.handler-assignment-from-multiple-sources + metadata: + cwe: + - 'CWE-289: Authentication Bypass by Alternate Name' + category: security + technology: + - gorilla + confidence: MEDIUM + references: + - https://cwe.mitre.org/data/definitions/289.html + subcategory: + - audit + impact: MEDIUM + likelihood: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/go.gorilla.security.audit.handler-assignment-from-multiple-sources.handler-assignment-from-multiple-sources + shortlink: https://sg.run/gL3y + semgrep.dev: + rule: + r_id: 9085 + rv_id: 945538 + rule_id: WAUoBk + version_id: ZRT35xJ + url: https://semgrep.dev/playground/r/ZRT35xJ/go.gorilla.security.audit.handler-assignment-from-multiple-sources.handler-assignment-from-multiple-sources + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-inside: "func $HANDLER(..., $R *http.Request, ...) {\n ...\n}\n" + - focus-metavariable: $R + - pattern-either: + - pattern: $R.query + pattern-sinks: + - patterns: + - pattern: '$Y, err := store.Get(...) + + ... + + $VAR := $Y.Values[...] + + ... + + $VAR = $R + + ' + - focus-metavariable: $R + - patterns: + - pattern: '$Y, err := store.Get(...) + + ... + + var $VAR $INT = $Y.Values["..."].($INT) + + ... + + $VAR = $R + + ' + - focus-metavariable: $R + message: 'Variable $VAR is assigned from two different sources: ''$Y'' and ''$R''. Make sure this is intended, as this could + cause logic bugs if they are treated as they are the same object.' + languages: + - go + severity: WARNING +- id: go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly + patterns: + - pattern-not-inside: "&sessions.Options{\n ...,\n HttpOnly: true,\n ...,\n}\n" + - pattern: "&sessions.Options{\n ...,\n}\n" + message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the + browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by + setting 'HttpOnly' to 'true' in the Options struct. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69 + category: security + technology: + - gorilla + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly + shortlink: https://sg.run/4xJZ + semgrep.dev: + rule: + r_id: 9088 + rv_id: 1262911 + rule_id: qNUj6g + version_id: WrTqKqe + url: https://semgrep.dev/playground/r/WrTqKqe/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly + origin: community + fix-regex: + regex: (HttpOnly\s*:\s+)false + replacement: \1true + severity: WARNING + languages: + - go +- id: go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure + patterns: + - pattern-not-inside: "&sessions.Options{\n ...,\n Secure: true,\n ...,\n}\n" + - pattern: "&sessions.Options{\n ...,\n}\n" + message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client + from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' + in the Options struct. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69 + category: security + technology: + - gorilla + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure + shortlink: https://sg.run/PJdE + semgrep.dev: + rule: + r_id: 9089 + rv_id: 1262912 + rule_id: lBU9kw + version_id: 0bTKzKk + url: https://semgrep.dev/playground/r/0bTKzKk/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure + origin: community + fix-regex: + regex: (Secure\s*:\s+)false + replacement: \1true + severity: WARNING + languages: + - go +- id: go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone + patterns: + - pattern-inside: "&sessions.Options{\n ...,\n SameSite: http.SameSiteNoneMode,\n ...,\n}\n" + - pattern: "&sessions.Options{\n ...,\n}\n" + message: Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default + for enhanced security. + metadata: + cwe: + - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://pkg.go.dev/github.com/gorilla/sessions#Options + category: security + technology: + - gorilla + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone + shortlink: https://sg.run/x8Nwj + semgrep.dev: + rule: + r_id: 133074 + rv_id: 1262913 + rule_id: YGUpGd4 + version_id: K3TKkKB + url: https://semgrep.dev/playground/r/K3TKkKB/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone + origin: community + fix-regex: + regex: (SameSite\s*:\s+)http.SameSiteNoneMode + replacement: \1http.SameSiteDefaultMode + severity: WARNING + languages: + - go +- id: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check + patterns: + - pattern-inside: 'import ("github.com/gorilla/websocket") + + ... + + ' + - patterns: + - pattern-not-inside: '$UPGRADER = websocket.Upgrader{..., CheckOrigin: $FN ,...} + + ... + + ' + - pattern-not-inside: '$UPGRADER.CheckOrigin = $FN2 + + ... + + ' + - pattern: '$UPGRADER.Upgrade(...) + + ' + message: 'The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket + is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per "gorilla/websocket" + documentation: "A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery."' + languages: + - go + severity: WARNING + metadata: + category: security + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://pkg.go.dev/github.com/gorilla/websocket#Upgrader + technology: + - gorilla + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + source: https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check + shortlink: https://sg.run/xXpz + semgrep.dev: + rule: + r_id: 18430 + rv_id: 1262914 + rule_id: ReUKdz + version_id: qkTR7RP + url: https://semgrep.dev/playground/r/qkTR7RP/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check + origin: community +- id: go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage + message: Detected usage of dangerous method $METHOD which does not escape inputs (see link in references). If the argument + is user-controlled, this can lead to SQL injection. When using $METHOD function, do not trust user-submitted data and + only allow approved list of input (possibly, use an allowlist approach). + severity: WARNING + languages: + - go + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + pattern-sinks: + - patterns: + - pattern-inside: 'import ("gorm.io/gorm") + + ... + + ' + - patterns: + - pattern-inside: "func $VAL(..., $GORM *gorm.DB,... ) {\n ...\n}\n" + - pattern-either: + - pattern: '$GORM. ... .$METHOD($VALUE) + + ' + - pattern: '$DB := $GORM. ... .$ANYTHING(...) + + ... + + $DB. ... .$METHOD($VALUE) + + ' + - focus-metavariable: $VALUE + - metavariable-regex: + metavariable: $METHOD + regex: ^(Order|Exec|Raw|Group|Having|Distinct|Select|Pluck)$ + pattern-sanitizers: + - pattern-either: + - pattern: strconv.Atoi(...) + - pattern: '($X: bool) + + ' + options: + interfile: true + metadata: + category: security + technology: + - gorm + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://gorm.io/docs/security.html#SQL-injection-Methods + - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage + shortlink: https://sg.run/R4qg + semgrep.dev: + rule: + r_id: 24693 + rv_id: 1262915 + rule_id: AbU5o3 + version_id: l4TJRJK + url: https://semgrep.dev/playground/r/l4TJRJK/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage + origin: community +- id: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection + metadata: + cwe: + - 'CWE-300: Channel Accessible by Non-Endpoint' + references: + - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption + category: security + technology: + - grpc + confidence: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection + shortlink: https://sg.run/J9yZ + semgrep.dev: + rule: + r_id: 9090 + rv_id: 1262916 + rule_id: PeUZ4X + version_id: YDTZeZB + url: https://semgrep.dev/playground/r/YDTZeZB/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection + origin: community + message: 'Found an insecure gRPC connection using ''grpc.WithInsecure()''. This creates a connection without encryption + to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, + establish a secure connection with an SSL certificate using the ''grpc.WithTransportCredentials()'' function. You can + create a create credentials using a ''tls.Config{}'' struct with ''credentials.NewTLS()''. The final fix looks like this: + ''grpc.WithTransportCredentials(credentials.NewTLS())''.' + languages: + - go + severity: ERROR + pattern: $GRPC.Dial($ADDR, ..., $GRPC.WithInsecure(...), ...) + fix-regex: + regex: (.*)WithInsecure\(.*?\) + replacement: \1WithTransportCredentials(credentials.NewTLS()) +- id: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection + metadata: + cwe: + - 'CWE-300: Channel Accessible by Non-Endpoint' + references: + - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption + category: security + technology: + - grpc + confidence: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection + shortlink: https://sg.run/5Q5l + semgrep.dev: + rule: + r_id: 9091 + rv_id: 1262917 + rule_id: JDUy0B + version_id: 6xT2923 + url: https://semgrep.dev/playground/r/6xT2923/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection + origin: community + message: Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection + without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the + machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create + credentials using 'credentials.NewServerTLSFromFile("cert.pem", "cert.key")'. + languages: + - go + severity: ERROR + mode: taint + pattern-sinks: + - requires: OPTIONS and not CREDS + pattern: grpc.NewServer($OPT, ...) + - requires: EMPTY_CONSTRUCTOR + pattern: grpc.NewServer() + pattern-sources: + - label: OPTIONS + pattern: grpc.ServerOption{ ... } + - label: CREDS + pattern: grpc.Creds(...) + - label: EMPTY_CONSTRUCTOR + pattern: grpc.NewServer() +- id: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified + message: Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're + doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the + signature is valid (because it has been checked previously in the stack) and you want to extract values from it. + metadata: + cwe: + - 'CWE-345: Insufficient Verification of Data Authenticity' + owasp: + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + category: security + technology: + - jwt + confidence: MEDIUM + references: + - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified + shortlink: https://sg.run/Av66 + semgrep.dev: + rule: + r_id: 9094 + rv_id: 1262918 + rule_id: ReUgJJ + version_id: o5TbDbq + url: https://semgrep.dev/playground/r/o5TbDbq/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified + origin: community + languages: + - go + severity: WARNING + patterns: + - pattern-inside: 'import "github.com/dgrijalva/jwt-go" + + ... + + ' + - pattern: '$JWT.ParseUnverified(...) + + ' +- id: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has + already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do + not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + category: security + technology: + - jwt + confidence: HIGH + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm + shortlink: https://sg.run/Gej1 + semgrep.dev: + rule: + r_id: 9092 + rv_id: 1262919 + rule_id: 5rUOWQ + version_id: zyTb2bz + url: https://semgrep.dev/playground/r/zyTb2bz/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm + origin: community + languages: + - go + severity: ERROR + patterns: + - pattern-either: + - pattern-inside: 'import "github.com/golang-jwt/jwt" + + ... + + ' + - pattern-inside: 'import "github.com/dgrijalva/jwt-go" + + ... + + ' + - pattern-either: + - pattern: 'jwt.SigningMethodNone + + ' + - pattern: jwt.UnsafeAllowNoneSignatureType +- id: go.jwt-go.security.jwt.hardcoded-jwt-key + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + options: + interfile: true + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + category: security + technology: + - jwt + - secrets + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key + shortlink: https://sg.run/Rod2 + semgrep.dev: + rule: + r_id: 9093 + rv_id: 1262920 + rule_id: GdU7Ny + version_id: pZT0305 + url: https://semgrep.dev/playground/r/pZT0305/go.jwt-go.security.jwt.hardcoded-jwt-key + origin: community + severity: WARNING + languages: + - go + mode: taint + pattern-sources: + - patterns: + - pattern-inside: '[]byte("$F") + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$TOKEN.SignedString($F) + + ' + - focus-metavariable: $F +- id: go.lang.security.audit.crypto.bad_imports.insecure-module-used + message: The package `net/http/cgi` is on the import blocklist. The package is vulnerable to httpoxy attacks (CVE-2015-5386). + It is recommended to use `net/http` or a web framework to build a web application instead. + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + source-rule-url: https://github.com/securego/gosec + references: + - https://godoc.org/golang.org/x/crypto/sha3 + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used + shortlink: https://sg.run/l2gj + semgrep.dev: + rule: + r_id: 9113 + rv_id: 1262921 + rule_id: yyUnov + version_id: 2KTv2vJ + url: https://semgrep.dev/playground/r/2KTv2vJ/go.lang.security.audit.crypto.bad_imports.insecure-module-used + origin: community + languages: + - go + severity: WARNING + pattern-either: + - patterns: + - pattern-inside: 'import "net/http/cgi" + + ... + + ' + - pattern: 'cgi.$FUNC(...) + + ' +- id: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key + message: Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' + package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn + more about the problem and how to fix it. + metadata: + cwe: + - 'CWE-322: Key Exchange without Entity Authentication' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec + references: + - https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ + - https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key + shortlink: https://sg.run/Yv6X + semgrep.dev: + rule: + r_id: 9114 + rv_id: 1262922 + rule_id: r6UrW9 + version_id: X0TzyzN + url: https://semgrep.dev/playground/r/X0TzyzN/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key + origin: community + languages: + - go + severity: WARNING + pattern: ssh.InsecureIgnoreHostKey() +- id: go.lang.security.audit.crypto.math_random.math-random-used + metadata: + cwe: + - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used + shortlink: https://sg.run/6nK6 + semgrep.dev: + rule: + r_id: 9115 + rv_id: 1262923 + rule_id: bwUwy8 + version_id: jQTn5nj + url: https://semgrep.dev/playground/r/jQTn5nj/go.lang.security.audit.crypto.math_random.math-random-used + origin: community + message: Do not use `math/rand`. Use `crypto/rand` instead. + languages: + - go + severity: WARNING + patterns: + - pattern-either: + - pattern: 'import $RAND "$MATH" + + ' + - pattern: 'import "$MATH" + + ' + - metavariable-regex: + metavariable: $MATH + regex: ^(math/rand(\/v[0-9]+)*)$ + - pattern-either: + - pattern-inside: '... + + rand.$FUNC(...) + + ' + - pattern-inside: '... + + $RAND.$FUNC(...) + + ' + - focus-metavariable: + - $MATH + fix: 'crypto/rand + + ' +- id: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + message: '`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as + the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where + it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer + 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13'' to the TLS configuration + to bump the minimum version to TLS 1.3.' + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go + references: + - https://go.dev/doc/go1.22#minor_library_changes + - https://pkg.go.dev/crypto/tls#:~:text=MinVersion + - https://www.us-cert.gov/ncas/alerts/TA14-290A + category: security + technology: + - go + confidence: HIGH + subcategory: + - audit + likelihood: MEDIUM + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + shortlink: https://sg.run/oxEN + semgrep.dev: + rule: + r_id: 9116 + rv_id: 1262924 + rule_id: NbUk4X + version_id: 1QTypyp + url: https://semgrep.dev/playground/r/1QTypyp/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + origin: community + languages: + - go + severity: WARNING + patterns: + - pattern: 'tls.Config{ $...CONF } + + ' + - pattern-not: 'tls.Config{..., MinVersion: ..., ...} + + ' + fix: 'tls.Config{ $...CONF, MinVersion: tls.VersionTLS13 } + + ' +- id: go.lang.security.audit.crypto.sha224-hash.sha224-hash + pattern-either: + - patterns: + - pattern-inside: 'import "crypto/sha256" + + ... + + ' + - pattern-either: + - pattern: 'sha256.New224() + + ' + - pattern: 'sha256.Sum224(...) + + ' + - patterns: + - pattern-inside: 'import "golang.org/x/crypto/sha3" + + ... + + ' + - pattern-either: + - pattern: 'sha3.New224() + + ' + - pattern: 'sha3.Sum224(...) + + ' + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating + to a stronger hash function such as SHA-384 or higher to ensure compliance and security. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + category: security + technology: + - go + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf + - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/go.lang.security.audit.crypto.sha224-hash.sha224-hash + shortlink: https://sg.run/ReJwY + semgrep.dev: + rule: + r_id: 151749 + rv_id: 1262925 + rule_id: GdUvElR + version_id: 9lT4b4w + url: https://semgrep.dev/playground/r/9lT4b4w/go.lang.security.audit.crypto.sha224-hash.sha224-hash + origin: community +- id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + message: SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use + 'tls.VersionTLS13'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go + references: + - https://golang.org/doc/go1.14#crypto/tls + - https://www.us-cert.gov/ncas/alerts/TA14-290A + category: security + technology: + - go + confidence: HIGH + subcategory: + - vuln + likelihood: MEDIUM + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + shortlink: https://sg.run/zvE1 + semgrep.dev: + rule: + r_id: 9117 + rv_id: 1262926 + rule_id: kxUkJ2 + version_id: yeTxpxj + url: https://semgrep.dev/playground/r/yeTxpxj/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + origin: community + languages: + - go + severity: WARNING + fix-regex: + regex: VersionSSL30 + replacement: VersionTLS13 + pattern: 'tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}' +- id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher + message: Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' + to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other + cipher suites to use. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go + references: + - https://golang.org/pkg/crypto/tls/#InsecureCipherSuites + category: security + technology: + - go + confidence: HIGH + subcategory: + - vuln + likelihood: HIGH + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher + shortlink: https://sg.run/px8N + semgrep.dev: + rule: + r_id: 9118 + rv_id: 1262927 + rule_id: wdUJYk + version_id: rxTAKAZ + url: https://semgrep.dev/playground/r/rxTAKAZ/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher + origin: community + languages: + - go + severity: WARNING + pattern-either: + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}} + + ' + - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...} + + ' +- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES + message: Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use + AES instead. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + source-rule-url: https://github.com/securego/gosec#available-rules + category: security + technology: + - go + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES + shortlink: https://sg.run/jREA + semgrep.dev: + rule: + r_id: 9121 + rv_id: 1262930 + rule_id: eqU8B3 + version_id: kbTzGzA + url: https://semgrep.dev/playground/r/kbTzGzA/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES + origin: community + patterns: + - pattern-inside: 'import "crypto/des" + + ... + + ' + - pattern-either: + - pattern: 'des.NewTripleDESCipher(...) + + ' + - pattern: 'des.NewCipher(...) + + ' +- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use SHA256 or SHA3 instead. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + source-rule-url: https://github.com/securego/gosec#available-rules + category: security + technology: + - go + confidence: MEDIUM + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 + shortlink: https://sg.run/2xB5 + semgrep.dev: + rule: + r_id: 9119 + rv_id: 1262928 + rule_id: x8Un6q + version_id: bZT535Y + url: https://semgrep.dev/playground/r/bZT535Y/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 + origin: community + patterns: + - pattern-inside: 'import "crypto/md5" + + ... + + ' + - pattern-either: + - pattern: 'md5.New() + + ' + - pattern: 'md5.Sum(...) + + ' +- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 + message: Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + source-rule-url: https://github.com/securego/gosec#available-rules + category: security + technology: + - go + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 + shortlink: https://sg.run/1ZAD + semgrep.dev: + rule: + r_id: 9122 + rv_id: 1262931 + rule_id: v8Unl0 + version_id: w8TRoRQ + url: https://semgrep.dev/playground/r/w8TRoRQ/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 + origin: community + patterns: + - pattern-inside: 'import "crypto/rc4" + + ... + + ' + - pattern: rc4.NewCipher(...) +- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + source-rule-url: https://github.com/securego/gosec#available-rules + category: security + technology: + - go + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 + shortlink: https://sg.run/XBYA + semgrep.dev: + rule: + r_id: 9120 + rv_id: 1262929 + rule_id: OrU31O + version_id: NdTzyz1 + url: https://semgrep.dev/playground/r/NdTzyz1/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 + origin: community + patterns: + - pattern-inside: 'import "crypto/sha1" + + ... + + ' + - pattern-either: + - pattern: 'sha1.New() + + ' + - pattern: 'sha1.Sum(...) + + ' +- id: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key + message: RSA keys should be at least 2048 bits + languages: + - go + severity: WARNING + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec/blob/master/rules/rsa.go + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms + category: security + technology: + - go + confidence: HIGH + subcategory: + - audit + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key + shortlink: https://sg.run/9oY4 + semgrep.dev: + rule: + r_id: 9123 + rv_id: 1262932 + rule_id: d8UjY3 + version_id: xyTjz8L + url: https://semgrep.dev/playground/r/xyTjz8L/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key + origin: community + patterns: + - pattern-either: + - pattern: 'rsa.GenerateKey(..., $BITS) + + ' + - pattern: 'rsa.GenerateMultiPrimeKey(..., $BITS) + + ' + - metavariable-comparison: + metavariable: $BITS + comparison: $BITS < 2048 + - focus-metavariable: + - $BITS + fix: '2048 + + ' +- id: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd + patterns: + - pattern-either: + - patterns: + - pattern: 'exec.Cmd {...,Path: $CMD,...} + + ' + - pattern-not: 'exec.Cmd {...,Path: "...",...} + + ' + - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); + + ... + + ' + - pattern-not-inside: '$CMD = "..."; + + ... + + ' + - patterns: + - pattern: 'exec.Cmd {...,Args: $ARGS,...} + + ' + - pattern-not: 'exec.Cmd {...,Args: []string{...},...} + + ' + - pattern-not-inside: '$ARGS = []string{"...",...}; + + ... + + ' + - pattern-not-inside: '$CMD = "..."; + + ... + + $ARGS = []string{$CMD,...}; + + ... + + ' + - pattern-not-inside: '$CMD = exec.LookPath("..."); + + ... + + $ARGS = []string{$CMD,...}; + + ... + + ' + - patterns: + - pattern: 'exec.Cmd {...,Args: []string{$CMD,...},...} + + ' + - pattern-not: 'exec.Cmd {...,Args: []string{"...",...},...} + + ' + - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); + + ... + + ' + - pattern-not-inside: '$CMD = "..."; + + ... + + ' + - patterns: + - pattern-either: + - pattern: 'exec.Cmd {...,Args: []string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...},...} + + ' + - patterns: + - pattern: 'exec.Cmd {...,Args: []string{$CMD,"-c",$EXE,...},...} + + ' + - pattern-inside: '$CMD,$ERR := exec.LookPath("=~/(sh|bash|ksh|csh|tcsh|zsh)/"); + + ... + + ' + - pattern-not: 'exec.Cmd {...,Args: []string{"...","...","...",...},...} + + ' + - pattern-not-inside: '$EXE = "..."; + + ... + + ' + - pattern-inside: 'import "os/exec" + + ... + + ' + message: Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this + call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary + code. + metadata: + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - go + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd + shortlink: https://sg.run/Dorj + semgrep.dev: + rule: + r_id: 9108 + rv_id: 1262934 + rule_id: 2ZUb8l + version_id: e1Tyjeg + url: https://semgrep.dev/playground/r/e1Tyjeg/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd + origin: community + severity: ERROR + languages: + - go +- id: go.lang.security.audit.md5-used-as-password.md5-used-as-password + languages: + - go + severity: WARNING + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked + by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` + package. + options: + interfile: true + metadata: + category: security + technology: + - md5 + references: + - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html + - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords + - https://github.com/returntocorp/semgrep-rules/issues/1609 + - https://pkg.go.dev/golang.org/x/crypto/bcrypt + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password + shortlink: https://sg.run/4eOE + semgrep.dev: + rule: + r_id: 14688 + rv_id: 1262938 + rule_id: 4bU1Wj + version_id: nWT2L9r + url: https://semgrep.dev/playground/r/nWT2L9r/go.lang.security.audit.md5-used-as-password.md5-used-as-password + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: md5.New + - pattern: md5.Sum + pattern-sinks: + - patterns: + - pattern: $FUNCTION(...) + - metavariable-regex: + metavariable: $FUNCTION + regex: (?i)(.*password.*) +- id: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces + message: Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server + publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty + string. + languages: + - go + severity: WARNING + metadata: + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://github.com/securego/gosec + category: security + technology: + - go + confidence: HIGH + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces + shortlink: https://sg.run/rdE0 + semgrep.dev: + rule: + r_id: 9125 + rv_id: 1262939 + rule_id: nJUz3J + version_id: ExTExoK + url: https://semgrep.dev/playground/r/ExTExoK/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces + origin: community + pattern-either: + - pattern: tls.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) + - pattern: net.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) + - pattern: tls.Listen($NETWORK, "=~/^:.*$/", ...) + - pattern: net.Listen($NETWORK, "=~/^:.*$/", ...) +- id: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + patterns: + - pattern-not-inside: "http.Cookie{\n ...,\n HttpOnly: true,\n ...,\n}\n" + - pattern: "http.Cookie{\n ...,\n}\n" + message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the + browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by + setting 'HttpOnly' to 'true' in the Cookie. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go + - https://golang.org/src/net/http/cookie.go + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + shortlink: https://sg.run/b73e + semgrep.dev: + rule: + r_id: 9126 + rv_id: 1262940 + rule_id: EwU2Z6 + version_id: 7ZTE3BW + url: https://semgrep.dev/playground/r/7ZTE3BW/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + origin: community + fix-regex: + regex: (HttpOnly\s*:\s+)false + replacement: \1true + severity: WARNING + languages: + - go +- id: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure + patterns: + - pattern-not-inside: "http.Cookie{\n ...,\n Secure: true,\n ...,\n}\n" + - pattern: "http.Cookie{\n ...,\n}\n" + message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client + from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' + in the Options struct. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go + - https://golang.org/src/net/http/cookie.go + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure + shortlink: https://sg.run/N4G7 + semgrep.dev: + rule: + r_id: 9127 + rv_id: 1262941 + rule_id: 7KUQ8X + version_id: LjTkgGE + url: https://semgrep.dev/playground/r/LjTkgGE/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure + origin: community + fix-regex: + regex: (Secure\s*:\s+)false + replacement: \1true + severity: WARNING + languages: + - go +- id: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace + message: Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for + '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events + occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined. + metadata: + cwe: + - 'CWE-913: Improper Control of Dynamically-Managed Code Resources' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://github.com/returntocorp/semgrep-rules/issues/518 + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace + shortlink: https://sg.run/kXEK + semgrep.dev: + rule: + r_id: 9128 + rv_id: 1262942 + rule_id: L1Uyjp + version_id: 8KT5rNv + url: https://semgrep.dev/playground/r/8KT5rNv/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace + origin: community + patterns: + - pattern-not-inside: 'package $PACKAGE + + ... + + &httptrace.ClientTrace { ... } + + ... + + ' + - pattern: httptrace.WithClientTrace($ANY, $TRACE) + severity: WARNING + languages: + - go +- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string + message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely + sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://golang.org/pkg/html/template/#HTML + category: security + technology: + - go + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string + shortlink: https://sg.run/weE0 + semgrep.dev: + rule: + r_id: 9129 + rv_id: 1262943 + rule_id: 8GUjDW + version_id: gETB7Pe + url: https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string + origin: community + languages: + - go + severity: WARNING + patterns: + - pattern-not: template.HTML("..." + "...") + - pattern-either: + - pattern: template.HTML($T + $X, ...) + - pattern: template.HTML(fmt.$P("...", ...), ...) + - pattern: '$T = "..." + + ... + + $T = $FXN(..., $T, ...) + + ... + + template.HTML($T, ...) + + ' + - pattern: '$T = fmt.$P("...", ...) + + ... + + template.HTML($T, ...) + + ' + - pattern: '$T, $ERR = fmt.$P("...", ...) + + ... + + template.HTML($T, ...) + + ' + - pattern: '$T = $X + $Y + + ... + + template.HTML($T, ...) + + ' + - pattern: '$T = "..." + + ... + + $OTHER, $ERR = fmt.$P(..., $T, ...) + + ... + + template.HTML($OTHER, ...)' +- id: go.lang.security.audit.net.fs-directory-listing.fs-directory-listing + message: 'Detected usage of ''http.FileServer'' as handler: this allows directory listing and an attacker could navigate + through directories looking for sensitive files. Be sure to disable directory listing or restrict access to specific directories/files.' + severity: WARNING + languages: + - go + patterns: + - pattern-either: + - patterns: + - pattern-inside: '$FS := http.FileServer(...) + + ... + + ' + - pattern-either: + - pattern: 'http.ListenAndServe(..., $FS) + + ' + - pattern: 'http.ListenAndServeTLS(..., $FS) + + ' + - pattern: 'http.Handle(..., $FS) + + ' + - pattern: 'http.HandleFunc(..., $FS) + + ' + - patterns: + - pattern: 'http.$FN(..., http.FileServer(...)) + + ' + - metavariable-regex: + metavariable: $FN + regex: (ListenAndServe|ListenAndServeTLS|Handle|HandleFunc) + metadata: + category: security + cwe: + - 'CWE-548: Exposure of Information Through Directory Listing' + owasp: + - A06:2017 - Security Misconfiguration + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://github.com/OWASP/Go-SCP + - https://cwe.mitre.org/data/definitions/548.html + confidence: MEDIUM + technology: + - go + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing + shortlink: https://sg.run/4R8x + semgrep.dev: + rule: + r_id: 21300 + rv_id: 1262944 + rule_id: 5rU9JO + version_id: QkTGqX0 + url: https://semgrep.dev/playground/r/QkTGqX0/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing + origin: community +- id: go.lang.security.audit.net.use-tls.use-tls + pattern: http.ListenAndServe($ADDR, $HANDLER) + fix: http.ListenAndServeTLS($ADDR, certFile, keyFile, $HANDLER) + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://golang.org/pkg/net/http/#ListenAndServeTLS + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls + shortlink: https://sg.run/dKbY + semgrep.dev: + rule: + r_id: 9134 + rv_id: 1262948 + rule_id: PeUZ8X + version_id: JdTzxkn + url: https://semgrep.dev/playground/r/JdTzxkn/go.lang.security.audit.net.use-tls.use-tls + origin: community + message: Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS + for more information. + languages: + - go + severity: WARNING +- id: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf + patterns: + - pattern-inside: "func $FUNC(..., $W http.ResponseWriter, ...) {\n ...\n var $TEMPLATE = \"...\"\n ...\n $W.Write([]byte(fmt.$PRINTF($TEMPLATE,\ + \ ...)), ...)\n ...\n}\n" + - pattern-either: + - pattern: '$PARAMS = r.URL.Query() + + ... + + $DATA, $ERR := $PARAMS[...] + + ... + + $INTERM = $ANYTHING(..., $DATA, ...) + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) + + ' + - pattern: '$PARAMS = r.URL.Query() + + ... + + $DATA, $ERR := $PARAMS[...] + + ... + + $INTERM = $DATA[...] + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) + + ' + - pattern: '$DATA, $ERR := r.URL.Query()[...] + + ... + + $INTERM = $DATA[...] + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) + + ' + - pattern: '$DATA, $ERR := r.URL.Query()[...] + + ... + + $INTERM = $ANYTHING(..., $DATA, ...) + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) + + ' + - pattern: '$PARAMS = r.URL.Query() + + ... + + $DATA, $ERR := $PARAMS[...] + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $DATA, ...))) + + ' + message: Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and + should not be done. If you must do this, ensure your data is sanitized or escaped. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - go + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf + shortlink: https://sg.run/Zvon + semgrep.dev: + rule: + r_id: 9135 + rv_id: 1262949 + rule_id: JDUyXB + version_id: 5PTo1qr + url: https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf + origin: community + severity: WARNING + languages: + - go +- id: go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface + languages: + - go + message: Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security vulnerabilities + (CWE-502). Use a concrete struct type instead. + severity: WARNING + metadata: + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + category: security + technology: + - go + confidence: HIGH + likelihood: MEDIUM + impact: HIGH + subcategory: + - vuln + references: + - https://cwe.mitre.org/data/definitions/502.html + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface + shortlink: https://sg.run/6WbKL + semgrep.dev: + rule: + r_id: 274359 + rv_id: 1409387 + rule_id: 4bUAQDG + version_id: ZRTDkjk + url: https://semgrep.dev/playground/r/ZRTDkjk/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface + origin: community + patterns: + - pattern-either: + - pattern: 'var $VAR interface{} + + ... + + json.Unmarshal($DATA, &$VAR) + + ' + - pattern: 'var $VAR interface{} + + ... + + yaml.Unmarshal($DATA, &$VAR) + + ' + - pattern: 'var $VAR interface{} + + ... + + xml.Unmarshal($DATA, &$VAR) + + ' +- id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse + message: '`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest + path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal + attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path, + "/")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.' + severity: ERROR + languages: + - go + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + pattern-sinks: + - patterns: + - pattern-either: + - pattern: filepath.Clean($...INNER) + - pattern: path.Clean($...INNER) + pattern-sanitizers: + - pattern-either: + - pattern: '"/" + ... + + ' + fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/"))) + options: + interfile: true + metadata: + references: + - https://pkg.go.dev/path#Clean + - http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html + - https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/ + - https://dzx.cz/2021/04/02/go_path_traversal/ + - https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - go + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse + shortlink: https://sg.run/ZKzw + semgrep.dev: + rule: + r_id: 18235 + rv_id: 1262967 + rule_id: qNUQJe + version_id: jQTn5Bj + url: https://semgrep.dev/playground/r/jQTn5Bj/go.lang.security.filepath-clean-misuse.filepath-clean-misuse + origin: community +- id: go.lang.security.injection.open-redirect.open-redirect + languages: + - go + severity: WARNING + message: An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, + potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input + to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices + to restrict the URL to domains in an allowlist. + options: + interfile: true + metadata: + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + references: + - https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html + category: security + technology: + - go + confidence: HIGH + description: An HTTP redirect was found to be crafted from user-input leading to an open redirect vulnerability + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect + shortlink: https://sg.run/2ZW45 + semgrep.dev: + rule: + r_id: 113619 + rv_id: 945608 + rule_id: DbU6RlN + version_id: GxTP7J7 + url: https://semgrep.dev/playground/r/GxTP7J7/go.lang.security.injection.open-redirect.open-redirect + origin: community + mode: taint + pattern-sources: + - label: INPUT + patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + - label: CLEAN + requires: INPUT + patterns: + - pattern-either: + - pattern: '"$URLSTR" + $INPUT + + ' + - patterns: + - pattern-either: + - pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...) + - pattern: fmt.Sprintf("$URLSTR", $INPUT, ...) + - pattern: fmt.Printf("$URLSTR", $INPUT, ...) + - metavariable-regex: + metavariable: $URLSTR + regex: .*//[a-zA-Z0-10]+\..* + pattern-sinks: + - requires: INPUT and not CLEAN + patterns: + - pattern: http.Redirect($W, $REQ, $URL, ...) + - focus-metavariable: $URL +- id: go.lang.security.injection.raw-html-format.raw-html-format + languages: + - go + severity: WARNING + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect + that the HTML is rendered safely. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - go + references: + - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format + shortlink: https://sg.run/3r1G + semgrep.dev: + rule: + r_id: 14443 + rv_id: 1262968 + rule_id: PeUonQ + version_id: 1QTyp2p + url: https://semgrep.dev/playground/r/1QTyp2p/go.lang.security.injection.raw-html-format.raw-html-format + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + pattern-sanitizers: + - pattern: html.EscapeString(...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: fmt.Printf("$HTMLSTR", ...) + - pattern: fmt.Sprintf("$HTMLSTR", ...) + - pattern: fmt.Fprintf($W, "$HTMLSTR", ...) + - pattern: '"$HTMLSTR" + ...' + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... +- id: go.lang.security.injection.tainted-sql-string.tainted-sql-string + languages: + - go + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using + prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of + SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements + (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library. + options: + interfile: true + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://golang.org/doc/database/sql-injection + - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/ + category: security + technology: + - go + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/PbEq + semgrep.dev: + rule: + r_id: 14689 + rv_id: 1409388 + rule_id: PeUoqy + version_id: nWTQ5qD + url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string + origin: community + mode: taint + severity: ERROR + pattern-sources: + - patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$SQLSTR" + ... + + ' + - patterns: + - pattern-inside: '$VAR = "$SQLSTR"; + + ... + + ' + - pattern: $VAR += ... + - patterns: + - pattern-inside: 'var $SB strings.Builder + + ... + + ' + - pattern-inside: '$SB.WriteString("$SQLSTR") + + ... + + $SB.String(...) + + ' + - pattern: '$SB.WriteString(...) + + ' + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(select|delete|insert|create|update|alter|drop).* + - patterns: + - pattern-either: + - pattern: fmt.Fprintf($F, "$SQLSTR", ...) + - pattern: fmt.Sprintf("$SQLSTR", ...) + - pattern: fmt.Printf("$SQLSTR", ...) + - metavariable-regex: + metavariable: $SQLSTR + regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* + pattern-sanitizers: + - pattern-either: + - pattern: strconv.Atoi(...) + - pattern: '($X: bool) + + ' +- id: go.lang.security.injection.tainted-url-host.tainted-url-host + languages: + - go + message: A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) + vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft + the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the + request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist. + options: + interfile: true + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://goteleport.com/blog/ssrf-attacks/ + category: security + technology: + - go + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host + shortlink: https://sg.run/5DjW + semgrep.dev: + rule: + r_id: 14391 + rv_id: 1262970 + rule_id: AbUQLr + version_id: yeTxpOj + url: https://semgrep.dev/playground/r/yeTxpOj/go.lang.security.injection.tainted-url-host.tainted-url-host + origin: community + mode: taint + pattern-sources: + - label: INPUT + patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + - label: CLEAN + requires: INPUT + patterns: + - pattern-either: + - pattern: '"$URLSTR" + $INPUT + + ' + - patterns: + - pattern-either: + - pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...) + - pattern: fmt.Sprintf("$URLSTR", $INPUT, ...) + - pattern: fmt.Printf("$URLSTR", $INPUT, ...) + - metavariable-regex: + metavariable: $URLSTR + regex: .*//[a-zA-Z0-10]+\..* + pattern-sinks: + - requires: INPUT and not CLEAN + patterns: + - pattern-either: + - patterns: + - pattern-either: + - patterns: + - pattern-inside: '$CLIENT := &http.Client{...} + + ... + + ' + - pattern: $CLIENT.$METHOD($URL, ...) + - pattern: http.$METHOD($URL, ...) + - metavariable-regex: + metavariable: $METHOD + regex: ^(Get|Head|Post|PostForm)$ + - patterns: + - pattern: 'http.NewRequest("$METHOD", $URL, ...) + + ' + - metavariable-regex: + metavariable: $METHOD + regex: ^(GET|HEAD|POST|POSTFORM)$ + - focus-metavariable: $URL + severity: WARNING +- id: go.lang.security.reverseproxy-director.reverseproxy-director + message: ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director. + languages: + - go + severity: WARNING + patterns: + - pattern-inside: 'import "net/http/httputil" + + ... + + ' + - pattern-either: + - pattern: $PROXY.Director = $FUNC + - patterns: + - pattern-inside: "httputil.ReverseProxy{\n ...\n}\n" + - pattern: 'Director: $FUNC + + ' + metadata: + cwe: + - 'CWE-115: Misinterpretation of Input' + category: security + subcategory: + - audit + technology: + - go + confidence: MEDIUM + likelihood: LOW + impact: LOW + references: + - https://github.com/golang/go/issues/50580 + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director + shortlink: https://sg.run/9AYYR + semgrep.dev: + rule: + r_id: 146567 + rv_id: 945612 + rule_id: zdUKzzA + version_id: DkTNpvx + url: https://semgrep.dev/playground/r/DkTNpvx/go.lang.security.reverseproxy-director.reverseproxy-director + origin: community diff --git a/.semgrep/registry/javascript.yaml b/.semgrep/registry/javascript.yaml new file mode 100644 index 0000000..58b096d --- /dev/null +++ b/.semgrep/registry/javascript.yaml @@ -0,0 +1,7316 @@ +# GENERATED FILE - DO NOT EDIT. +# Snapshot of Semgrep registry config(s): p/javascript +# Rules are fetched from https://semgrep.dev/c/, deduplicated by rule id, +# and sorted. Refresh with: python3 .github/scripts/semgrep_registry.py sync +# (the semgrep-registry-update workflow does this on a schedule). +rules: +- id: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint + message: Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It + is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved + it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize. + metadata: + confidence: MEDIUM + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + references: + - https://docs.angularjs.org/api/ng/function/angular.element + - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf + category: security + technology: + - angularjs + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint + shortlink: https://sg.run/5AQ0 + semgrep.dev: + rule: + r_id: 21503 + rv_id: 1263091 + rule_id: GdUP71 + version_id: 44TEj8L + url: https://semgrep.dev/playground/r/44TEj8L/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: window.location.search + - pattern: window.document.location.search + - pattern: document.location.search + - pattern: location.search + - pattern: $location.search(...) + - patterns: + - pattern-either: + - pattern: $DECODE(<... location.hash ...>) + - pattern: $DECODE(<... window.location.hash ...>) + - pattern: $DECODE(<... document.location.hash ...>) + - pattern: $DECODE(<... location.href ...>) + - pattern: $DECODE(<... window.location.href ...>) + - pattern: $DECODE(<... document.location.href ...>) + - pattern: $DECODE(<... document.URL ...>) + - pattern: $DECODE(<... window.document.URL ...>) + - pattern: $DECODE(<... document.location.href ...>) + - pattern: $DECODE(<... document.location.href ...>) + - pattern: $DECODE(<... $location.absUrl() ...>) + - pattern: $DECODE(<... $location.url() ...>) + - pattern: $DECODE(<... $location.hash() ...>) + - metavariable-regex: + metavariable: $DECODE + regex: ^(unescape|decodeURI|decodeURIComponent)$ + - patterns: + - pattern-inside: $http.$METHOD(...).$CONTINUE(function $FUNC($RES) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|delete|head|jsonp|post|put|patch) + - pattern: $RES.data + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: 'angular.element(...). ... .$SINK($QUERY) + + ' + - pattern-inside: '$ANGULAR = angular.element(...) + + ... + + $ANGULAR. ... .$SINK($QUERY) + + ' + - metavariable-regex: + metavariable: $SINK + regex: ^(after|append|html|prepend|replaceWith|wrap)$ + - focus-metavariable: $QUERY + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern: $sce.getTrustedHtml(...) + - pattern: $sanitize(...) + - pattern: DOMPurify.sanitize(...) +- id: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled + message: $sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide + additional attack surface for XSS vulnerabilities. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + references: + - https://docs.angularjs.org/api/ng/service/$sce + - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf + category: security + technology: + - angular + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled + shortlink: https://sg.run/N4DG + semgrep.dev: + rule: + r_id: 9227 + rv_id: 1263094 + rule_id: EwU20Z + version_id: 5PTo1EW + url: https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled + origin: community + languages: + - javascript + - typescript + severity: ERROR + pattern: '$sceProvider.enabled(false); + + ' +- id: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method + message: The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API. + metadata: + references: + - https://docs.angularjs.org/api/ng/service/$sce + - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf + category: security + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + technology: + - angular + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method + shortlink: https://sg.run/OPW2 + semgrep.dev: + rule: + r_id: 9231 + rv_id: 1263098 + rule_id: gxU1QX + version_id: BjTkZv0 + url: https://semgrep.dev/playground/r/BjTkZv0/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-inside: 'app.controller(..., function($scope,$sce) { + + ... + + }); + + ' + - pattern: $scope.$X + pattern-sinks: + - pattern: $sce.trustAs(...) + - pattern: $sce.trustAsHtml(...) +- id: javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config + message: Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee + an adversary has no direct access to the computing environment. + metadata: + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html + - https://eprint.iacr.org/2016/759.pdf + - https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf + - https://datatracker.ietf.org/doc/html/rfc9106#section-4 + category: security + cwe: + - 'CWE-916: Use of Password Hash With Insufficient Computational Effort' + technology: + - argon2 + - cryptography + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + impact: LOW + likelihood: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config + shortlink: https://sg.run/ALq4 + semgrep.dev: + rule: + r_id: 20150 + rv_id: 1263103 + rule_id: DbU2X8 + version_id: qkTR7Jk + url: https://semgrep.dev/playground/r/qkTR7Jk/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-inside: '$ARGON = require(''argon2''); + + ... + + ' + - pattern: '{type: ...} + + ' + pattern-sinks: + - patterns: + - pattern: '$Y + + ' + - pattern-inside: '$ARGON.hash(...,$Y) + + ' + pattern-sanitizers: + - patterns: + - pattern: '{type: $ARGON.argon2id}' +- id: javascript.aws-lambda.security.detect-child-process.detect-child-process + message: Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command + injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let + running arbitrary commands, use a white list for inputs. + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - javascript + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process + shortlink: https://sg.run/Ggoq + semgrep.dev: + rule: + r_id: 18248 + rv_id: 1263105 + rule_id: r6UDNQ + version_id: YDTZe4o + url: https://semgrep.dev/playground/r/YDTZe4o/javascript.aws-lambda.security.detect-child-process.detect-child-process + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern: $EVENT + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + pattern-sinks: + - patterns: + - focus-metavariable: $CMD + - pattern-either: + - pattern: exec($CMD,...) + - pattern: execSync($CMD,...) + - pattern: spawn($CMD,...) + - pattern: spawnSync($CMD,...) + - pattern: $CP.exec($CMD,...) + - pattern: $CP.execSync($CMD,...) + - pattern: $CP.spawn($CMD,...) + - pattern: $CP.spawnSync($CMD,...) + - pattern-either: + - pattern-inside: 'require(''child_process'') + + ... + + ' + - pattern-inside: 'import ''child_process'' + + ... + + ' +- id: javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object + message: Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable + is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly + to DynamoDB client. + metadata: + cwe: + - 'CWE-943: Improper Neutralization of Special Elements in Data Query Logic' + owasp: + - A01:2017 - Injection + category: security + technology: + - javascript + - aws-lambda + - dynamodb + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object + shortlink: https://sg.run/X1e4 + semgrep.dev: + rule: + r_id: 21320 + rv_id: 945766 + rule_id: 0oU1xk + version_id: GxTP7gN + url: https://semgrep.dev/playground/r/GxTP7gN/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern: $EVENT + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern: '$DC.$METHOD($SINK, ...) + + ' + - metavariable-regex: + metavariable: $METHOD + regex: (query|send|scan|delete|put|transactWrite|update|batchExecuteStatement|executeStatement|executeTransaction|transactWriteItems) + - pattern-either: + - pattern-inside: '$DC = new $AWS.DocumentClient(...); + + ... + + ' + - pattern-inside: '$DC = new $AWS.DynamoDB(...); + + ... + + ' + - pattern-inside: '$DC = new DynamoDBClient(...); + + ... + + ' + - pattern-inside: '$DC = DynamoDBDocumentClient.from(...); + + ... + + ' + pattern-sanitizers: + - patterns: + - pattern: '{...} + + ' +- id: javascript.aws-lambda.security.knex-sqli.knex-sqli + message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `knex.raw(''SELECT $1 from table'', [userinput])`' + metadata: + references: + - https://knexjs.org/#Builder-fromRaw + - https://knexjs.org/#Builder-whereRaw + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - knex + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli + shortlink: https://sg.run/RgWq + semgrep.dev: + rule: + r_id: 18249 + rv_id: 1263106 + rule_id: bwUBlj + version_id: JdTzxKg + url: https://semgrep.dev/playground/r/JdTzxKg/javascript.aws-lambda.security.knex-sqli.knex-sqli + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern: $EVENT + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $KNEX.fromRaw($QUERY, ...) + - pattern: $KNEX.whereRaw($QUERY, ...) + - pattern: $KNEX.raw($QUERY, ...) + - pattern-either: + - pattern-inside: 'require(''knex'') + + ... + + ' + - pattern-inside: 'import ''knex'' + + ... + + ' +- id: javascript.aws-lambda.security.mysql-sqli.mysql-sqli + message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `connection.query(''SELECT $1 from table'', [userinput])`' + metadata: + references: + - https://www.npmjs.com/package/mysql2 + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - mysql + - mysql2 + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli + shortlink: https://sg.run/A502 + semgrep.dev: + rule: + r_id: 18250 + rv_id: 1263107 + rule_id: NbUBJ2 + version_id: 5PTo1En + url: https://semgrep.dev/playground/r/5PTo1En/javascript.aws-lambda.security.mysql-sqli.mysql-sqli + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern: $EVENT + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $POOL.query($QUERY, ...) + - pattern: $POOL.execute($QUERY, ...) + - pattern-either: + - pattern-inside: 'require(''mysql'') + + ... + + ' + - pattern-inside: 'require(''mysql2'') + + ... + + ' + - pattern-inside: 'require(''mysql2/promise'') + + ... + + ' + - pattern-inside: 'import ''mysql'' + + ... + + ' + - pattern-inside: 'import ''mysql2'' + + ... + + ' + - pattern-inside: 'import ''mysql2/promise'' + + ... + + ' +- id: javascript.aws-lambda.security.pg-sqli.pg-sqli + message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `connection.query(''SELECT $1 from table'', [userinput])`' + metadata: + references: + - https://node-postgres.com/features/queries + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - postgres + - pg + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli + shortlink: https://sg.run/BGKA + semgrep.dev: + rule: + r_id: 18251 + rv_id: 1263108 + rule_id: kxU25P + version_id: GxTkeJL + url: https://semgrep.dev/playground/r/GxTkeJL/javascript.aws-lambda.security.pg-sqli.pg-sqli + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern: $EVENT + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $DB.query($QUERY, ...) + - pattern-either: + - pattern-inside: 'require(''pg'') + + ... + + ' + - pattern-inside: 'import ''pg'' + + ... + + ' +- id: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli + message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `sequelize.query(''SELECT * FROM projects WHERE status = ?'', { + replacements: [''active''], type: QueryTypes.SELECT });`' + metadata: + references: + - https://sequelize.org/master/manual/raw-queries.html + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - sequelize + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli + shortlink: https://sg.run/DAlP + semgrep.dev: + rule: + r_id: 18252 + rv_id: 1263109 + rule_id: wdUA5o + version_id: RGT0LrD + url: https://semgrep.dev/playground/r/RGT0LrD/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern: $EVENT + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $DB.query($QUERY, ...) + - pattern-either: + - pattern-inside: 'require(''sequelize'') + + ... + + ' + - pattern-inside: 'import ''sequelize'' + + ... + + ' +- id: javascript.aws-lambda.security.tainted-html-response.tainted-html-response + message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering + HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers + steal sensitive user data. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response + shortlink: https://sg.run/0Gvj + semgrep.dev: + rule: + r_id: 18254 + rv_id: 1263111 + rule_id: OrUJBY + version_id: BjTkZ8D + url: https://semgrep.dev/playground/r/BjTkZ8D/javascript.aws-lambda.security.tainted-html-response.tainted-html-response + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern: $EVENT + pattern-sinks: + - patterns: + - focus-metavariable: $BODY + - pattern-inside: '{..., headers: {..., ''Content-Type'': ''text/html'', ...}, body: $BODY, ... } + + ' +- id: javascript.aws-lambda.security.tainted-html-string.tainted-html-string + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use + templates which will safely render HTML instead. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string + shortlink: https://sg.run/Lgqr + semgrep.dev: + rule: + r_id: 18483 + rv_id: 1263112 + rule_id: PeUxwW + version_id: DkTRbvp + url: https://semgrep.dev/playground/r/DkTRbvp/javascript.aws-lambda.security.tainted-html-string.tainted-html-string + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern: $EVENT + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$HTMLSTR" + $EXPR + + ' + - pattern: '"$HTMLSTR".concat(...) + + ' + - pattern: $UTIL.format($HTMLSTR, ...) + - pattern: format($HTMLSTR, ...) + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... + - patterns: + - pattern: '`...${...}...` + + ' + - pattern-regex: '.*<\w+.* + + ' + - pattern-not-inside: 'console.$LOG(...) + + ' +- id: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection + message: The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a + security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input + it could result in command injection. Do not let user input in `vm` functions. + metadata: + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + category: security + technology: + - javascript + - aws-lambda + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection + shortlink: https://sg.run/q9w7 + semgrep.dev: + rule: + r_id: 18256 + rv_id: 1263114 + rule_id: v8UOdZ + version_id: 0bTKz9J + url: https://semgrep.dev/playground/r/0bTKz9J/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern: $EVENT + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: 'require(''vm''); + + ... + + ' + - pattern-inside: 'import ''vm'' + + ... + + ' + - pattern-either: + - pattern: $VM.runInContext($X,...) + - pattern: $VM.runInNewContext($X,...) + - pattern: $VM.runInThisContext($X,...) + - pattern: $VM.compileFunction($X,...) + - pattern: new $VM.Script($X,...) + - pattern: new $VM.SourceTextModule($X,...) + - pattern: runInContext($X,...) + - pattern: runInNewContext($X,...) + - pattern: runInThisContext($X,...) + - pattern: compileFunction($X,...) + - pattern: new Script($X,...) + - pattern: new SourceTextModule($X,...) +- id: javascript.browser.security.open-redirect.js-open-redirect + message: The application accepts potentially user-controlled input `$PROP` which can control the location of the current + window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript + URIs. It is recommended to validate user-controllable input before allowing it to control the redirection. + options: + interfile: true + metadata: + interfile: true + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.1 Insecue Redirect + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation + version: '4' + category: security + confidence: HIGH + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html + technology: + - browser + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect + shortlink: https://sg.run/3xRe + semgrep.dev: + rule: + r_id: 9243 + rv_id: 1263122 + rule_id: WAUopl + version_id: pZT03x0 + url: https://semgrep.dev/playground/r/pZT03x0/javascript.browser.security.open-redirect.js-open-redirect + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: 'new URLSearchParams($WINDOW. ... .location.search).get(''...'') + + ' + - pattern: 'new URLSearchParams(location.search).get(''...'') + + ' + - pattern: 'new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get(''...'') + + ' + - pattern: 'new URLSearchParams(location.hash.substring(1)).get(''...'') + + ' + - patterns: + - pattern-either: + - pattern-inside: '$PROPS = new URLSearchParams($WINDOW. ... .location.search) + + ... + + ' + - pattern-inside: '$PROPS = new URLSearchParams(location.search) + + ... + + ' + - pattern-inside: '$PROPS = new URLSearchParams($WINDOW. ... .location.hash.substring(1)) + + ... + + ' + - pattern-inside: '$PROPS = new URLSearchParams(location.hash.substring(1)) + + ... + + ' + - pattern: $PROPS.get('...') + - patterns: + - pattern-either: + - pattern-inside: '$PROPS = new URL($WINDOW. ... .location.href) + + ... + + ' + - pattern-inside: '$PROPS = new URL(location.href) + + ... + + ' + - pattern: $PROPS.searchParams.get('...') + - patterns: + - pattern-either: + - pattern: 'new URL($WINDOW. ... .location.href).searchParams.get(''...'') + + ' + - pattern: 'new URL(location.href).searchParams.get(''...'') + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern: location.href = $SINK + - pattern: $THIS. ... .location.href = $SINK + - pattern: location.replace($SINK) + - pattern: $THIS. ... .location.replace($SINK) + - pattern: location = $SINK + - pattern: $WINDOW. ... .location = $SINK + - focus-metavariable: $SINK + - metavariable-pattern: + patterns: + - pattern-not: '"..." + $VALUE + + ' + - pattern-not: '`...${$VALUE}` + + ' + metavariable: $SINK +- id: javascript.browser.security.raw-html-concat.raw-html-concat + message: User controlled data in a HTML string may result in XSS + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/xss/ + category: security + technology: + - browser + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat + shortlink: https://sg.run/4xAx + semgrep.dev: + rule: + r_id: 9244 + rv_id: 1263123 + rule_id: 0oU5b5 + version_id: 2KTv2wp + url: https://semgrep.dev/playground/r/2KTv2wp/javascript.browser.security.raw-html-concat.raw-html-concat + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: location.href + - pattern: location.hash + - pattern: location.search + - pattern: $WINDOW. ... .location.href + - pattern: $WINDOW. ... .location.hash + - pattern: $WINDOW. ... .location.search + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: $STRING + $EXPR + - pattern-not: $STRING + "..." + - metavariable-pattern: + patterns: + - pattern: <$TAG ... + - pattern-not: <$TAG ...>...... + metavariable: $STRING + language: generic + - patterns: + - pattern: $EXPR + $STRING + - pattern-not: '"..." + $STRING' + - metavariable-pattern: + patterns: + - pattern: '... ,...) + - pattern-not-inside: '$OPTS = <... {name:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.name = ...; + + ... + + $SESSION($OPTS,...); + + ' +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain + message: 'Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare + against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.' + severity: WARNING + languages: + - javascript + - typescript + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + category: security + technology: + - express + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: LOW + confidence: MEDIUM + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain + shortlink: https://sg.run/rd41 + semgrep.dev: + rule: + r_id: 9269 + rv_id: 1263133 + rule_id: ZqU5Pn + version_id: w8TRoyd + url: https://semgrep.dev/playground/r/w8TRoyd/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain + origin: community + patterns: + - pattern-either: + - pattern-inside: '$SESSION = require(''cookie-session''); + + ... + + ' + - pattern-inside: '$SESSION = require(''express-session''); + + ... + + ' + - pattern: $SESSION(...) + - pattern-not-inside: $SESSION(<... {cookie:{domain:...}} ...>,...) + - pattern-not-inside: '$OPTS = <... {cookie:{domain:...}} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE = <... {domain:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie = <... {domain:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE.domain = ...; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie.domain = ...; + + ... + + $SESSION($OPTS,...); + + ' +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires + message: 'Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.' + severity: WARNING + languages: + - javascript + - typescript + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + category: security + technology: + - express + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: LOW + confidence: MEDIUM + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires + shortlink: https://sg.run/N4eG + semgrep.dev: + rule: + r_id: 9271 + rv_id: 1263135 + rule_id: EwU2DZ + version_id: O9TpxRq + url: https://semgrep.dev/playground/r/O9TpxRq/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires + origin: community + patterns: + - pattern-either: + - pattern-inside: '$SESSION = require(''cookie-session''); + + ... + + ' + - pattern-inside: '$SESSION = require(''express-session''); + + ... + + ' + - pattern: $SESSION(...) + - pattern-not-inside: $SESSION(<... {cookie:{expires:...}} ...>,...) + - pattern-not-inside: '$OPTS = <... {cookie:{expires:...}} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE = <... {expires:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie = <... {expires:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE.expires = ...; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie.expires = ...; + + ... + + $SESSION($OPTS,...);' +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly + message: 'Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not + client JavaScript, helping to protect against cross-site scripting attacks.' + severity: WARNING + languages: + - javascript + - typescript + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + category: security + technology: + - express + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: LOW + confidence: MEDIUM + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly + shortlink: https://sg.run/ydBO + semgrep.dev: + rule: + r_id: 9268 + rv_id: 1263132 + rule_id: d8UjGo + version_id: kbTzGev + url: https://semgrep.dev/playground/r/kbTzGev/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly + origin: community + patterns: + - pattern-either: + - pattern-inside: '$SESSION = require(''cookie-session''); + + ... + + ' + - pattern-inside: '$SESSION = require(''express-session''); + + ... + + ' + - pattern: $SESSION(...) + - pattern-not-inside: $SESSION(<... {cookie:{httpOnly:true}} ...>,...) + - pattern-not-inside: '$OPTS = <... {cookie:{httpOnly:true}} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE = <... {httpOnly:true} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie = <... {httpOnly:true} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE.httpOnly = true; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie.httpOnly = true; + + ... + + $SESSION($OPTS,...); + + ' +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path + message: 'Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against + the request path. If this and domain match, then send the cookie in the request.' + severity: WARNING + languages: + - javascript + - typescript + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + category: security + technology: + - express + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: LOW + confidence: MEDIUM + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path + shortlink: https://sg.run/b7pd + semgrep.dev: + rule: + r_id: 9270 + rv_id: 1263134 + rule_id: nJUz4X + version_id: xyTjzQD + url: https://semgrep.dev/playground/r/xyTjzQD/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path + origin: community + patterns: + - pattern-either: + - pattern-inside: '$SESSION = require(''cookie-session''); + + ... + + ' + - pattern-inside: '$SESSION = require(''express-session''); + + ... + + ' + - pattern: $SESSION(...) + - pattern-not-inside: $SESSION(<... {cookie:{path:...}} ...>,...) + - pattern-not-inside: '$OPTS = <... {cookie:{path:...}} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE = <... {path:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie = <... {path:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE.path = ...; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie.path = ...; + + ... + + $SESSION($OPTS,...); + + ' +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure + message: 'Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.' + severity: WARNING + languages: + - javascript + - typescript + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + category: security + technology: + - express + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: LOW + confidence: MEDIUM + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure + shortlink: https://sg.run/9oKz + semgrep.dev: + rule: + r_id: 9267 + rv_id: 1263131 + rule_id: v8Unzw + version_id: NdTzyrv + url: https://semgrep.dev/playground/r/NdTzyrv/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure + origin: community + patterns: + - pattern-either: + - pattern-inside: '$SESSION = require(''cookie-session''); + + ... + + ' + - pattern-inside: '$SESSION = require(''express-session''); + + ... + + ' + - pattern: $SESSION(...) + - pattern-not-inside: $SESSION(<... {cookie:{secure:true}} ...>,...) + - pattern-not-inside: '$OPTS = <... {cookie:{secure:true}} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE = <... {secure:true} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie = <... {secure:true} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE.secure = true; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie.secure = true; + + ... + + $SESSION($OPTS,...); + + ' +- id: javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked + message: No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider + using function as the `isRevoked` option. + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://github.com/goldbergyoni/nodebestpractices/blob/master/sections/security/expirejwt.md + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.3 Insecure Stateless Session Tokens + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - express + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked + shortlink: https://sg.run/kXNo + semgrep.dev: + rule: + r_id: 9272 + rv_id: 1263137 + rule_id: 7KUQ9k + version_id: vdT06Bg + url: https://semgrep.dev/playground/r/vdT06Bg/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked + origin: community + languages: + - javascript + - typescript + severity: WARNING + patterns: + - pattern-inside: '$JWT = require(''express-jwt''); + + ... + + ' + - pattern: $JWT(...) + - pattern-not-inside: $JWT(<... {isRevoked:...} ...>,...) + - pattern-not-inside: '$OPTS = <... {isRevoked:...} ...>; + + ... + + $JWT($OPTS,...);' +- id: javascript.express.security.audit.express-libxml-noent.express-libxml-noent + message: The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable + to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure + you are protected. + options: + interfile: true + metadata: + interfile: true + references: + - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html + technology: + - express + category: security + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent + shortlink: https://sg.run/Z75x + semgrep.dev: + rule: + r_id: 22079 + rv_id: 1263138 + rule_id: pKUNeD + version_id: d6TyxpX + url: https://semgrep.dev/playground/r/d6TyxpX/javascript.express.security.audit.express-libxml-noent.express-libxml-noent + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - pattern: $REQ.files.$ANYTHING.data.toString('utf8') + - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - pattern: files.$ANYTHING.data.toString('utf8') + - pattern: files.$ANYTHING['data'].toString('utf8') + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: '$XML = require(''$IMPORT'') + + ... + + ' + - pattern-inside: "import $XML from '$IMPORT'\n ...\n" + - pattern-inside: 'import * as $XML from ''$IMPORT'' + + ... + + ' + - metavariable-regex: + metavariable: $IMPORT + regex: ^(libxmljs|libxmljs2)$ + - pattern-inside: $XML.$FUNC($QUERY, {...,noent:true,...}) + - metavariable-regex: + metavariable: $FUNC + regex: ^(parseXmlString|parseXml)$ + - focus-metavariable: $QUERY +- id: javascript.express.security.audit.express-open-redirect.express-open-redirect + message: The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect + users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected + to a third-party website. + metadata: + technology: + - express + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + category: security + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect + shortlink: https://sg.run/EpoP + semgrep.dev: + rule: + r_id: 22081 + rv_id: 1263140 + rule_id: X5ULkq + version_id: nWT2L0v + url: https://semgrep.dev/playground/r/nWT2L0v/javascript.express.security.audit.express-open-redirect.express-open-redirect + origin: community + languages: + - javascript + - typescript + severity: WARNING + options: + taint_unify_mvars: true + symbolic_propagation: true + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.redirect("$HTTP"+$REQ. ... .$VALUE) + - pattern: $RES.redirect("$HTTP"+$REQ. ... .$VALUE + $...A) + - pattern: $RES.redirect(`$HTTP${$REQ. ... .$VALUE}...`) + - pattern: $RES.redirect("$HTTP"+$REQ.$VALUE[...]) + - pattern: $RES.redirect("$HTTP"+$REQ.$VALUE[...] + $...A) + - pattern: $RES.redirect(`$HTTP${$REQ.$VALUE[...]}...`) + - metavariable-regex: + metavariable: $HTTP + regex: ^https?:\/\/$ + - pattern-either: + - pattern: $REQ. ... .$VALUE + - patterns: + - pattern-either: + - pattern: $RES.redirect($REQ. ... .$VALUE) + - pattern: $RES.redirect($REQ. ... .$VALUE + $...A) + - pattern: $RES.redirect(`${$REQ. ... .$VALUE}...`) + - pattern: $REQ. ... .$VALUE + - patterns: + - pattern-either: + - pattern: $RES.redirect($REQ.$VALUE['...']) + - pattern: $RES.redirect($REQ.$VALUE['...'] + $...A) + - pattern: $RES.redirect(`${$REQ.$VALUE['...']}...`) + - pattern: $REQ.$VALUE + - patterns: + - pattern-either: + - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE + + ... + + ' + - pattern-inside: '$ASSIGN = $REQ.$VALUE[''...''] + + ... + + ' + - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE + $...A + + ... + + ' + - pattern-inside: "$ASSIGN = $REQ.$VALUE['...'] + $...A\n... \n" + - pattern-inside: '$ASSIGN = `${$REQ. ... .$VALUE}...` + + ... + + ' + - pattern-inside: "$ASSIGN = `${$REQ.$VALUE['...']}...`\n... \n" + - pattern-either: + - pattern: $RES.redirect($ASSIGN) + - pattern: $RES.redirect($ASSIGN + $...FOO) + - pattern: $RES.redirect(`${$ASSIGN}...`) + - focus-metavariable: $ASSIGN +- id: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal + message: Possible writing outside of the destination, make sure that the target path is nested in the intended destination + metadata: + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + category: security + references: + - https://owasp.org/www-community/attacks/Path_Traversal + technology: + - express + - node.js + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal + shortlink: https://sg.run/weRn + semgrep.dev: + rule: + r_id: 9273 + rv_id: 1263141 + rule_id: L1Uyb8 + version_id: ExTExX0 + url: https://semgrep.dev/playground/r/ExTExX0/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern-either: + - pattern-inside: '$PATH = require(''path''); + + ... + + ' + - pattern-inside: 'import $PATH from ''path''; + + ... + + ' + - pattern-either: + - pattern: $PATH.join(...,$SINK,...) + - pattern: $PATH.resolve(...,$SINK,...) + - patterns: + - focus-metavariable: $SINK + - pattern-inside: 'import ''path''; + + ... + + ' + - pattern-either: + - pattern: path.join(...,$SINK,...) + - pattern: path.resolve(...,$SINK,...) + pattern-sanitizers: + - pattern: $Y.replace(...) + - pattern: $Y.indexOf(...) + - pattern: "function ... (...) {\n ...\n <... $Y.indexOf(...) ...>\n ...\n}\n" + - patterns: + - pattern: $FUNC(...) + - metavariable-regex: + metavariable: $FUNC + regex: sanitize +- id: javascript.express.security.audit.express-res-sendfile.express-res-sendfile + message: The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily + read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing + the path. This allows you to validate the path against the intended directory it should be accessing. + metadata: + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html + technology: + - express + category: security + cwe: + - 'CWE-73: External Control of File Name or Path' + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile + shortlink: https://sg.run/7DJk + semgrep.dev: + rule: + r_id: 22082 + rv_id: 1263142 + rule_id: j2UzDx + version_id: 7ZTE3X9 + url: https://semgrep.dev/playground/r/7ZTE3X9/javascript.express.security.audit.express-res-sendfile.express-res-sendfile + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: 'function ... (...,$REQ: $TYPE, ...) {...} + + ' + - metavariable-regex: + metavariable: $TYPE + regex: ^(string|String) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.$METH($QUERY,...) + - pattern-not-inside: $RES.$METH($QUERY,$OPTIONS) + - metavariable-regex: + metavariable: $METH + regex: ^(sendfile|sendFile)$ + - focus-metavariable: $QUERY +- id: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + options: + interfile: true + metadata: + interfile: true + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + category: security + technology: + - express + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret + shortlink: https://sg.run/LYvG + semgrep.dev: + rule: + r_id: 22083 + rv_id: 1263143 + rule_id: 10Uo39 + version_id: LjTkgle + url: https://semgrep.dev/playground/r/LjTkgle/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret + origin: community + languages: + - javascript + - typescript + severity: WARNING + patterns: + - pattern-either: + - pattern-inside: '$SESSION = require(''express-session''); + + ... + + ' + - pattern-inside: 'import $SESSION from ''express-session'' + + ... + + ' + - pattern-inside: 'import {..., $SESSION, ...} from ''express-session'' + + ... + + ' + - pattern-inside: 'import * as $SESSION from ''express-session'' + + ... + + ' + - patterns: + - pattern-either: + - pattern-inside: $APP.use($SESSION({...})) + - pattern: '$SECRET = $VALUE + + ... + + $APP.use($SESSION($SECRET)) + + ' + - pattern: 'secret: ''$Y'' + + ' +- id: javascript.express.security.audit.express-ssrf.express-ssrf + message: 'The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side + Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, + but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded + to follow OWASP best practices to prevent abuse. ' + metadata: + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + technology: + - express + category: security + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf + shortlink: https://sg.run/0PNw + semgrep.dev: + rule: + r_id: 22554 + rv_id: 1263144 + rule_id: eqU9l2 + version_id: 8KT5rBr + url: https://semgrep.dev/playground/r/8KT5rBr/javascript.express.security.audit.express-ssrf.express-ssrf + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + options: + taint_unify_mvars: true + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, ...) {...} + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,...) => + + {...} + + ' + - pattern-inside: '({ $REQ }: $EXPRESS.Request,...) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$REQUEST = require(''request'') + + ... + + ' + - pattern-inside: 'import * as $REQUEST from ''request'' + + ... + + ' + - pattern-inside: 'import $REQUEST from ''request'' + + ... + + ' + - pattern-either: + - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE) + - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE + $...A) + - pattern: $REQUEST.$METHOD(`$HTTP${$REQ. ... .$VALUE}...`) + - pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...]) + - pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...] + $...A) + - pattern: $REQUEST.$METHOD(`$HTTP${$REQ.$VALUE[...]}...`) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|patch|del|head|delete)$ + - metavariable-regex: + metavariable: $HTTP + regex: ^(https?:\/\/|//)$ + - pattern-either: + - pattern: $REQ. ... .$VALUE + - patterns: + - pattern-either: + - pattern-inside: '$REQUEST = require(''request'') + + ... + + ' + - pattern-inside: 'import * as $REQUEST from ''request'' + + ... + + ' + - pattern-inside: 'import $REQUEST from ''request'' + + ... + + ' + - pattern-either: + - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE,...) + - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE + $...A,...) + - pattern: $REQUEST.$METHOD(`${$REQ. ... .$VALUE}...`,...) + - pattern: $REQ. ... .$VALUE + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|patch|del|head|delete)$ + - patterns: + - pattern-either: + - pattern-inside: '$REQUEST = require(''request'') + + ... + + ' + - pattern-inside: 'import * as $REQUEST from ''request'' + + ... + + ' + - pattern-inside: 'import $REQUEST from ''request'' + + ... + + ' + - pattern-either: + - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'],...) + - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'] + $...A,...) + - pattern: $REQUEST.$METHOD(`${$REQ.$VALUE['...']}...`,...) + - pattern: $REQ.$VALUE + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|patch|del|head|delete)$ + - patterns: + - pattern-either: + - pattern-inside: '$REQUEST = require(''request'') + + ... + + ' + - pattern-inside: 'import * as $REQUEST from ''request'' + + ... + + ' + - pattern-inside: 'import $REQUEST from ''request'' + + ... + + ' + - pattern-either: + - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE + + ... + + ' + - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE[''...''] + + ... + + ' + - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE + $...A + + ... + + ' + - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE['...'] + $...A\n... \n" + - pattern-inside: '$ASSIGN = `${$REQ. ... .$VALUE}...` + + ... + + ' + - pattern-inside: "$ASSIGN = `${$REQ. ... .$VALUE['...']}...`\n... \n" + - patterns: + - pattern-either: + - pattern-inside: '$ASSIGN = "$HTTP"+ $REQ. ... .$VALUE + + ... + + ' + - pattern-inside: '$ASSIGN = "$HTTP"+$REQ. ... .$VALUE + $...A + + ... + + ' + - pattern-inside: '$ASSIGN = "$HTTP"+$REQ.$VALUE[...] + + ... + + ' + - pattern-inside: '$ASSIGN = "$HTTP"+$REQ.$VALUE[...] + $...A + + ... + + ' + - pattern-inside: '$ASSIGN = `$HTTP${$REQ.$VALUE[...]}...` + + ... + + ' + - metavariable-regex: + metavariable: $HTTP + regex: ^(https?:\/\/|//)$ + - pattern-either: + - pattern: $REQUEST.$METHOD($ASSIGN,...) + - pattern: $REQUEST.$METHOD($ASSIGN + $...FOO,...) + - pattern: $REQUEST.$METHOD(`${$ASSIGN}...`,...) + - patterns: + - pattern-either: + - pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN,...) + - pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN + $...A,...) + - pattern: $REQUEST.$METHOD(`$HTTP${$ASSIGN}...`,...) + - metavariable-regex: + metavariable: $HTTP + regex: ^(https?:\/\/|//)$ + - pattern: $ASSIGN + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|patch|del|head|delete)$ +- id: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization + message: The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) + through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and + Buffer.from(). + options: + interfile: true + metadata: + interfile: true + technology: + - express + category: security + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html + source_rule_url: + - https://github.com/ajinabraham/njsscan/blob/75bfbeb9c8d72999e4d527dfa2548f7f0f3cc48a/njsscan/rules/semantic_grep/eval/eval_deserialize.yaml + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization + shortlink: https://sg.run/8W5j + semgrep.dev: + rule: + r_id: 22084 + rv_id: 1263145 + rule_id: 9AUyqj + version_id: gETB7nD + url: https://semgrep.dev/playground/r/gETB7nD/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - pattern: $REQ.files.$ANYTHING.data.toString('utf8') + - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - pattern: files.$ANYTHING.data.toString('utf8') + - pattern: files.$ANYTHING['data'].toString('utf8') + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: '$SER = require(''$IMPORT'') + + ... + + ' + - pattern-inside: "import $SER from '$IMPORT'\n ...\n" + - pattern-inside: 'import * as $SER from ''$IMPORT'' + + ... + + ' + - metavariable-regex: + metavariable: $IMPORT + regex: ^(node-serialize|serialize-to-js)$ + - pattern: $SER.$FUNC(...) + - metavariable-regex: + metavariable: $FUNC + regex: ^(unserialize|deserialize)$ +- id: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event + message: Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it + can result in XML External or Internal Entity (XXE) Processing vulnerabilities + metadata: + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + category: security + technology: + - express + references: + - https://www.npmjs.com/package/xml2json + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event + shortlink: https://sg.run/x1AA + semgrep.dev: + rule: + r_id: 9274 + rv_id: 1263146 + rule_id: 8GUjkk + version_id: QkTGqgo + url: https://semgrep.dev/playground/r/QkTGqgo/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: 'require(''xml2json''); + + ... + + ' + - pattern-inside: 'import ''xml2json''; + + ... + + ' + - pattern: $REQ.on('...', function(...) { ... $EXPAT.toJson($INPUT,...); ... }) + - focus-metavariable: $INPUT +- id: javascript.express.security.audit.res-render-injection.res-render-injection + message: User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages + that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` + to access other HTML pages on the file system. Where possible, do not allow users to define what should be loaded in + $RES.render or use an allow list for the existing application. + options: + interfile: true + metadata: + interfile: true + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' + category: security + technology: + - express + references: + - http://expressjs.com/en/4x/api.html#res.render + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection + shortlink: https://sg.run/eLjd + semgrep.dev: + rule: + r_id: 9276 + rv_id: 1263149 + rule_id: QrUzrq + version_id: PkTR3OY + url: https://semgrep.dev/playground/r/PkTR3OY/javascript.express.security.audit.res-render-injection.res-render-injection + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.render($SINK, ...) + - focus-metavariable: $SINK +- id: javascript.express.security.audit.xss.direct-response-write.direct-response-write + message: Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may + expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped + HTML. + options: + interfile: true + metadata: + interfile: true + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + category: security + technology: + - express + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + vulnerability_class: + - Cross-Site-Scripting (XSS) + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write + shortlink: https://sg.run/vzGl + semgrep.dev: + rule: + r_id: 9277 + rv_id: 1263150 + rule_id: 3qUPA1 + version_id: JdTzxeg + url: https://semgrep.dev/playground/r/JdTzxeg/javascript.express.security.audit.xss.direct-response-write.direct-response-write + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options) + - pattern-not-inside: "function ... ($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" + - pattern-not-inside: "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n\ + })\n" + - pattern-not-inside: "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" + - pattern-not-inside: "function ... ($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n}\n" + - pattern-not-inside: "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n})\n" + - pattern-not-inside: "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.set('$TYPE')\n}\n" + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - pattern-not-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.$SET('Content-Type',\ + \ '$TYPE')\n}\n" + - pattern-not-inside: "({ $REQ }: Request,$RES: Response) => {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" + - pattern-not-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.set('$TYPE')\n\ + }\n" + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: body + pattern-sinks: + - patterns: + - pattern-inside: function ... (..., $RES,...) {...} + - pattern-either: + - pattern: $RES.write($ARG) + - pattern: $RES.send($ARG) + - pattern-not: $RES. ... .set('...'). ... .send($ARG) + - pattern-not: $RES. ... .type('...'). ... .send($ARG) + - pattern-not-inside: $RES.$METHOD({ ... }) + - focus-metavariable: $ARG + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import * as $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: '$S = require("underscore.string") + + ... + + ' + - pattern-either: + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "dompurify" + + ... + + ' + - pattern-inside: 'import { ..., $S,... } from "dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "dompurify" + + ... + + ' + - pattern-inside: '$S = require("dompurify") + + ... + + ' + - pattern-inside: 'import $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: '$S = require("isomorphic-dompurify") + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$VALUE = $S(...) + + ... + + ' + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: '$VALUE = $S.sanitize + + ... + + ' + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''xss''; + + ... + + ' + - pattern-inside: 'import * as $S from ''xss''; + + ... + + ' + - pattern-inside: '$S = require("xss") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''sanitize-html''; + + ... + + ' + - pattern-inside: 'import * as $S from "sanitize-html"; + + ... + + ' + - pattern-inside: '$S = require("sanitize-html") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: '$S = new Remarkable() + + ... + + ' + - pattern: $S.render(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''express-xss-sanitizer''; + + ... + + ' + - pattern-inside: 'import * as $S from "express-xss-sanitizer"; + + ... + + ' + - pattern-inside: 'const { ..., $S, ... } = require(''express-xss-sanitizer''); + + ... + + ' + - pattern-inside: 'var { ..., $S, ... } = require(''express-xss-sanitizer''); + + ... + + ' + - pattern-inside: 'let { ...,$S,... } = require(''express-xss-sanitizer''); + + ... + + ' + - pattern-inside: '$S = require("express-xss-sanitizer") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern: $RES. ... .type('$F'). ... .send(...) + - metavariable-regex: + metavariable: $F + regex: (?!.*text/html) + - patterns: + - pattern-inside: '$X = [...]; + + ... + + ' + - pattern: "if(<... !$X.includes($SOURCE)...>) {\n ...\n return ...\n}\n...\n" + - pattern: $SOURCE +- id: javascript.express.security.cors-misconfiguration.cors-misconfiguration + message: By letting user input control CORS parameters, there is a risk that software does not properly verify that the + source of data or communication is valid. Use literal values for CORS settings. + metadata: + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe: + - 'CWE-346: Origin Validation Error' + category: security + references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS + technology: + - express + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration + shortlink: https://sg.run/nKXO + semgrep.dev: + rule: + r_id: 13580 + rv_id: 1263162 + rule_id: 5rULJQ + version_id: YDTZe8Y + url: https://semgrep.dev/playground/r/YDTZe8Y/javascript.express.security.cors-misconfiguration.cors-misconfiguration + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.set($HEADER, $X) + - pattern: $RES.header($HEADER, $X) + - pattern: $RES.setHeader($HEADER, $X) + - pattern: '$RES.set({$HEADER: $X}, ...) + + ' + - pattern: '$RES.writeHead($STATUS, {$HEADER: $X}, ...) + + ' + - focus-metavariable: $X + - metavariable-regex: + metavariable: $HEADER + regex: .*(Access-Control-Allow-Origin|access-control-allow-origin).* +- id: javascript.express.security.express-expat-xxe.express-expat-xxe + message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal + Entity (XXE) Processing vulnerabilities. + options: + interfile: true + metadata: + interfile: true + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://github.com/astro/node-expat + category: security + technology: + - express + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe + shortlink: https://sg.run/BkXx + semgrep.dev: + rule: + r_id: 9251 + rv_id: 1263164 + rule_id: zdUkJl + version_id: o5TbD5l + url: https://semgrep.dev/playground/r/o5TbD5l/javascript.express.security.express-expat-xxe.express-expat-xxe + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$XML = require(''node-expat'') + + ... + + ' + - pattern-inside: 'import $XML from ''node-expat'' + + ... + + ' + - pattern-inside: 'import * as $XML from ''node-expat'' + + ... + + ' + - pattern-either: + - pattern-inside: '$PARSER = new $XML.Parser(...); + + ... + + ' + - pattern-either: + - pattern: $PARSER.parse($QUERY) + - pattern: $PARSER.write($QUERY) + - focus-metavariable: $QUERY +- id: javascript.express.security.express-insecure-template-usage.express-insecure-template-usage + message: User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) + vulnerability. + options: + interfile: true + metadata: + interfile: true + category: security + cwe: + - 'CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine' + owasp: + - A03:2021 - Injection + - A01:2017 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html + technology: + - javascript + - typescript + - express + - pug + - jade + - dot + - ejs + - nunjucks + - lodash + - handlbars + - mustache + - hogan.js + - eta + - squirrelly + source_rule_url: + - https://github.com/github/codeql/blob/2ba2642c7ab29b9eedef33bcc2b8cd1d203d0c10/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/template-sinks.js + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage + shortlink: https://sg.run/b49v + semgrep.dev: + rule: + r_id: 19226 + rv_id: 1263165 + rule_id: EwUr9k + version_id: zyTb2eD + url: https://semgrep.dev/playground/r/zyTb2eD/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-propagators: + - pattern: $MODEL.$FIND($E).then((...,$S,...)=>{...}) + from: $E + to: $S + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''pug'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''pug'' + + ... + + ' + - pattern-inside: '$PUG = require(''jade'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''jade'' + + ... + + ' + - pattern-either: + - pattern: $PUG.compile(...) + - pattern: $PUG.compileClient(...) + - pattern: $PUG.compileClientWithDependenciesTracked(...) + - pattern: $PUG.render(...) + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''dot'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''dot'' + + ... + + ' + - pattern-either: + - pattern: $PUG.template(...) + - pattern: $PUG.compile(...) + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''ejs'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''ejs'' + + ... + + ' + - pattern-either: + - pattern: $PUG.render(...) + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''nunjucks'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''nunjucks'' + + ... + + ' + - pattern-either: + - pattern: $PUG.renderString(...) + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''lodash'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''lodash'' + + ... + + ' + - pattern-either: + - pattern: $PUG.template(...) + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''mustache'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''mustache'' + + ... + + ' + - pattern-inside: '$PUG = require(''eta'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''eta'' + + ... + + ' + - pattern-inside: '$PUG = require(''squirrelly'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''squirrelly'' + + ... + + ' + - pattern-either: + - pattern: $PUG.render(...) + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''hogan.js'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''hogan.js'' + + ... + + ' + - pattern-inside: '$PUG = require(''handlebars'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''handlebars'' + + ... + + ' + - pattern-either: + - pattern: $PUG.compile(...) +- id: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + options: + interfile: true + metadata: + interfile: true + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + category: security + technology: + - express + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret + shortlink: https://sg.run/Do1d + semgrep.dev: + rule: + r_id: 9252 + rv_id: 1263166 + rule_id: pKUOjy + version_id: pZT03Q0 + url: https://semgrep.dev/playground/r/pZT03Q0/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret + origin: community + languages: + - javascript + - typescript + severity: WARNING + patterns: + - pattern-either: + - pattern-inside: '$JWT = require(''express-jwt''); + + ... + + ' + - pattern-inside: 'import $JWT from ''express-jwt''; + + ... + + ' + - pattern-inside: 'import * as $JWT from ''express-jwt''; + + ... + + ' + - pattern-inside: 'import { ..., $JWT, ... } from ''express-jwt''; + + ... + + ' + - pattern-either: + - pattern: '$JWT({...,secret: "$Y",...},...) + + ' + - pattern: '$OPTS = "$Y"; + + ... + + $JWT({...,secret: $OPTS},...); + + ' + - focus-metavariable: $Y +- id: javascript.express.security.express-phantom-injection.express-phantom-injection + message: If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities + metadata: + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + category: security + technology: + - express + references: + - https://phantomjs.org/page-automation.html + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection + shortlink: https://sg.run/W8BL + semgrep.dev: + rule: + r_id: 9253 + rv_id: 1263167 + rule_id: 2ZUbx3 + version_id: 2KTv26p + url: https://semgrep.dev/playground/r/2KTv26p/javascript.express.security.express-phantom-injection.express-phantom-injection + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: 'require(''phantom''); + + ... + + ' + - pattern-inside: 'import ''phantom''; + + ... + + ' + - pattern-either: + - pattern: $PAGE.open($SINK,...) + - pattern: $PAGE.setContent($SINK,...) + - pattern: $PAGE.openUrl($SINK,...) + - pattern: $PAGE.evaluateJavaScript($SINK,...) + - pattern: $PAGE.property("content",$SINK,...) + - focus-metavariable: $SINK +- id: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection + message: If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities + metadata: + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + category: security + technology: + - express + references: + - https://pptr.dev/api/puppeteer.page + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection + shortlink: https://sg.run/0QJB + semgrep.dev: + rule: + r_id: 9254 + rv_id: 1263168 + rule_id: X5U8Nz + version_id: X0TzyJY + url: https://semgrep.dev/playground/r/X0TzyJY/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: 'require(''puppeteer''); + + ... + + ' + - pattern-inside: 'import ''puppeteer''; + + ... + + ' + - pattern-either: + - pattern: $PAGE.goto($SINK,...) + - pattern: $PAGE.setContent($SINK,...) + - pattern: $PAGE.evaluate($SINK,...) + - pattern: $PAGE.evaluate($CODE,$SINK,...) + - pattern: $PAGE.evaluateHandle($SINK,...) + - pattern: $PAGE.evaluateHandle($CODE,$SINK,...) + - pattern: $PAGE.evaluateOnNewDocument($SINK,...) + - pattern: $PAGE.evaluateOnNewDocument($CODE,$SINK,...) + - focus-metavariable: $SINK +- id: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection + message: Make sure that unverified user data can not reach `sandbox`. + metadata: + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + category: security + technology: + - express + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection + shortlink: https://sg.run/KlwL + semgrep.dev: + rule: + r_id: 9255 + rv_id: 1263169 + rule_id: j2UvXB + version_id: jQTn59D + url: https://semgrep.dev/playground/r/jQTn59D/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-inside: '$SANDBOX = require(''sandbox''); + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$S = new $SANDBOX(...); + + ... + + ' + - pattern: '$S.run(...) + + ' + - pattern: 'new $SANDBOX($OPTS).run(...) + + ' + - pattern: new $SANDBOX().run(...) +- id: javascript.express.security.express-vm-injection.express-vm-injection + message: Make sure that unverified user data can not reach `$VM`. + metadata: + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + category: security + technology: + - express + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection + shortlink: https://sg.run/jkqJ + semgrep.dev: + rule: + r_id: 12821 + rv_id: 1263170 + rule_id: DbUKPX + version_id: 1QTypXQ + url: https://semgrep.dev/playground/r/1QTypXQ/javascript.express.security.express-vm-injection.express-vm-injection + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-inside: '$VM = require(''vm''); + + ... + + ' + - pattern-either: + - pattern: '$VM.runInContext(...) + + ' + - pattern: '$VM.runInNewContext(...) + + ' + - pattern: '$VM.compileFunction(...) + + ' + - pattern: '$VM.runInThisContext(...) + + ' + - pattern: new $VM.Script(...) +- id: javascript.express.security.express-vm2-injection.express-vm2-injection + message: Make sure that unverified user data can not reach `vm2`. + metadata: + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + category: security + technology: + - express + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection + shortlink: https://sg.run/1GWv + semgrep.dev: + rule: + r_id: 12822 + rv_id: 1263171 + rule_id: WAUPXJ + version_id: 9lT4bnX + url: https://semgrep.dev/playground/r/9lT4bnX/javascript.express.security.express-vm2-injection.express-vm2-injection + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-inside: 'require(''vm2'') + + ... + + ' + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: '$VM = new VM(...) + + ... + + ' + - pattern-inside: '$VM = new NodeVM(...) + + ... + + ' + - pattern: '$VM.run(...) + + ' + - pattern: 'new VM(...).run(...) + + ' + - pattern: 'new NodeVM(...).run(...) + + ' + - pattern: 'new VMScript(...) + + ' + - pattern: 'new VM(...) + + ' + - pattern: new NodeVM(...) +- id: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe + message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal + Entity (XXE) Processing vulnerabilities + metadata: + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + category: security + technology: + - express + references: + - https://www.npmjs.com/package/xml2json + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe + shortlink: https://sg.run/XBD4 + semgrep.dev: + rule: + r_id: 9264 + rv_id: 1263174 + rule_id: x8Uneb + version_id: bZT534J + url: https://semgrep.dev/playground/r/bZT534J/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - pattern: $REQ.files.$ANYTHING.data.toString('utf8') + - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - pattern: files.$ANYTHING.data.toString('utf8') + - pattern: files.$ANYTHING['data'].toString('utf8') + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: 'require(''xml2json''); + + ... + + ' + - pattern-inside: 'import ''xml2json''; + + ... + + ' + - pattern: $EXPAT.toJson($SINK,...) + - focus-metavariable: $SINK +- id: javascript.express.security.injection.raw-html-format.raw-html-format + message: User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting + (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to + sanitize the HTML within. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + category: security + technology: + - express + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format + shortlink: https://sg.run/5DO3 + semgrep.dev: + rule: + r_id: 14691 + rv_id: 1263175 + rule_id: 5rUL0X + version_id: NdTzyQv + url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - label: EXPRESS + patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - label: EXPRESSTS + patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - label: CLEAN + by-side-effect: true + patterns: + - pattern-either: + - pattern: $A($SOURCE) + - pattern: $SANITIZE. ... .$A($SOURCE) + - pattern: $A. ... .$SANITIZE($SOURCE) + - focus-metavariable: $SOURCE + - metavariable-regex: + metavariable: $A + regex: (?i)(.*valid|.*sanitiz) + pattern-sinks: + - requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN) + patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$HTMLSTR" + $EXPR' + - pattern: '"$HTMLSTR".concat(...)' + - pattern: util.format($HTMLSTR, ...) + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... + - patterns: + - pattern: '`...` + + ' + - pattern-regex: '.*<\w+.* + + ' +- id: javascript.express.security.require-request.require-request + message: If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the + server. + options: + interfile: true + metadata: + interfile: true + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' + source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html + category: security + technology: + - express + references: + - https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/javascript.express.security.require-request.require-request + shortlink: https://sg.run/jRbl + semgrep.dev: + rule: + r_id: 9265 + rv_id: 1263177 + rule_id: OrU3WK + version_id: w8TRo0d + url: https://semgrep.dev/playground/r/w8TRo0d/javascript.express.security.require-request.require-request + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern: require($SINK) + - focus-metavariable: $SINK +- id: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration + message: By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify + whether or not a browser should be allowed to render a page in an `iframe`. + metadata: + references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + cwe: + - 'CWE-451: User Interface (UI) Misrepresentation of Critical Information' + category: security + technology: + - express + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration + shortlink: https://sg.run/EvjA + semgrep.dev: + rule: + r_id: 13581 + rv_id: 1263178 + rule_id: GdUrLy + version_id: xyTjz3D + url: https://semgrep.dev/playground/r/xyTjz3D/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.set($HEADER, ...) + - pattern: $RES.header($HEADER, ...) + - pattern: $RES.setHeader($HEADER, ...) + - pattern: '$RES.set({$HEADER: ...}, ...) + + ' + - pattern: '$RES.writeHead($STATUS, {$HEADER: ...}, ...) + + ' + - metavariable-regex: + metavariable: $HEADER + regex: .*(X-Frame-Options|x-frame-options).* +- id: javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash + patterns: + - pattern-either: + - pattern: 'window.intercomSettings = {..., email: $EMAIL, ...}; + + ' + - pattern: 'window.intercomSettings = {..., user_id: $USER_ID, ...}; + + ' + - pattern: 'Intercom(''boot'', {..., email: $EMAIL, ...}); + + ' + - pattern: 'Intercom(''boot'', {..., user_id: $USER_ID, ...}); + + ' + - pattern: '$VAR = {..., email: $EMAIL, ...}; + + ... + + Intercom(''boot'', $VAR); + + ' + - pattern: '$VAR = {..., user_id: $EMAIL, ...}; + + ... + + Intercom(''boot'', $VAR); + + ' + - pattern-not: 'window.intercomSettings = {..., user_hash: $USER_HASH, ...}; + + ' + - pattern-not: 'Intercom(''boot'', {..., user_hash: $USER_HASH, ...}); + + ' + - pattern-not: '$VAR = {..., user_hash: $USER_HASH, ...}; + + ... + + Intercom(''boot'', $VAR); + + ' + message: Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This + configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile + languages: + - js + severity: WARNING + metadata: + category: security + subcategory: + - audit + cwe: + - 'CWE-287: Improper Authentication' + confidence: MEDIUM + likelihood: MEDIUM + impact: HIGH + technology: + - intercom + references: + - https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash + shortlink: https://sg.run/Eb5w + semgrep.dev: + rule: + r_id: 60237 + rv_id: 945842 + rule_id: QrU96W + version_id: nWTpzDk + url: https://semgrep.dev/playground/r/nWTpzDk/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash + origin: community +- id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + metadata: + interfile: true + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.2 Static API keys or secret + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jose + - jwt + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret + shortlink: https://sg.run/Ro1g + semgrep.dev: + rule: + r_id: 9293 + rv_id: 1263182 + rule_id: JDUyRl + version_id: d6TyxbX + url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret + origin: community + languages: + - javascript + - typescript + severity: WARNING + patterns: + - pattern-inside: '$JOSE = require("jose"); + + ... + + ' + - pattern-either: + - pattern-inside: 'var {JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'var {JWK, JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'const {JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'const {JWK, JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'let {JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'let {JWK, JWT} = $JOSE; + + ... + + ' + - pattern-either: + - pattern: 'JWT.verify($P, "...", ...); + + ' + - pattern: 'JWT.sign($P, "...", ...); + + ' + - pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...); \n" + - pattern: '$JWT.sign($P, JWK.asKey("..."), ...); + + ' + options: + symbolic_propagation: true + interfile: true +- id: javascript.jose.security.jwt-none-alg.jwt-none-alg + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has + already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do + not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.3 Insecue Stateless Session Tokens + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jose + - jwt + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg + shortlink: https://sg.run/AvRL + semgrep.dev: + rule: + r_id: 9294 + rv_id: 1263183 + rule_id: 5rUOGN + version_id: ZRTKAyb + url: https://semgrep.dev/playground/r/ZRTKAyb/javascript.jose.security.jwt-none-alg.jwt-none-alg + origin: community + languages: + - javascript + - typescript + severity: ERROR + pattern-either: + - pattern: 'var $JOSE = require("jose"); + + ... + + var { JWK, JWT } = $JOSE; + + ... + + var $T = JWT.verify($P, JWK.None,...); + + ' + - pattern: 'var $JOSE = require("jose"); + + ... + + var { JWK, JWT } = $JOSE; + + ... + + $T = JWT.verify($P, JWK.None,...); + + ' + - pattern: 'var $JOSE = require("jose"); + + ... + + var { JWK, JWT } = $JOSE; + + ... + + JWT.verify($P, JWK.None,...); + + ' +- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.2 Static API keys or secret + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jwt + - javascript + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret + shortlink: https://sg.run/4xN9 + semgrep.dev: + rule: + r_id: 9300 + rv_id: 1263189 + rule_id: WAUon7 + version_id: gETB75D + url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern: "$X = '...' \n" + - pattern: "$X = '$Y' \n" + - patterns: + - pattern-either: + - pattern-inside: '$JWT.sign($DATA,"...",...); + + ' + - pattern-inside: '$JWT.verify($DATA,"...",...); + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$JWT = require("jsonwebtoken") + + ... + + ' + - pattern-inside: 'import $JWT from "jsonwebtoken" + + ... + + ' + - pattern-inside: 'import * as $JWT from "jsonwebtoken" + + ... + + ' + - pattern-inside: 'import {...,$JWT,...} from "jsonwebtoken" + + ... + + ' + - pattern-either: + - pattern-inside: '$JWT.sign($DATA,$VALUE,...); + + ' + - pattern-inside: '$JWT.verify($DATA,$VALUE,...); + + ' + - focus-metavariable: $VALUE +- id: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has + already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do + not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.3 Insecue Stateless Session Tokens + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jwt + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg + shortlink: https://sg.run/PJXv + semgrep.dev: + rule: + r_id: 9301 + rv_id: 1263190 + rule_id: 0oU53g + version_id: QkTGqQo + url: https://semgrep.dev/playground/r/QkTGqQo/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg + origin: community + languages: + - javascript + - typescript + severity: ERROR + patterns: + - pattern-inside: '$JWT = require("jsonwebtoken"); + + ... + + ' + - pattern: $JWT.verify($P, $X, {algorithms:[...,'none',...]},...) +- id: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify + message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the + token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` + before using the token. + severity: ERROR + metadata: + owasp: + - A05:2021 - Security Misconfiguration + - A07:2021 - Identification and Authentication Failures + - A02:2025 - Security Misconfiguration + - A07:2025 - Authentication Failures + cwe: + - 'CWE-287: Improper Authentication' + - 'CWE-345: Insufficient Verification of Data Authenticity' + - 'CWE-347: Improper Verification of Cryptographic Signature' + category: security + subcategory: + - vuln + technology: + - jwt-simple + - jwt + confidence: HIGH + likelihood: MEDIUM + impact: HIGH + references: + - https://www.npmjs.com/package/jwt-simple + - https://cwe.mitre.org/data/definitions/287 + - https://cwe.mitre.org/data/definitions/345 + - https://cwe.mitre.org/data/definitions/347 + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + - Improper Authentication + source: https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify + shortlink: https://sg.run/zdjod + semgrep.dev: + rule: + r_id: 120561 + rv_id: 1263191 + rule_id: r6UyNLy + version_id: 3ZT4Xxv + url: https://semgrep.dev/playground/r/3ZT4Xxv/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify + origin: community + languages: + - javascript + - typescript + patterns: + - pattern-inside: '$JWT = require(''jwt-simple''); + + ... + + ' + - pattern: $JWT.decode($TOKEN, $SECRET, $NOVERIFY, ...) + - metavariable-pattern: + metavariable: $NOVERIFY + patterns: + - pattern-either: + - pattern: 'true + + ' + - pattern: '"..." + + ' +- id: javascript.lang.security.audit.code-string-concat.code-string-concat + message: Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead + to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible. + options: + interfile: true + metadata: + interfile: true + confidence: HIGH + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + references: + - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval + - https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback + - https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/ + - https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html + category: security + technology: + - node.js + - Express + - Next.js + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat + shortlink: https://sg.run/96Yk + semgrep.dev: + rule: + r_id: 13023 + rv_id: 1263192 + rule_id: DbUKEz + version_id: 44TEjYX + url: https://semgrep.dev/playground/r/44TEjYX/javascript.lang.security.audit.code-string-concat.code-string-concat + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: 'import { ...,$IMPORT,... } from ''next/router'' + + ... + + ' + - pattern-inside: 'import $IMPORT from ''next/router''; + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$ROUTER = $IMPORT() + + ... + + ' + - pattern-either: + - pattern-inside: 'const { ...,$PROPS,... } = $ROUTER.query + + ... + + ' + - pattern-inside: 'var { ...,$PROPS,... } = $ROUTER.query + + ... + + ' + - pattern-inside: 'let { ...,$PROPS,... } = $ROUTER.query + + ... + + ' + - focus-metavariable: $PROPS + - patterns: + - pattern-inside: '$ROUTER = $IMPORT() + + ... + + ' + - pattern: "$ROUTER.query.$VALUE \n" + - patterns: + - pattern: $IMPORT().query.$VALUE + pattern-sinks: + - patterns: + - pattern: 'eval(...) + + ' +- id: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli + message: 'Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled + and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared + statements. An example of parameterized queries like so: `knex.raw(''SELECT $1 from table'', [userinput])` can help prevent + SQLi.' + metadata: + confidence: MEDIUM + references: + - https://knexjs.org/#Builder-fromRaw + - https://knexjs.org/#Builder-whereRaw + - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - express + - nodejs + - knex + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli + shortlink: https://sg.run/l9eE + semgrep.dev: + rule: + r_id: 18257 + rv_id: 1263205 + rule_id: d8UKLD + version_id: l4TJRey + url: https://semgrep.dev/playground/r/l4TJRey/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options) + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - pattern: $REQ.files.$ANYTHING.data.toString('utf8') + - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - pattern: files.$ANYTHING.data.toString('utf8') + - pattern: files.$ANYTHING['data'].toString('utf8') + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern-inside: $KNEX.fromRaw($QUERY, ...) + - pattern-inside: $KNEX.whereRaw($QUERY, ...) + - pattern-inside: $KNEX.raw($QUERY, ...) + - pattern-either: + - pattern-inside: 'require(''knex'') + + ... + + ' + - pattern-inside: 'import ''knex'' + + ... + + ' + pattern-sanitizers: + - patterns: + - pattern: parseInt(...) +- id: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression + message: Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting + (XSS). Where possible avoid including user-input in functions which dynamically execute user-input. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js + references: + - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval! + category: security + technology: + - javascript + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression + shortlink: https://sg.run/6nwK + semgrep.dev: + rule: + r_id: 9315 + rv_id: 1263214 + rule_id: yyUngo + version_id: WrTqKkJ + url: https://semgrep.dev/playground/r/WrTqKkJ/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "$PROP = new URLSearchParams($WINDOW. ... .location.search).get('...')\n ...\n" + - pattern-inside: "$PROP = new URLSearchParams(location.search).get('...')\n ...\n" + - pattern-inside: "$PROP = new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...')\n ...\n" + - pattern-inside: "$PROP = new URLSearchParams(location.hash.substring(1)).get('...')\n ...\n" + - focus-metavariable: $PROP + - patterns: + - pattern-either: + - pattern-inside: "$PROPS = new URLSearchParams($WINDOW. ... .location.search)\n ...\n" + - pattern-inside: "$PROPS = new URLSearchParams(location.search)\n ...\n" + - pattern-inside: "$PROPS = new\nURLSearchParams($WINDOW. ... .location.hash.substring(1))\n ...\n" + - pattern-inside: '$PROPS = new URLSearchParams(location.hash.substring(1)) + + ... + + ' + - pattern: $PROPS.get('...') + - focus-metavariable: $PROPS + - patterns: + - pattern-either: + - pattern: location.href + - pattern: location.hash + - pattern: location.search + - pattern: $WINDOW. ... .location.href + - pattern: $WINDOW. ... .location.hash + - pattern: $WINDOW. ... .location.search + pattern-sinks: + - patterns: + - pattern-either: + - pattern: eval(<... $SINK ...>) + - pattern: window.eval(<... $SINK ...>) + - pattern: new Function(<... $SINK ...>) + - pattern: new Function(<... $SINK ...>)(...) + - pattern: setTimeout(<... $SINK ...>,...) + - pattern: setInterval(<... $SINK ...>,...) + - focus-metavariable: $SINK + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern: location.href = $FUNC(...) + - pattern: location.hash = $FUNC(...) + - pattern: location.search = $FUNC(...) + - pattern: $WINDOW. ... .location.href = $FUNC(...) + - pattern: $WINDOW. ... .location.hash = $FUNC(...) + - pattern: $WINDOW. ... .location.search = $FUNC(...) +- id: javascript.node-crypto.security.aead-no-final.aead-no-final + message: The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing + to call 'final' will invalidate all integrity guarantees of the released ciphertext. + metadata: + cwe: + - 'CWE-310: CWE CATEGORY: Cryptographic Issues' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + category: security + subcategory: + - vuln + technology: + - node-crypto + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + references: + - https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/ + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final + shortlink: https://sg.run/r6EEA + semgrep.dev: + rule: + r_id: 146569 + rv_id: 1263222 + rule_id: 2ZUz884 + version_id: zyTb2X0 + url: https://semgrep.dev/playground/r/zyTb2X0/javascript.node-crypto.security.aead-no-final.aead-no-final + origin: community + languages: + - javascript + - typescript + severity: ERROR + patterns: + - pattern: '$DECIPHER = $CRYPTO.createDecipheriv(''$ALGO'', ...) + + ... + + $DECIPHER.update(...) + + ' + - pattern-not-inside: '$DECIPHER = $CRYPTO.createDecipheriv(''$ALGO'', ...) + + ... + + $DECIPHER.final(...) + + ' + - metavariable-regex: + metavariable: $ALGO + regex: .*(-gcm|-ccm|-ocb|chacha20-poly1305)$ +- id: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv + message: The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. + For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used + more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' + or 'createDecipheriv' instead. + metadata: + cwe: + - 'CWE-1204: Generation of Weak Initialization Vector (IV)' + category: security + subcategory: + - vuln + technology: + - node-crypto + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + references: + - https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options + - https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv + shortlink: https://sg.run/bw33r + semgrep.dev: + rule: + r_id: 146570 + rv_id: 945898 + rule_id: X5UQRR7 + version_id: ZRT3510 + url: https://semgrep.dev/playground/r/ZRT3510/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv + origin: community + languages: + - javascript + - typescript + severity: ERROR + patterns: + - pattern-either: + - pattern: '$CRYPTO.createCipher(...) + + ' + - pattern: '$CRYPTO.createDecipher(...) + + ' +- id: javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length + message: The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication + tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be + tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts + or recover the implicit authentication key of GCM, allowing arbitrary forgeries. + metadata: + cwe: + - 'CWE-310: CWE CATEGORY: Cryptographic Issues' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + category: security + subcategory: + - vuln + technology: + - node-crypto + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + references: + - https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/ + - https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/ + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length + shortlink: https://sg.run/NbGG1 + semgrep.dev: + rule: + r_id: 146571 + rv_id: 1263223 + rule_id: j2UgPP3 + version_id: pZT03qd + url: https://semgrep.dev/playground/r/pZT03qd/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length + origin: community + languages: + - javascript + - typescript + severity: ERROR + patterns: + - pattern: '$CRYPTO.createDecipheriv(''$ALGO'', $KEY, $IV) + + ' + - metavariable-regex: + metavariable: $ALGO + regex: .*(-gcm)$ +- id: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.2 Static API keys or secret + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jwt + - nodejs + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret + shortlink: https://sg.run/vz70 + semgrep.dev: + rule: + r_id: 9333 + rv_id: 1263225 + rule_id: QrUzq6 + version_id: X0TzyoE + url: https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - by-side-effect: true + patterns: + - pattern-either: + - pattern: '{..., clientSecret: "...", ...} + + ' + - pattern: '{..., secretOrKey: "...", ...} + + ' + - pattern: '{..., consumerSecret: "...", ...} + + ' + - patterns: + - pattern-inside: '$OBJ = {} + + ... + + ' + - pattern-either: + - pattern: '$OBJ.clientSecret = "..." + + ' + - pattern: '$OBJ.secretOrKey = "..." + + ' + - pattern: '$OBJ.consumerSecret = "..." + + ' + - pattern: $OBJ + - patterns: + - pattern-inside: '$SECRET = ''...'' + + ... + + ' + - pattern-either: + - pattern: '{..., clientSecret: $SECRET, ...} + + ' + - pattern: '{..., secretOrKey: $SECRET, ...} + + ' + - pattern: '{..., consumerSecret: $SECRET, ...} + + ' + - patterns: + - pattern-inside: '$SECRET = ''...'' + + ... + + ' + - pattern-either: + - pattern-inside: '$VALUE = {..., clientSecret: $SECRET, ...} + + ... + + ' + - pattern-inside: '$VALUE = {..., secretOrKey: $SECRET, ...} + + ... + + ' + - pattern-inside: '$VALUE = {..., consumerSecret: $SECRET, ...} + + ... + + ' + - pattern: $VALUE + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$F = require("$I").Strategy + + ... + + ' + - pattern-inside: '$F = require("$I") + + ... + + ' + - pattern-inside: 'import { $STRAT as $F } from ''$I'' + + ... + + ' + - pattern-inside: 'import $F from ''$I'' + + ... + + ' + - metavariable-regex: + metavariable: $I + regex: (passport-.*) + - pattern-inside: 'new $F($VALUE,...) + + ' + - focus-metavariable: $VALUE +- id: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection + message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable + is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized + queries or prepared statements. + options: + interfile: true + metadata: + interfile: true + references: + - https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements + category: security + technology: + - express + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection + shortlink: https://sg.run/gjoe + semgrep.dev: + rule: + r_id: 22085 + rv_id: 1263241 + rule_id: yyU0GX + version_id: nWT2Llx + url: https://semgrep.dev/playground/r/nWT2Llx/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - pattern: $REQ.files.$ANYTHING.data.toString('utf8') + - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - pattern: files.$ANYTHING.data.toString('utf8') + - pattern: files.$ANYTHING['data'].toString('utf8') + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sequelize.query($QUERY,...) + - pattern: $DB.sequelize.query($QUERY,...) + - focus-metavariable: $QUERY + pattern-sanitizers: + - pattern-either: + - pattern: parseInt(...) + - pattern: $FUNC. ... .hash(...) +- id: problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification + message: Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. + This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification + against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, + and should not be used. + severity: WARNING + metadata: + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + category: security + cwe: 'CWE-319: Cleartext Transmission of Sensitive Information' + owasp: A03:2017 - Sensitive Data Exposure + references: + - https://nodejs.org/api/https.html#https_https_request_options_callback + - https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100 + subcategory: + - vuln + technology: + - node.js + vulnerability: Insecure Transport + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification + shortlink: https://sg.run/9oxr + semgrep.dev: + rule: + r_id: 9423 + rv_id: 946067 + rule_id: OrU3Y6 + version_id: JdTDybO + url: https://semgrep.dev/playground/r/JdTDybO/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification + origin: community + languages: + - javascript + - typescript + pattern-either: + - pattern: 'process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = 0; + + ' + - pattern: '{rejectUnauthorized:false} + + ' +- id: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust + message: Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from + user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention + mechanism e.g. input validation or sanitization depending on the context. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + references: + - https://angular.io/api/platform-browser/DomSanitizer + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + confidence: MEDIUM + category: security + technology: + - angular + - browser + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust + shortlink: https://sg.run/KWxP + semgrep.dev: + rule: + r_id: 9755 + rv_id: 1263902 + rule_id: oqUzgA + version_id: 5PTo1zk + url: https://semgrep.dev/playground/r/5PTo1zk/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust + origin: community + languages: + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: 'function ...({..., $X: string, ...}) { ... } + + ' + - pattern-inside: 'function ...(..., $X: string, ...) { ... } + + ' + - focus-metavariable: $X + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $X.$TRUST($Y) + - focus-metavariable: $Y + - pattern-not: '$X.$TRUST(`...`) + + ' + - pattern-not: '$X.$TRUST("...") + + ' + - metavariable-regex: + metavariable: $TRUST + regex: (bypassSecurityTrustHtml|bypassSecurityTrustStyle|bypassSecurityTrustScript|bypassSecurityTrustUrl|bypassSecurityTrustResourceUrl) + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import * as $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: '$S = require("underscore.string") + + ... + + ' + - pattern-either: + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "dompurify" + + ... + + ' + - pattern-inside: 'import { ..., $S,... } from "dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "dompurify" + + ... + + ' + - pattern-inside: '$S = require("dompurify") + + ... + + ' + - pattern-inside: 'import $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: '$S = require("isomorphic-dompurify") + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$VALUE = $S(...) + + ... + + ' + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: '$VALUE = $S.sanitize + + ... + + ' + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''xss''; + + ... + + ' + - pattern-inside: 'import * as $S from ''xss''; + + ... + + ' + - pattern-inside: '$S = require("xss") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''sanitize-html''; + + ... + + ' + - pattern-inside: 'import * as $S from "sanitize-html"; + + ... + + ' + - pattern-inside: '$S = require("sanitize-html") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern: sanitizer.sanitize(...) + - pattern-not: sanitizer.sanitize(SecurityContext.NONE, ...); +- id: typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption + message: 'Add "encryption: $Y.BucketEncryption.KMS_MANAGED" or "encryption: $Y.BucketEncryption.S3_MANAGED" to the bucket + props for Bucket construct $X' + metadata: + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + category: security + technology: + - AWS-CDK + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html + owasp: + - A03:2017 - Sensitive Data Exposure + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption + shortlink: https://sg.run/eowX + semgrep.dev: + rule: + r_id: 15276 + rv_id: 1263903 + rule_id: bwU8qz + version_id: GxTkeRx + url: https://semgrep.dev/playground/r/GxTkeRx/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption + origin: community + languages: + - typescript + severity: ERROR + pattern-either: + - patterns: + - pattern-inside: 'import {Bucket} from ''@aws-cdk/aws-s3'' + + ... + + ' + - pattern: const $X = new Bucket(...) + - pattern-not: 'const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS_MANAGED, ...}) + + ' + - pattern-not: 'const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS, ...}) + + ' + - pattern-not: 'const $X = new Bucket(..., {..., encryption: BucketEncryption.S3_MANAGED, ...}) + + ' + - patterns: + - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-s3'' + + ... + + ' + - pattern: const $X = new $Y.Bucket(...) + - pattern-not: 'const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS_MANAGED, ...}) + + ' + - pattern-not: 'const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS, ...}) + + ' + - pattern-not: 'const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.S3_MANAGED, ...}) + + ' +- id: typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl + message: Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the + property "enforceSSL" should be set to true + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + category: security + technology: + - AWS-CDK + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl + shortlink: https://sg.run/vqBX + semgrep.dev: + rule: + r_id: 15277 + rv_id: 1263904 + rule_id: NbUN8B + version_id: RGT0Llg + url: https://semgrep.dev/playground/r/RGT0Llg/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl + origin: community + languages: + - ts + severity: ERROR + pattern-either: + - patterns: + - pattern-inside: 'import {Bucket} from ''@aws-cdk/aws-s3''; + + ... + + ' + - pattern: const $X = new Bucket(...) + - pattern-not: 'const $X = new Bucket(..., {enforceSSL: true}, ...) + + ' + - patterns: + - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-s3''; + + ... + + ' + - pattern: const $X = new $Y.Bucket(...) + - pattern-not: 'const $X = new $Y.Bucket(..., {..., enforceSSL: true, ...}) + + ' +- id: typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue + message: 'Queue $X is missing encryption at rest. Add "encryption: $Y.QueueEncryption.KMS" or "encryption: $Y.QueueEncryption.KMS_MANAGED" + to the queue props to enable encryption at rest for the queue.' + metadata: + category: security + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + technology: + - AWS-CDK + references: + - https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html + owasp: + - A03:2017 - Sensitive Data Exposure + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue + shortlink: https://sg.run/d23P + semgrep.dev: + rule: + r_id: 15278 + rv_id: 1263905 + rule_id: kxUwqO + version_id: A8Tgd2W + url: https://semgrep.dev/playground/r/A8Tgd2W/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue + origin: community + languages: + - ts + severity: WARNING + pattern-either: + - patterns: + - pattern-inside: 'import {Queue} from ''@aws-cdk/aws-sqs'' + + ... + + ' + - pattern: const $X = new Queue(...) + - pattern-not: 'const $X = new Queue(..., {..., encryption: QueueEncryption.KMS_MANAGED, ...}) + + ' + - pattern-not: 'const $X = new Queue(..., {..., encryption: QueueEncryption.KMS, ...}) + + ' + - patterns: + - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-sqs'' + + ... + + ' + - pattern: const $X = new $Y.Queue(...) + - pattern-not: 'const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS_MANAGED, ...}) + + ' + - pattern-not: 'const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS, ...}) + + ' +- id: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod + message: Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. + Verify if this is intentional. + metadata: + cwe: + - 'CWE-306: Missing Authentication for Critical Function' + category: security + technology: + - AWS-CDK + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod + shortlink: https://sg.run/Z4p7 + semgrep.dev: + rule: + r_id: 15279 + rv_id: 1263906 + rule_id: wdUjZK + version_id: BjTkZA7 + url: https://semgrep.dev/playground/r/BjTkZA7/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod + origin: community + languages: + - ts + severity: WARNING + pattern-either: + - patterns: + - pattern-inside: 'import {Bucket} from ''@aws-cdk/aws-s3'' + + ... + + ' + - pattern: 'const $X = new Bucket(...) + + ... + + $X.grantPublicAccess(...) + + ' + - patterns: + - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-s3'' + + ... + + ' + - pattern: 'const $X = new $Y.Bucket(...) + + ... + + $X.grantPublicAccess(...) + + ' +- id: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public + message: CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically + accessible, including builds prior to the project being public. Ensure this is acceptable for the project. + metadata: + category: security + cwe: + - 'CWE-306: Missing Authentication for Critical Function' + technology: + - AWS-CDK + references: + - https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public + shortlink: https://sg.run/nK7G + semgrep.dev: + rule: + r_id: 15280 + rv_id: 1263907 + rule_id: x8UxXZ + version_id: DkTRbj1 + url: https://semgrep.dev/playground/r/DkTRbj1/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public + origin: community + languages: + - ts + severity: WARNING + pattern-either: + - patterns: + - pattern-inside: 'import {Project} from ''@aws-cdk/aws-codebuild'' + + ... + + ' + - pattern: 'const $X = new Project(..., {..., badge: true, ...}) + + ' + - patterns: + - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-codebuild'' + + ... + + ' + - pattern: 'const $X = new $Y.Project(..., {..., badge: true, ...}) + + ' +- id: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml + message: Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site + scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using + a sanitization library such as DOMPurify to sanitize your HTML. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html + category: security + confidence: MEDIUM + technology: + - react + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml + shortlink: https://sg.run/rAx6 + semgrep.dev: + rule: + r_id: 9769 + rv_id: 1263912 + rule_id: x8UWvK + version_id: l4TJR0v + url: https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml + origin: community + languages: + - typescript + - javascript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: 'function ...({..., $X, ...}) { ... } + + ' + - pattern-inside: 'function ...(..., $X, ...) { ... } + + ' + - focus-metavariable: $X + - pattern-not-inside: '$F. ... .$SANITIZEUNC(...) + + ' + pattern-sinks: + - patterns: + - focus-metavariable: $X + - pattern-either: + - pattern: '{...,dangerouslySetInnerHTML: {__html: $X},...} + + ' + - pattern: '<$Y ... dangerouslySetInnerHTML={{__html: $X}} /> + + ' + - pattern-not: '<$Y ... dangerouslySetInnerHTML={{__html: "..."}} /> + + ' + - pattern-not: '{...,dangerouslySetInnerHTML:{__html: "..."},...} + + ' + - metavariable-pattern: + patterns: + - pattern-not: '{...} + + ' + metavariable: $X + - pattern-not: '<... {__html: "..."} ...> + + ' + - pattern-not: '<... {__html: `...`} ...> + + ' + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import * as $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: '$S = require("underscore.string") + + ... + + ' + - pattern-either: + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "dompurify" + + ... + + ' + - pattern-inside: 'import { ..., $S,... } from "dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "dompurify" + + ... + + ' + - pattern-inside: '$S = require("dompurify") + + ... + + ' + - pattern-inside: 'import $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: '$S = require("isomorphic-dompurify") + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$VALUE = $S(...) + + ... + + ' + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: '$VALUE = $S.sanitize + + ... + + ' + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''xss''; + + ... + + ' + - pattern-inside: 'import * as $S from ''xss''; + + ... + + ' + - pattern-inside: '$S = require("xss") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''sanitize-html''; + + ... + + ' + - pattern-inside: 'import * as $S from "sanitize-html"; + + ... + + ' + - pattern-inside: '$S = require("sanitize-html") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: '$S = new Remarkable() + + ... + + ' + - pattern: $S.render(...) +- id: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method + message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) + attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as + DOMPurify to sanitize your HTML. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln + - https://developer.mozilla.org/en-US/docs/Web/API/Document/write + - https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML + category: security + confidence: MEDIUM + technology: + - react + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method + shortlink: https://sg.run/E5x8 + semgrep.dev: + rule: + r_id: 9781 + rv_id: 1263916 + rule_id: QrU68w + version_id: GxTkeRl + url: https://semgrep.dev/playground/r/GxTkeRl/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method + origin: community + languages: + - typescript + - javascript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: 'function ...({..., $X, ...}) { ... } + + ' + - pattern-inside: 'function ...(..., $X, ...) { ... } + + ' + - focus-metavariable: $X + - pattern-either: + - pattern: $X.$Y + - pattern: $X[...] + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "this.window.document. ... .$HTML('...',$SINK) \n" + - pattern: "window.document. ... .$HTML('...',$SINK) \n" + - pattern: "document.$HTML($SINK) \n" + - metavariable-regex: + metavariable: $HTML + regex: (writeln|write) + - focus-metavariable: $SINK + - patterns: + - pattern-either: + - pattern: "$PROP. ... .$HTML('...',$SINK) \n" + - metavariable-regex: + metavariable: $HTML + regex: (insertAdjacentHTML) + - focus-metavariable: $SINK + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import * as $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: '$S = require("underscore.string") + + ... + + ' + - pattern-either: + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "dompurify" + + ... + + ' + - pattern-inside: 'import { ..., $S,... } from "dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "dompurify" + + ... + + ' + - pattern-inside: '$S = require("dompurify") + + ... + + ' + - pattern-inside: 'import $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: '$S = require("isomorphic-dompurify") + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$VALUE = $S(...) + + ... + + ' + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: '$VALUE = $S.sanitize + + ... + + ' + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''xss''; + + ... + + ' + - pattern-inside: 'import * as $S from ''xss''; + + ... + + ' + - pattern-inside: '$S = require("xss") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''sanitize-html''; + + ... + + ' + - pattern-inside: 'import * as $S from "sanitize-html"; + + ... + + ' + - pattern-inside: '$S = require("sanitize-html") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: '$S = new Remarkable() + + ... + + ' + - pattern: $S.render(...) +- id: typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property + message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) + attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as + DOMPurify to sanitize your HTML. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html + category: security + confidence: MEDIUM + technology: + - react + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property + shortlink: https://sg.run/70Zv + semgrep.dev: + rule: + r_id: 9782 + rv_id: 1263917 + rule_id: 3qUBl4 + version_id: RGT0Lln + url: https://semgrep.dev/playground/r/RGT0Lln/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property + origin: community + languages: + - typescript + - javascript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: 'function ...({..., $X, ...}) { ... } + + ' + - pattern-inside: 'function ...(..., $X, ...) { ... } + + ' + - focus-metavariable: $X + - pattern-either: + - pattern: $X.$Y + - pattern: $X[...] + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$BODY = $REACT.useRef(...) + + ... + + ' + - pattern-inside: '$BODY = useRef(...) + + ... + + ' + - pattern-inside: '$BODY = findDOMNode(...) + + ... + + ' + - pattern-inside: '$BODY = createRef(...) + + ... + + ' + - pattern-inside: '$BODY = $REACT.findDOMNode(...) + + ... + + ' + - pattern-inside: '$BODY = $REACT.createRef(...) + + ... + + ' + - pattern-either: + - pattern: "$BODY. ... .$HTML = $SINK \n" + - pattern: "$BODY.$HTML = $SINK \n" + - metavariable-regex: + metavariable: $HTML + regex: (innerHTML|outerHTML) + - focus-metavariable: $SINK + - patterns: + - pattern-either: + - pattern: ReactDOM.findDOMNode(...).$HTML = $SINK + - metavariable-regex: + metavariable: $HTML + regex: (innerHTML|outerHTML) + - focus-metavariable: $SINK + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import * as $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: '$S = require("underscore.string") + + ... + + ' + - pattern-either: + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "dompurify" + + ... + + ' + - pattern-inside: 'import { ..., $S,... } from "dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "dompurify" + + ... + + ' + - pattern-inside: '$S = require("dompurify") + + ... + + ' + - pattern-inside: 'import $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: '$S = require("isomorphic-dompurify") + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$VALUE = $S(...) + + ... + + ' + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: '$VALUE = $S.sanitize + + ... + + ' + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''xss''; + + ... + + ' + - pattern-inside: 'import * as $S from ''xss''; + + ... + + ' + - pattern-inside: '$S = require("xss") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''sanitize-html''; + + ... + + ' + - pattern-inside: 'import * as $S from "sanitize-html"; + + ... + + ' + - pattern-inside: '$S = require("sanitize-html") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: '$S = new Remarkable() + + ... + + ' + - pattern: $S.render(...) +- id: typescript.react.security.react-insecure-request.react-insecure-request + message: Unencrypted request over HTTP detected. + metadata: + vulnerability: Insecure Transport + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + references: + - https://www.npmjs.com/package/axios + category: security + technology: + - react + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request + shortlink: https://sg.run/1n0b + semgrep.dev: + rule: + r_id: 9766 + rv_id: 1263918 + rule_id: NbUA3O + version_id: A8Tgd2p + url: https://semgrep.dev/playground/r/A8Tgd2p/typescript.react.security.react-insecure-request.react-insecure-request + origin: community + languages: + - typescript + - javascript + severity: ERROR + patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: 'import $AXIOS from ''axios''; + + ... + + $AXIOS.$METHOD(...) + + ' + - pattern-inside: '$AXIOS = require(''axios''); + + ... + + $AXIOS.$METHOD(...) + + ' + - pattern: $AXIOS.$VERB("$URL",...) + - metavariable-regex: + metavariable: $VERB + regex: ^(get|post|delete|head|patch|put|options) + - patterns: + - pattern-either: + - pattern-inside: 'import $AXIOS from ''axios''; + + ... + + $AXIOS(...) + + ' + - pattern-inside: '$AXIOS = require(''axios''); + + ... + + $AXIOS(...) + + ' + - pattern-either: + - pattern: '$AXIOS({url: "$URL"}, ...)' + - pattern: '$OPTS = {url: "$URL"} + + ... + + $AXIOS($OPTS, ...) + + ' + - pattern: fetch("$URL", ...) + - metavariable-regex: + metavariable: $URL + regex: ^([Hh][Tt][Tt][Pp]:\/\/(?!localhost).*) diff --git a/.semgrep/registry/owasp-top-ten.yaml b/.semgrep/registry/owasp-top-ten.yaml new file mode 100644 index 0000000..551d4e2 --- /dev/null +++ b/.semgrep/registry/owasp-top-ten.yaml @@ -0,0 +1,43429 @@ +# GENERATED FILE - DO NOT EDIT. +# Snapshot of Semgrep registry config(s): p/owasp-top-ten +# Rules are fetched from https://semgrep.dev/c/, deduplicated by rule id, +# and sorted. Refresh with: python3 .github/scripts/semgrep_registry.py sync +# (the semgrep-registry-update workflow does this on a schedule). +rules: +- id: bash.curl.security.curl-eval.curl-eval + severity: WARNING + languages: + - bash + message: Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could + inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If + you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity. + metadata: + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + category: security + technology: + - bash + - curl + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval + shortlink: https://sg.run/0yqJ + semgrep.dev: + rule: + r_id: 14554 + rv_id: 1262601 + rule_id: KxU7Rq + version_id: JdTzxL2 + url: https://semgrep.dev/playground/r/JdTzxL2/bash.curl.security.curl-eval.curl-eval + origin: community + mode: taint + pattern-sources: + - pattern: '$(curl ...) + + ' + - pattern: '`curl ...` + + ' + pattern-sinks: + - pattern: eval ... +- id: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe + languages: + - clojure + severity: ERROR + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://semgrep.dev/blog/2022/xml-security-in-java + - https://semgrep.dev/docs/cheat-sheets/java-xxe/ + - https://xerces.apache.org/xerces2-j/features.html + source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/xxe-clojure-xml/xxe-clojure-xml.yml + category: security + technology: + - clojure + - xml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe + shortlink: https://sg.run/v7An + semgrep.dev: + rule: + r_id: 71533 + rv_id: 1262608 + rule_id: bwU3Gj + version_id: WrTqKyD + url: https://semgrep.dev/playground/r/WrTqKyD/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe + origin: community + message: DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, + this is vulnerable to XML external entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" + to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done + by setting the features "http://xml.org/sax/features/external-general-entities" and "http://xml.org/sax/features/external-parameter-entities" + to false. + patterns: + - pattern-inside: '(ns ... (:require [clojure.xml :as ...])) + + ... + + ' + - pattern-either: + - pattern-inside: '(def ... ... ( ... )) + + ' + - pattern-inside: '(defn ... ... ( ... )) + + ' + - pattern-either: + - pattern: (clojure.xml/parse $INPUT) + - patterns: + - pattern-inside: '(doto (javax.xml.parsers.SAXParserFactory/newInstance) ...) + + ' + - pattern: (.setFeature "http://apache.org/xml/features/disallow-doctype-decl" false) + - pattern-not-inside: "(doto (javax.xml.parsers.SAXParserFactory/newInstance)\n ...\n (.setFeature \"http://xml.org/sax/features/external-general-entities\"\ + \ false)\n ...\n (.setFeature \"http://xml.org/sax/features/external-parameter-entities\" false)\n ...)\n" + - pattern-not-inside: "(doto (javax.xml.parsers.SAXParserFactory/newInstance)\n ...\n (.setFeature \"http://xml.org/sax/features/external-parameter-entities\"\ + \ false)\n ...\n (.setFeature \"http://xml.org/sax/features/external-general-entities\" false)\n ...)\n" +- id: clojure.lang.security.use-of-md5.use-of-md5 + languages: + - clojure + severity: WARNING + message: MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace + with current recommended hashing algorithms. + metadata: + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html + - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html + technology: + - clojure + source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/weak-hash-function-md5.yml + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + author: Gabriel Marquet + category: security + subcategory: + - vuln + confidence: HIGH + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5 + shortlink: https://sg.run/BgPx + semgrep.dev: + rule: + r_id: 52195 + rv_id: 1262609 + rule_id: nJU1ep + version_id: 0bTKz2B + url: https://semgrep.dev/playground/r/0bTKz2B/clojure.lang.security.use-of-md5.use-of-md5 + origin: community + pattern-either: + - pattern: (MessageDigest/getInstance "MD5") + - pattern: (MessageDigest/getInstance MessageDigestAlgorithms/MD5) + - pattern: (MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5) + - pattern: (java.security.MessageDigest/getInstance "MD5") + - pattern: (java.security.MessageDigest/getInstance MessageDigestAlgorithms/MD5) + - pattern: (java.security.MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5) +- id: clojure.lang.security.use-of-sha1.use-of-sha1 + languages: + - clojure + severity: WARNING + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not + suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function + applications. + metadata: + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html + - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html + technology: + - clojure + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + - 'CWE-328: Use of Weak Hash' + category: security + subcategory: + - vuln + confidence: HIGH + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1 + shortlink: https://sg.run/dvwX + semgrep.dev: + rule: + r_id: 71534 + rv_id: 1262610 + rule_id: NbUy12 + version_id: K3TKk7E + url: https://semgrep.dev/playground/r/K3TKk7E/clojure.lang.security.use-of-sha1.use-of-sha1 + origin: community + patterns: + - pattern-either: + - pattern: (MessageDigest/getInstance $ALGO) + - pattern: (java.security.MessageDigest/getInstance $ALGO) + - metavariable-regex: + metavariable: $ALGO + regex: (((org\.apache\.commons\.codec\.digest\.)?MessageDigestAlgorithms/)?"?(SHA-1|SHA1)"?) +- id: csharp.dotnet.security.audit.ldap-injection.ldap-injection + message: LDAP queries are constructed dynamically on user-controlled input. This vulnerability in code could lead to an + arbitrary LDAP query execution. + severity: ERROR + metadata: + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + category: security + cwe: + - 'CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (''LDAP Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection/ + - https://cwe.mitre.org/data/definitions/90 + - https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html#safe-c-sharp-net-tba-example + subcategory: + - vuln + technology: + - .net + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - LDAP Injection + source: https://semgrep.dev/r/csharp.dotnet.security.audit.ldap-injection.ldap-injection + shortlink: https://sg.run/GJ9z + semgrep.dev: + rule: + r_id: 27692 + rv_id: 1262612 + rule_id: 2ZUv3R + version_id: l4TJR8G + url: https://semgrep.dev/playground/r/l4TJR8G/csharp.dotnet.security.audit.ldap-injection.ldap-injection + origin: community + languages: + - csharp + mode: taint + options: + taint_unify_mvars: true + pattern-sources: + - patterns: + - focus-metavariable: $INPUT + - pattern-inside: $T $M(...,$INPUT,...) {...} + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $S.Filter = ... + $INPUT + ... + - pattern: $S.Filter = String.Format(...,$INPUT) + - pattern: $S.Filter = String.Concat(...,$INPUT) + pattern-sanitizers: + - pattern-either: + - pattern: Regex.Replace($INPUT, ...) + - pattern: $ENCODER.LdapFilterEncode($INPUT) + - pattern: $ENCODER.LdapDistinguishedNameEncode($INPUT) +- id: csharp.dotnet.security.audit.mass-assignment.mass-assignment + message: Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which + could create a new parameter in the binding request and manipulate the underlying object in the application. + severity: WARNING + metadata: + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + category: security + cwe: + - 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes' + owasp: + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + references: + - https://cwe.mitre.org/data/definitions/915.html + - https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md + subcategory: + - vuln + technology: + - .net + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mass Assignment + source: https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment + shortlink: https://sg.run/7B3e + semgrep.dev: + rule: + r_id: 26838 + rv_id: 1262613 + rule_id: x8Up5B + version_id: YDTZeD9 + url: https://semgrep.dev/playground/r/YDTZeD9/csharp.dotnet.security.audit.mass-assignment.mass-assignment + origin: community + languages: + - csharp + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: "public IActionResult $METHOD(..., $TYPE $ARG, ...){\n ...\n}\n" + - pattern: "public ActionResult $METHOD(..., $TYPE $ARG, ...){\n ...\n}\n" + - pattern-inside: 'using Microsoft.AspNetCore.Mvc; + + ... + + ' + - pattern-not: "public IActionResult $METHOD(..., [Bind(...)] $TYPE $ARG, ...){\n ...\n}\n" + - pattern-not: "public ActionResult $METHOD(..., [Bind(...)] $TYPE $ARG, ...){\n ...\n}\n" + - focus-metavariable: $ARG + pattern-sinks: + - pattern: View(...) +- id: csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization + message: Anonymous access shouldn't be allowed unless explicit by design. Access control checks are missing and potentially + can be bypassed. This finding violates the principle of least privilege or deny by default, where access should only be + permitted for a specific set of roles or conforms to a custom policy or users. + severity: INFO + metadata: + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + category: security + cwe: + - 'CWE-862: Missing Authorization' + cwe2021-top25: true + cwe2022-top25: true + cwe2023-top25: true + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + - https://cwe.mitre.org/data/definitions/862.html + - https://docs.microsoft.com/en-us/aspnet/core/security/authorization/simple?view=aspnetcore-7.0 + subcategory: + - vuln + technology: + - .net + - mvc + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization + shortlink: https://sg.run/Z8GA + semgrep.dev: + rule: + r_id: 26335 + rv_id: 1262615 + rule_id: eqU32Y + version_id: o5TbD41 + url: https://semgrep.dev/playground/r/o5TbD41/csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization + origin: community + languages: + - csharp + patterns: + - pattern: "public class $CLASS : Controller {\n ...\n}\n" + - pattern-inside: 'using Microsoft.AspNetCore.Mvc; + + ... + + ' + - pattern-not: "[AllowAnonymous]\npublic class $CLASS : Controller {\n ...\n}\n" + - pattern-not: "[Authorize]\npublic class $CLASS : Controller {\n ...\n}\n" + - pattern-not: "[Authorize(Roles = ...)]\npublic class $CLASS : Controller {\n ...\n}\n" + - pattern-not: "[Authorize(Policy = ...)]\npublic class $CLASS : Controller {\n ...\n}\n" +- id: csharp.dotnet.security.audit.open-directory-listing.open-directory-listing + message: An open directory listing is potentially exposed, potentially revealing sensitive information to attackers. + severity: INFO + metadata: + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + category: security + cwe: + - 'CWE-548: Exposure of Information Through Directory Listing' + owasp: + - A06:2017 - Security Misconfiguration + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://cwe.mitre.org/data/definitions/548.html + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration/ + - https://docs.microsoft.com/en-us/aspnet/core/fundamentals/static-files?view=aspnetcore-7.0#directory-browsing + subcategory: + - vuln + technology: + - .net + - mvc + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/csharp.dotnet.security.audit.open-directory-listing.open-directory-listing + shortlink: https://sg.run/n0y1 + semgrep.dev: + rule: + r_id: 26336 + rv_id: 1262616 + rule_id: v8U8Ab + version_id: zyTb2Y2 + url: https://semgrep.dev/playground/r/zyTb2Y2/csharp.dotnet.security.audit.open-directory-listing.open-directory-listing + origin: community + languages: + - csharp + patterns: + - pattern-either: + - pattern: (IApplicationBuilder $APP).UseDirectoryBrowser(...); + - pattern: $BUILDER.Services.AddDirectoryBrowser(...); + - pattern-inside: "public void Configure(...) {\n ...\n}\n" +- id: csharp.dotnet.security.audit.xpath-injection.xpath-injection + message: XPath queries are constructed dynamically on user-controlled input. This vulnerability in code could lead to an + XPath Injection exploitation. + severity: ERROR + metadata: + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + category: security + cwe: + - 'CWE-643: Improper Neutralization of Data within XPath Expressions (''XPath Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection/ + - https://cwe.mitre.org/data/definitions/643.html + subcategory: + - vuln + technology: + - .net + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XPath Injection + source: https://semgrep.dev/r/csharp.dotnet.security.audit.xpath-injection.xpath-injection + shortlink: https://sg.run/4KP7 + semgrep.dev: + rule: + r_id: 27400 + rv_id: 1262618 + rule_id: x8Uj2k + version_id: 2KTv2Pq + url: https://semgrep.dev/playground/r/2KTv2Pq/csharp.dotnet.security.audit.xpath-injection.xpath-injection + origin: community + languages: + - csharp + mode: taint + pattern-sources: + - pattern-either: + - pattern: $T $M($INPUT,...) {...} + - pattern: "$T $M(...) {\n ...\n string $INPUT;\n}\n" + pattern-sinks: + - pattern-either: + - pattern: XPathExpression $EXPR = $NAV.Compile("..." + $INPUT + "..."); + - pattern: var $EXPR = $NAV.Compile("..." + $INPUT + "..."); + - pattern: XPathNodeIterator $NODE = $NAV.Select("..." + $INPUT + "..."); + - pattern: var $NODE = $NAV.Select("..." + $INPUT + "..."); + - pattern: Object $OBJ = $NAV.Evaluate("..." + $INPUT + "..."); + - pattern: var $OBJ = $NAV.Evaluate("..." + $INPUT + "..."); +- id: csharp.dotnet.security.razor-template-injection.razor-template-injection + message: User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process. + severity: WARNING + metadata: + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + category: security + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + cwe2022-top25: true + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/ + subcategory: + - vuln + technology: + - .net + - razor + - asp + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection + shortlink: https://sg.run/oyj0 + semgrep.dev: + rule: + r_id: 18216 + rv_id: 1262621 + rule_id: EwUr68 + version_id: 1QTypdj + url: https://semgrep.dev/playground/r/1QTypdj/csharp.dotnet.security.razor-template-injection.razor-template-injection + origin: community + languages: + - csharp + mode: taint + pattern-sources: + - patterns: + - focus-metavariable: $ARG + - pattern-inside: 'public ActionResult $METHOD(..., string $ARG,...){...} + + ' + pattern-sinks: + - pattern: 'Razor.Parse(...) + + ' + pattern-sanitizers: + - not_conflicting: true + pattern: $F(...) +- id: csharp.dotnet.security.use_deprecated_cipher_algorithm.use_deprecated_cipher_algorithm + message: Usage of deprecated cipher algorithm detected. Use Aes or ChaCha20Poly1305 instead. + severity: ERROR + metadata: + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + category: security + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.des?view=net-6.0#remarks + - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.rc2?view=net-6.0#remarks + - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aes?view=net-6.0 + - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0 + subcategory: + - vuln + technology: + - .net + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/csharp.dotnet.security.use_deprecated_cipher_algorithm.use_deprecated_cipher_algorithm + shortlink: https://sg.run/k8Qo + semgrep.dev: + rule: + r_id: 36772 + rv_id: 1262622 + rule_id: WAUJr0 + version_id: 9lT4bRK + url: https://semgrep.dev/playground/r/9lT4bRK/csharp.dotnet.security.use_deprecated_cipher_algorithm.use_deprecated_cipher_algorithm + origin: community + languages: + - csharp + patterns: + - pattern: $KEYTYPE.Create(...); + - metavariable-pattern: + metavariable: $KEYTYPE + pattern-either: + - pattern: DES + - pattern: RC2 +- id: csharp.dotnet.security.use_ecb_mode.use_ecb_mode + message: Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented + by the classes AesGcm or ChaCha20Poly1305. + severity: WARNING + metadata: + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + category: security + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0 + - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0 + - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0 + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes + subcategory: + - vuln + technology: + - .net + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode + shortlink: https://sg.run/wj9n + semgrep.dev: + rule: + r_id: 36773 + rv_id: 1262623 + rule_id: 0oUqWP + version_id: yeTxpPw + url: https://semgrep.dev/playground/r/yeTxpPw/csharp.dotnet.security.use_ecb_mode.use_ecb_mode + origin: community + languages: + - csharp + patterns: + - pattern-either: + - pattern: ($KEYTYPE $KEY).EncryptEcb(...); + - pattern: ($KEYTYPE $KEY).DecryptEcb(...); + - pattern: ($KEYTYPE $KEY).Mode = CipherMode.ECB; + - metavariable-pattern: + metavariable: $KEYTYPE + pattern-either: + - pattern: SymmetricAlgorithm + - pattern: Aes + - pattern: Rijndael + - pattern: DES + - pattern: TripleDES + - pattern: RC2 +- id: csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration + message: You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never + be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead. + severity: ERROR + metadata: + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + category: security + cwe: + - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks + - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0 + - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors + - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key + subcategory: + - vuln + technology: + - .net + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration + shortlink: https://sg.run/xjrA + semgrep.dev: + rule: + r_id: 36774 + rv_id: 1262624 + rule_id: KxU3Nq + version_id: rxTAK2O + url: https://semgrep.dev/playground/r/rxTAK2O/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration + origin: community + languages: + - csharp + mode: taint + pattern-sources: + - patterns: + - pattern-inside: (System.Random $RNG).NextBytes($KEY); ... + - pattern: $KEY + pattern-sinks: + - pattern-either: + - patterns: + - pattern: ($KEYTYPE $CIPHER).Key = $SINK; + - focus-metavariable: $SINK + - metavariable-pattern: + metavariable: $KEYTYPE + pattern-either: + - pattern: SymmetricAlgorithm + - pattern: Aes + - pattern: Rijndael + - pattern: DES + - pattern: TripleDES + - pattern: RC2 + - pattern: new AesGcm(...) + - pattern: new AesCcm(...) + - pattern: new ChaCha20Poly1305(...) +- id: csharp.dotnet.security.use_weak_rsa_encryption_padding.use_weak_rsa_encryption_padding + message: You are using the outdated PKCS#1 v1.5 encryption padding for your RSA key. Use the OAEP padding instead. + severity: WARNING + metadata: + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + category: security + cwe: + - 'CWE-780: Use of RSA Algorithm without OAEP' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.rsapkcs1keyexchangeformatter + - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.rsaoaepkeyexchangeformatter + - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.rsapkcs1keyexchangedeformatter + - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.rsaoaepkeyexchangedeformatter + subcategory: + - vuln + technology: + - .net + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/csharp.dotnet.security.use_weak_rsa_encryption_padding.use_weak_rsa_encryption_padding + shortlink: https://sg.run/GoJ1 + semgrep.dev: + rule: + r_id: 35492 + rv_id: 1262625 + rule_id: QrU2G5 + version_id: bZT53zb + url: https://semgrep.dev/playground/r/bZT53zb/csharp.dotnet.security.use_weak_rsa_encryption_padding.use_weak_rsa_encryption_padding + origin: community + languages: + - csharp + pattern-either: + - pattern: (RSAPKCS1KeyExchangeFormatter $FORMATER).CreateKeyExchange(...); + - pattern: (RSAPKCS1KeyExchangeDeformatter $DEFORMATER).DecryptKeyExchange(...); +- id: csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation + patterns: + - pattern-either: + - patterns: + - pattern: $LIFETIME = $FALSE + - pattern-inside: new TokenValidationParameters {...} + - patterns: + - pattern: '(TokenValidationParameters $OPTS). ... .$LIFETIME = $FALSE + + ' + - metavariable-regex: + metavariable: $LIFETIME + regex: (RequireExpirationTime|ValidateLifetime) + - metavariable-regex: + metavariable: $FALSE + regex: (false) + - focus-metavariable: $FALSE + fix: 'true + + ' + message: The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. + This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate + the JWT lifetime to ensure only valid tokens are used. + metadata: + category: security + technology: + - csharp + owasp: + - A02:2017 - Broken Authentication + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe: + - 'CWE-613: Insufficient Session Expiration' + references: + - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/ + - https://cwe.mitre.org/data/definitions/613.html + - https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet + subcategory: + - audit + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation + shortlink: https://sg.run/KA0d + semgrep.dev: + rule: + r_id: 28955 + rv_id: 1262628 + rule_id: bwU5kK + version_id: w8TRolJ + url: https://semgrep.dev/playground/r/w8TRolJ/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation + origin: community + languages: + - csharp + severity: WARNING +- id: csharp.lang.security.cryptography.unsigned-security-token.unsigned-security-token + patterns: + - pattern: RequireSignedTokens = false + - pattern-inside: "new TokenValidationParameters {\n ...\n}\n" + fix: RequireSignedTokens = true + message: Accepting unsigned security tokens as valid security tokens allows an attacker to remove its signature and potentially + forge an identity. As a fix, set RequireSignedTokens to be true. + metadata: + category: security + technology: + - csharp + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-347: Improper Verification of Cryptographic Signature' + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control/ + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/ + - https://cwe.mitre.org/data/definitions/347 + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/csharp.lang.security.cryptography.unsigned-security-token.unsigned-security-token + shortlink: https://sg.run/pqzN + semgrep.dev: + rule: + r_id: 26718 + rv_id: 1262631 + rule_id: KxUGLw + version_id: e1Tyjrz + url: https://semgrep.dev/playground/r/e1Tyjrz/csharp.lang.security.cryptography.unsigned-security-token.unsigned-security-token + origin: community + languages: + - csharp + severity: ERROR +- id: csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation + severity: WARNING + languages: + - csharp + metadata: + cwe: + - 'CWE-295: Improper Certificate Validation' + owasp: + - A03:2017 - Sensitive Data Exposure + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8 + category: security + technology: + - .net + confidence: MEDIUM + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation + shortlink: https://sg.run/XZ6B + semgrep.dev: + rule: + r_id: 18220 + rv_id: 1262629 + rule_id: gxUy01 + version_id: xyTjzGW + url: https://semgrep.dev/playground/r/xyTjzGW/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation + origin: community + message: Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead. + patterns: + - pattern-inside: 'using System.IdentityModel.Tokens; + + ... + + ' + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: 'X509SecurityToken $TOK = $RHS; + + ... + + ' + - pattern-inside: "$T $M(..., X509SecurityToken $TOK, ...) {\n ...\n}\n" + - metavariable-pattern: + metavariable: $RHS + pattern-either: + - pattern: $T as X509SecurityToken + - pattern: new X509SecurityToken(...) + - patterns: + - pattern-either: + - pattern-inside: 'X509Certificate2 $CERT = new X509Certificate2(...); + + ... + + ' + - pattern-inside: "$T $M(..., X509Certificate2 $CERT, ...) {\n ...\n}\n" + - pattern-inside: "foreach (X509Certificate2 $CERT in $COLLECTION) {\n ...\n}\n" + - patterns: + - pattern-either: + - pattern: String.Equals($NAME, "...") + - pattern: String.Equals("...", $NAME) + - pattern: $NAME.Equals("...") + - pattern: $NAME == "..." + - pattern: $NAME != "..." + - pattern: '"..." == $NAME + + ' + - pattern: '"..." != $NAME + + ' + - metavariable-pattern: + metavariable: $NAME + pattern-either: + - pattern: $TOK.Certificate.SubjectName.Name + - pattern: $CERT.SubjectName.Name + - pattern: $CERT.GetNameInfo(...) +- id: csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine + mode: taint + pattern-sources: + - patterns: + - pattern: $A + - pattern-inside: 'Path.Combine(...,$A,...) + + ' + - pattern-inside: 'public $TYPE $M(...,$A,...){...} + + ' + - pattern-not-inside: '<... Path.GetFileName($A) != $A ...> + + ' + pattern-sinks: + - patterns: + - focus-metavariable: $X + - pattern: 'File.$METHOD($X,...) + + ' + - metavariable-regex: + metavariable: $METHOD + regex: (?i)^(read|write) + pattern-sanitizers: + - pattern: 'Path.GetFileName(...) + + ' + - patterns: + - pattern-inside: '$X = Path.GetFileName(...); + + ... + + ' + - pattern: $X + - patterns: + - pattern: $X + - pattern-inside: "if(<... Path.GetFileName($X) != $X ...>){\n ...\n throw new $EXCEPTION(...);\n}\n...\n" + message: String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. + If the path is user-supplied data this can lead to path traversal. + languages: + - csharp + severity: WARNING + metadata: + category: security + confidence: MEDIUM + references: + - https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/ + - https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks + technology: + - .net + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine + shortlink: https://sg.run/1RvG + semgrep.dev: + rule: + r_id: 18222 + rv_id: 1262632 + rule_id: 3qU3bE + version_id: vdT0644 + url: https://semgrep.dev/playground/r/vdT0644/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine + origin: community +- id: csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings + severity: WARNING + languages: + - C# + metadata: + cwe: + - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0 + category: security + technology: + - .net + confidence: MEDIUM + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings + shortlink: https://sg.run/9LJr + semgrep.dev: + rule: + r_id: 18223 + rv_id: 1262633 + rule_id: 4bUQ81 + version_id: d6Tyx4K + url: https://semgrep.dev/playground/r/d6Tyx4K/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings + origin: community + message: The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers + more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, + you can use "*.asdf.gov" if you own all of "asdf.gov". + patterns: + - pattern-inside: 'using System.Net; + + ... + + ' + - pattern: $LISTENER.Prefixes.Add("$PREFIX") + - metavariable-regex: + metavariable: $PREFIX + regex: (http|https)://(\*|\+)(.[a-zA-Z]{2,})?:[0-9]+ +- id: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization + severity: WARNING + languages: + - C# + metadata: + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + references: + - https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide + category: security + technology: + - .net + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization + shortlink: https://sg.run/ZeXW + semgrep.dev: + rule: + r_id: 11135 + rv_id: 1262635 + rule_id: bwUOjK + version_id: nWT2LGp + url: https://semgrep.dev/playground/r/nWT2LGp/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization + origin: community + message: The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using + BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter + is insecure and can't be made secure + patterns: + - pattern-inside: 'using System.Runtime.Serialization.Formatters.Binary; + + ... + + ' + - pattern: 'new BinaryFormatter(); + + ' +- id: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization + severity: WARNING + languages: + - C# + metadata: + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + references: + - https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution + category: security + technology: + - .net + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization + shortlink: https://sg.run/E5e5 + semgrep.dev: + rule: + r_id: 11137 + rv_id: 1262638 + rule_id: kxURnR + version_id: LjTkgPk + url: https://semgrep.dev/playground/r/LjTkgPk/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization + origin: community + message: The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization + vulnerability. + patterns: + - pattern-inside: 'using MBrace.FsPickler.Json; + + ... + + ' + - pattern: 'FsPickler.CreateJsonSerializer(); + + ' +- id: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization + severity: WARNING + languages: + - C# + metadata: + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + references: + - https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8 + category: security + technology: + - .net + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization + shortlink: https://sg.run/70pG + semgrep.dev: + rule: + r_id: 11138 + rv_id: 1262641 + rule_id: wdU87G + version_id: QkTGqnA + url: https://semgrep.dev/playground/r/QkTGqnA/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization + origin: community + message: The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter + as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and + can't be made secure + patterns: + - pattern-inside: 'using System.Web.UI; + + ... + + ' + - pattern: 'new LosFormatter(); + + ' +- id: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization + severity: WARNING + languages: + - C# + metadata: + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + references: + - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security + category: security + technology: + - .net + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization + shortlink: https://sg.run/L0AX + semgrep.dev: + rule: + r_id: 11139 + rv_id: 1262642 + rule_id: x8UW7x + version_id: 3ZT4X6b + url: https://semgrep.dev/playground/r/3ZT4X6b/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization + origin: community + message: The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should + stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. + NetDataContractSerializer is insecure and can't be made secure + patterns: + - pattern-inside: 'using System.Runtime.Serialization; + + ... + + ' + - pattern: 'new NetDataContractSerializer(); + + ' +- id: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization + severity: WARNING + languages: + - C# + metadata: + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + references: + - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks + category: security + technology: + - .net + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization + shortlink: https://sg.run/gJnR + semgrep.dev: + rule: + r_id: 11141 + rv_id: 1262644 + rule_id: eqUvND + version_id: PkTR30n + url: https://semgrep.dev/playground/r/PkTR30n/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization + origin: community + message: The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using + SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is + insecure and can't be made secure + patterns: + - pattern-inside: 'using System.Runtime.Serialization.Formatters.Soap; + + ... + + ' + - pattern: 'new SoapFormatter(); + + ' +- id: csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout + severity: WARNING + languages: + - C# + metadata: + cwe: + - 'CWE-1333: Inefficient Regular Expression Complexity' + owasp: A01:2017 - Injection + references: + - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS + - https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout + - https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0 + category: security + technology: + - .net + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Denial-of-Service (DoS) + source: https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout + shortlink: https://sg.run/NgRy + semgrep.dev: + rule: + r_id: 18227 + rv_id: 945224 + rule_id: GdUDBP + version_id: yeT0nDq + url: https://semgrep.dev/playground/r/yeT0nDq/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout + origin: community + message: 'Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider + setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double + check that your context meets the conditions outlined in the "Notes to Callers" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0' + patterns: + - pattern-inside: 'using System.Text.RegularExpressions; + + ... + + ' + - pattern-either: + - pattern: new Regex(..., TimeSpan.InfiniteMatchTimeout) + - patterns: + - pattern: new Regex(..., TimeSpan.FromSeconds($TIME)) + - metavariable-comparison: + metavariable: $TIME + comparison: $TIME > 5 + - pattern: new Regex(..., TimeSpan.FromMinutes(...)) + - pattern: new Regex(..., TimeSpan.FromHours(...)) +- id: csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos + severity: WARNING + languages: + - C# + metadata: + cwe: + - 'CWE-1333: Inefficient Regular Expression Complexity' + owasp: A01:2017 - Injection + references: + - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS + - https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples + category: security + technology: + - .net + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Denial-of-Service (DoS) + source: https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos + shortlink: https://sg.run/RPyY + semgrep.dev: + rule: + r_id: 12005 + rv_id: 945225 + rule_id: 4bU2gd + version_id: rxT6rjl + url: https://semgrep.dev/playground/r/rxT6rjl/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos + origin: community + message: When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout. A malicious user can provide + input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead + to excessive CPU usage, causing a Denial-of-Service attack + patterns: + - pattern-inside: 'using System.Text.RegularExpressions; + + ... + + ' + - pattern-either: + - pattern: "public $T $F($X)\n{\n Regex $Y = new Regex($P);\n ...\n $Y.Match($X);\n}\n" + - pattern: "public $T $F($X)\n{\n Regex $Y = new Regex($P, $O);\n ...\n $Y.Match($X);\n}\n" + - pattern: "public $T $F($X)\n{\n ... Regex.Match($X, $P);\n}\n" + - pattern: "public $T $F($X)\n{\n ... Regex.Match($X, $P, $O);\n}\n" +- id: csharp.lang.security.sqli.csharp-sqli.csharp-sqli + mode: taint + pattern-sources: + - patterns: + - pattern: '(string $X) + + ' + - pattern-not: '"..." + + ' + pattern-propagators: + - pattern: (StringBuilder $B).$ANY(...,(string $X),...) + from: $X + to: $B + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: 'new $PATTERN($CMD,...) + + ' + - focus-metavariable: $CMD + - patterns: + - pattern: '$CMD.$PATTERN = $VALUE; + + ' + - focus-metavariable: $VALUE + - metavariable-regex: + metavariable: $PATTERN + regex: ^(SqlCommand|CommandText|OleDbCommand|OdbcCommand|OracleCommand)$ + pattern-sanitizers: + - pattern-either: + - pattern: '$CMD.Parameters.Add(...) + + ' + - pattern: '$CMD.Parameters.AddRange(...) + + ' + - pattern: '$CMD.Parameters.AddWithValue(...) + + ' + - pattern: '$CMD.Parameters[$IDX].Value = ... + + ' + by-side-effect: true + message: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement + are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and + 'SqlParameter'. + metadata: + category: security + technology: + - csharp + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli + shortlink: https://sg.run/d2Xd + semgrep.dev: + rule: + r_id: 15078 + rv_id: 1262648 + rule_id: x8UxeP + version_id: RGT0LqW + url: https://semgrep.dev/playground/r/RGT0LqW/csharp.lang.security.sqli.csharp-sqli.csharp-sqli + origin: community + languages: + - csharp + severity: ERROR +- id: csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure + patterns: + - pattern: $APP.UseDeveloperExceptionPage(...); + - pattern-not-inside: "if ($ENV.IsDevelopment(...)) {\n ...\n}\n" + - pattern-not-inside: "if ($ENV.EnvironmentName == \"Development\") {\n ...\n}\n" + message: Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace + information in a production environment aids an attacker in reconnaissance and information gathering. + metadata: + category: security + technology: + - csharp + owasp: + - A06:2017 - Security Misconfiguration + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + cwe: + - 'CWE-209: Generation of Error Message Containing Sensitive Information' + references: + - https://cwe.mitre.org/data/definitions/209.html + - https://owasp.org/Top10/A04_2021-Insecure_Design/ + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure + shortlink: https://sg.run/XvkA + semgrep.dev: + rule: + r_id: 26720 + rv_id: 1262653 + rule_id: lBU6Dv + version_id: 0bTKzrB + url: https://semgrep.dev/playground/r/0bTKzrB/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure + origin: community + languages: + - csharp + severity: WARNING +- id: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override + mode: taint + pattern-sources: + - patterns: + - focus-metavariable: $ARG + - pattern-inside: 'public $T $M(...,string $ARG,...){...} + + ' + pattern-sinks: + - patterns: + - pattern: '$XMLDOCUMENT.$METHOD(...) + + ' + - pattern-inside: "XmlDocument $XMLDOCUMENT = new XmlDocument(...);\n...\n$XMLDOCUMENT.XmlResolver = new XmlUrlResolver(...);\n\ + ... \n" + message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. + Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable + data. + languages: + - csharp + severity: WARNING + metadata: + category: security + references: + - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ + - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks + technology: + - .net + - xml + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override + shortlink: https://sg.run/k98P + semgrep.dev: + rule: + r_id: 18228 + rv_id: 1262654 + rule_id: ReUK9k + version_id: K3TKk5E + url: https://semgrep.dev/playground/r/K3TKk5E/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override + origin: community +- id: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override + mode: taint + pattern-sources: + - patterns: + - focus-metavariable: $ARG + - pattern-inside: 'public $T $M(...,string $ARG,...){...} + + ' + pattern-sinks: + - patterns: + - pattern: 'XmlReader $READER = XmlReader.Create(...,$RS,...); + + ' + - pattern-inside: "XmlReaderSettings $RS = new XmlReaderSettings();\n...\n$RS.DtdProcessing = DtdProcessing.Parse;\n...\ + \ \n" + message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. + Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable + data. + languages: + - csharp + severity: WARNING + metadata: + category: security + references: + - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ + - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks + technology: + - .net + - xml + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override + shortlink: https://sg.run/wXjA + semgrep.dev: + rule: + r_id: 18229 + rv_id: 1262655 + rule_id: AbU3pX + version_id: qkTR7WD + url: https://semgrep.dev/playground/r/qkTR7WD/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override + origin: community +- id: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults + mode: taint + pattern-sources: + - patterns: + - focus-metavariable: $ARG + - pattern-inside: 'public $T $M(...,string $ARG,...){...} + + ' + pattern-sinks: + - patterns: + - pattern: '$READER.$METHOD(...) + + ' + - pattern-not-inside: '$READER.DtdProcessing = DtdProcessing.Prohibit; + + ... + + ' + - pattern-inside: 'XmlTextReader $READER = new XmlTextReader(...); + + ... + + ' + message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. + Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable + data. + languages: + - csharp + severity: WARNING + metadata: + category: security + references: + - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ + - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks + technology: + - .net + - xml + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults + shortlink: https://sg.run/xXjL + semgrep.dev: + rule: + r_id: 18230 + rv_id: 1262656 + rule_id: BYUevk + version_id: l4TJRWG + url: https://semgrep.dev/playground/r/l4TJRWG/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults + origin: community +- id: dockerfile.security.last-user-is-root.last-user-is-root + patterns: + - pattern: USER root + - pattern-not-inside: + patterns: + - pattern: 'USER root + + ... + + USER $X + + ' + - metavariable-pattern: + metavariable: $X + patterns: + - pattern-not: root + message: The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the + container they will have root access. Switch back to another user after running commands as 'root'. + severity: ERROR + languages: + - dockerfile + metadata: + cwe: + - 'CWE-269: Improper Privilege Management' + source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3002 + references: + - https://github.com/hadolint/hadolint/wiki/DL3002 + category: security + technology: + - dockerfile + confidence: MEDIUM + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root + shortlink: https://sg.run/5Z43 + semgrep.dev: + rule: + r_id: 20147 + rv_id: 1262658 + rule_id: ReU2n5 + version_id: 6xT29Eg + url: https://semgrep.dev/playground/r/6xT29Eg/dockerfile.security.last-user-is-root.last-user-is-root + origin: community +- id: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint + patterns: + - pattern: 'ENTRYPOINT $...VARS + + ' + - pattern-not-inside: 'USER $USER + + ... + + ' + fix: 'USER non-root + + ENTRYPOINT $...VARS + + ' + message: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker + can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile + is a USER other than 'root'. + severity: ERROR + languages: + - dockerfile + metadata: + cwe: + - 'CWE-269: Improper Privilege Management' + category: security + technology: + - dockerfile + confidence: MEDIUM + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint + shortlink: https://sg.run/k281 + semgrep.dev: + rule: + r_id: 47272 + rv_id: 1262659 + rule_id: ReUW9E + version_id: o5TbD21 + url: https://semgrep.dev/playground/r/o5TbD21/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint + origin: community +- id: dockerfile.security.missing-user.missing-user + patterns: + - pattern: 'CMD $...VARS + + ' + - pattern-not-inside: 'USER $USER + + ... + + ' + - pattern-not-inside: 'HEALTHCHECK ... CMD ... + + ' + fix: 'USER non-root + + CMD $...VARS + + ' + message: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker + can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile + is a USER other than 'root'. + severity: ERROR + languages: + - dockerfile + metadata: + cwe: + - 'CWE-250: Execution with Unnecessary Privileges' + category: security + technology: + - dockerfile + confidence: MEDIUM + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/dockerfile.security.missing-user.missing-user + shortlink: https://sg.run/Gbvn + semgrep.dev: + rule: + r_id: 20148 + rv_id: 1262660 + rule_id: AbUN06 + version_id: zyTb2n2 + url: https://semgrep.dev/playground/r/zyTb2n2/dockerfile.security.missing-user.missing-user + origin: community +- id: dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile + patterns: + - pattern: 'RUN sudo ... + + ' + message: Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact of + configuration errors and security vulnerabilities. + metadata: + category: security + technology: + - dockerfile + cwe: + - 'CWE-250: Execution with Unnecessary Privileges' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://cwe.mitre.org/data/definitions/250.html + - https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile + shortlink: https://sg.run/80Q7 + semgrep.dev: + rule: + r_id: 66384 + rv_id: 1262661 + rule_id: kxUlx1 + version_id: pZT03zY + url: https://semgrep.dev/playground/r/pZT03zY/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile + origin: community + languages: + - dockerfile + severity: WARNING +- id: generic.ci.security.bash-reverse-shell.bash_reverse_shell + metadata: + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + category: security + technology: + - ci + confidence: HIGH + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + subcategory: + - audit + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell + shortlink: https://sg.run/4l9l + semgrep.dev: + rule: + r_id: 16200 + rv_id: 1262664 + rule_id: gxUJrJ + version_id: jQTn5QE + url: https://semgrep.dev/playground/r/jQTn5QE/generic.ci.security.bash-reverse-shell.bash_reverse_shell + origin: community + message: Semgrep found a bash reverse shell + severity: ERROR + languages: + - generic + pattern-either: + - pattern: 'sh -i >& /dev/udp/.../... 0>&1 + + ' + - pattern: '<...>/dev/tcp/.../...; sh <&... >&... 2>& + + ' + - pattern: '<...>/dev/tcp/.../...; cat <&... | while read line; do $line 2>&... >&...;done + + ' + - pattern: 'sh -i ...<...> /dev/tcp/.../... ...<&... 1>&... 2>& + + ' +- id: generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host + paths: + include: + - '*.conf' + - '*.vhost' + - '**/sites-available/*' + - '**/sites-enabled/*' + languages: + - generic + severity: WARNING + message: The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an + attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving + them with 'map' or something similar. + metadata: + source-rule-url: https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md + references: + - https://nginx.org/en/docs/http/ngx_http_map_module.html + category: security + technology: + - nginx + confidence: MEDIUM + cwe: + - 'CWE-441: Unintended Proxy or Intermediary (''Confused Deputy'')' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host + shortlink: https://sg.run/ndpb + semgrep.dev: + rule: + r_id: 9036 + rv_id: 1262671 + rule_id: GdU7yl + version_id: kbTzG2j + url: https://semgrep.dev/playground/r/kbTzG2j/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host + origin: community + pattern-either: + - pattern: proxy_pass $SCHEME://$$HOST ...; + - pattern: proxy_pass $$SCHEME://$$HOST ...; +- id: generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme + paths: + include: + - '*.conf' + - '*.vhost' + - '**/sites-available/*' + - '**/sites-enabled/*' + languages: + - generic + severity: WARNING + message: The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected + by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy. + metadata: + cwe: + - 'CWE-16: CWE CATEGORY: Configuration' + references: + - https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md + category: security + technology: + - nginx + confidence: MEDIUM + owasp: + - A06:2017 - Security Misconfiguration + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme + shortlink: https://sg.run/EkAo + semgrep.dev: + rule: + r_id: 9037 + rv_id: 1262672 + rule_id: ReUg7n + version_id: w8TRoAJ + url: https://semgrep.dev/playground/r/w8TRoAJ/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme + origin: community + pattern: proxy_pass $$SCHEME:// ...; +- id: generic.nginx.security.header-injection.header-injection + pattern: "location ... <$VARIABLE> ... {\n ...\n add_header ... $$VARIABLE\n ...\n}\n" + paths: + include: + - '*.conf' + - '*.vhost' + - '**/sites-available/*' + - '**/sites-enabled/*' + languages: + - generic + severity: ERROR + message: 'The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline + and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the + path parameter: ''[^\s]+''.' + metadata: + cwe: + - 'CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (''HTTP Request/Response Splitting'')' + references: + - https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md + - https://owasp.org/www-community/attacks/HTTP_Response_Splitting + category: security + technology: + - nginx + confidence: MEDIUM + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection + shortlink: https://sg.run/7oj4 + semgrep.dev: + rule: + r_id: 9038 + rv_id: 1262673 + rule_id: AbUz8p + version_id: xyTjzNW + url: https://semgrep.dev/playground/r/xyTjzNW/generic.nginx.security.header-injection.header-injection + origin: community +- id: generic.nginx.security.insecure-ssl-version.insecure-ssl-version + patterns: + - pattern-not: ssl_protocols TLSv1.2 TLSv1.3; + - pattern-not: ssl_protocols TLSv1.3 TLSv1.2; + - pattern-not: ssl_protocols TLSv1.2; + - pattern-not: ssl_protocols TLSv1.3; + - pattern: ssl_protocols ...; + paths: + include: + - '*.conf' + - '*.vhost' + - '**/sites-available/*' + - '**/sites-enabled/*' + languages: + - generic + severity: WARNING + message: Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to + be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + references: + - https://www.acunetix.com/blog/web-security-zone/hardening-nginx/ + - https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/ + category: security + technology: + - nginx + confidence: HIGH + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version + shortlink: https://sg.run/gLKy + semgrep.dev: + rule: + r_id: 9041 + rv_id: 1262676 + rule_id: WAUo9k + version_id: vdT06O4 + url: https://semgrep.dev/playground/r/vdT06O4/generic.nginx.security.insecure-ssl-version.insecure-ssl-version + origin: community +- id: generic.nginx.security.missing-ssl-version.missing-ssl-version + patterns: + - pattern: server { ... listen $PORT ssl; ... } + - pattern-not-inside: server { ... ssl_protocols ... } + paths: + include: + - '*.conf' + - '*.vhost' + - '**/sites-available/*' + - '**/sites-enabled/*' + languages: + - generic + severity: WARNING + message: This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols + TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 + TLSv1.3' to use secure TLS versions. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + references: + - https://www.acunetix.com/blog/web-security-zone/hardening-nginx/ + - https://nginx.org/en/docs/http/configuring_https_servers.html + category: security + technology: + - nginx + confidence: MEDIUM + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version + shortlink: https://sg.run/3xzl + semgrep.dev: + rule: + r_id: 9043 + rv_id: 1262678 + rule_id: KxUbeA + version_id: ZRTKAle + url: https://semgrep.dev/playground/r/ZRTKAle/generic.nginx.security.missing-ssl-version.missing-ssl-version + origin: community +- id: generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling + patterns: + - pattern-either: + - pattern: 'proxy_http_version 1.1 ...; + + ... + + proxy_set_header Upgrade ...; + + ... + + proxy_set_header Connection ...; + + ' + - pattern: 'proxy_set_header Upgrade ...; + + ... + + proxy_set_header Connection ...; + + ... + + proxy_http_version 1.1 ...; + + ' + - pattern: 'proxy_set_header Upgrade ...; + + ... + + proxy_http_version 1.1 ...; + + ... + + proxy_set_header Connection ...; + + ' + - pattern-inside: "location ... {\n ...\n}\n" + languages: + - generic + severity: WARNING + message: 'Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known + HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, + unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value + websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade + headers.' + paths: + include: + - '*.conf' + - '*.vhost' + - '**/sites-available/*' + - '**/sites-enabled/*' + metadata: + cwe: + - 'CWE-444: Inconsistent Interpretation of HTTP Requests (''HTTP Request/Response Smuggling'')' + references: + - https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c + category: security + technology: + - nginx + confidence: MEDIUM + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling + shortlink: https://sg.run/ploZ + semgrep.dev: + rule: + r_id: 10562 + rv_id: 1262679 + rule_id: 6JUq0Z + version_id: nWT2Lyp + url: https://semgrep.dev/playground/r/nWT2Lyp/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling + origin: community +- id: generic.nginx.security.request-host-used.request-host-used + pattern-either: + - pattern: $http_host + - pattern: $host + paths: + include: + - '*conf*' + - '*nginx*' + - '*vhost*' + - '**/sites-available/*' + - '**/sites-enabled/*' + languages: + - generic + severity: WARNING + message: '''$http_host'' and ''$host'' variables may contain a malicious value from attacker controlled ''Host'' request + header. Use an explicitly configured host value or a allow list for validation.' + metadata: + cwe: + - 'CWE-290: Authentication Bypass by Spoofing' + references: + - https://github.com/yandex/gixy/blob/master/docs/en/plugins/hostspoofing.md + - https://portswigger.net/web-security/host-header + category: security + technology: + - nginx + confidence: MEDIUM + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/generic.nginx.security.request-host-used.request-host-used + shortlink: https://sg.run/4x3Z + semgrep.dev: + rule: + r_id: 9044 + rv_id: 1262680 + rule_id: qNUjGg + version_id: ExTExrN + url: https://semgrep.dev/playground/r/ExTExrN/generic.nginx.security.request-host-used.request-host-used + origin: community +- id: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key + pattern-regex: rk_live_[0-9a-zA-Z]{24} + languages: + - regex + message: Stripe Restricted API Key detected + severity: ERROR + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json + category: security + technology: + - secrets + - stripe + confidence: MEDIUM + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key + shortlink: https://sg.run/ZvdL + semgrep.dev: + rule: + r_id: 9079 + rv_id: 1262900 + rule_id: 5rUOWq + version_id: K3TKkKj + url: https://semgrep.dev/playground/r/K3TKkKj/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key + origin: community +- id: generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri + patterns: + - pattern: $PROTOCOL://$...USERNAME:$...PASSWORD@$END + - metavariable-regex: + metavariable: $...USERNAME + regex: \A({?)([A-Za-z])([A-Za-z0-9_-]){5,31}(}?)\Z + - metavariable-regex: + metavariable: $...PASSWORD + regex: (?!.*[\s])(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~]){6,32} + - metavariable-regex: + metavariable: $PROTOCOL + regex: (.*http.*)|(.*sql.*)|(.*ftp.*)|(.*smtp.*) + languages: + - generic + message: Username and password in URI detected + severity: ERROR + metadata: + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go + category: security + technology: + - secrets + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri + shortlink: https://sg.run/8yA4 + semgrep.dev: + rule: + r_id: 9084 + rv_id: 1262903 + rule_id: DbUple + version_id: YDTZeZE + url: https://semgrep.dev/playground/r/YDTZeZE/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri + origin: community +- id: generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak + patterns: + - pattern-regex: ^(AIza[0-9A-Za-z_-]{35}(?!\S))$ + message: Detects potential Google Maps API keys in code + languages: + - generic + severity: WARNING + metadata: + description: Detects potential Google Maps API keys in code + severity: MEDIUM + category: security + confidence: MEDIUM + impact: HIGH + likelihood: MEDIUM + subcategory: + - audit + owasp: + - A3:2017 Sensitive Data Exposure + references: + - https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e + cwe: + - 'CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory' + technology: + - Google Maps + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak + shortlink: https://sg.run/DL5d + semgrep.dev: + rule: + r_id: 52196 + rv_id: 945530 + rule_id: EwU3kN + version_id: NdTqkGz + url: https://semgrep.dev/playground/r/NdTqkGz/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak + origin: community +- id: generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs + languages: + - generic + severity: WARNING + message: 'Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised + code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource + will not be loaded. Add an integrity attribute to your + - pattern-not: + paths: + include: + - '*.component' + - '*.page' +- id: generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute + languages: + - generic + severity: INFO + message: Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 + or higher. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5 + category: security + subcategory: + - vuln + technology: + - salesforce + - visualforce + cwe2022-top25: true + cwe2021-top25: true + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute + shortlink: https://sg.run/yoj8 + semgrep.dev: + rule: + r_id: 72424 + rv_id: 1262907 + rule_id: DbUj7d + version_id: RGT0L0r + url: https://semgrep.dev/playground/r/RGT0L0r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute + origin: community + patterns: + - pattern: ... + - pattern-not: ... + - pattern-not: ...... + - pattern-not: ...... + paths: + include: + - '*.page' +- id: generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version + languages: + - generic + severity: WARNING + message: Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm + category: security + subcategory: + - vuln + technology: + - salesforce + - visualforce + cwe2022-top25: true + cwe2021-top25: true + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version + shortlink: https://sg.run/rWr6 + semgrep.dev: + rule: + r_id: 72425 + rv_id: 1262908 + rule_id: WAUwJW + version_id: A8Tgdgn + url: https://semgrep.dev/playground/r/A8Tgdgn/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version + origin: community + patterns: + - pattern-inside: + - pattern-either: + - pattern-regex: '[>][0-9].[0-9][<]' + - pattern-regex: '[>][1-4][0-9].[0-9][<]' + - pattern-regex: '[>][5][0-4].[0-9][<]' + paths: + include: + - '*.page-meta.xml' +- id: go.aws-lambda.security.database-sqli.database-sqli + languages: + - go + message: Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls. + mode: taint + metadata: + references: + - https://pkg.go.dev/database/sql#DB.Query + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - database + - sql + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli + shortlink: https://sg.run/e5e8 + semgrep.dev: + rule: + r_id: 18232 + rv_id: 1262909 + rule_id: WAUdJ7 + version_id: BjTkZkQ + url: https://semgrep.dev/playground/r/BjTkZkQ/go.aws-lambda.security.database-sqli.database-sqli + origin: community + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $DB.Exec($QUERY,...) + - pattern: $DB.ExecContent($QUERY,...) + - pattern: $DB.Query($QUERY,...) + - pattern: $DB.QueryContext($QUERY,...) + - pattern: $DB.QueryRow($QUERY,...) + - pattern: $DB.QueryRowContext($QUERY,...) + - pattern-inside: 'import "database/sql" + + ... + + ' + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: 'func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...} + + ... + + lambda.Start($HANDLER, ...) + + ' + - patterns: + - pattern-inside: 'func $HANDLER($EVENT $TYPE) {...} + + ... + + lambda.Start($HANDLER, ...) + + ' + - pattern-not-inside: 'func $HANDLER($EVENT context.Context) {...} + + ... + + lambda.Start($HANDLER, ...) + + ' + - focus-metavariable: $EVENT + severity: WARNING +- id: go.aws-lambda.security.tainted-sql-string.tainted-sql-string + languages: + - go + severity: ERROR + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction + could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the + database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider + using an object-relational mapper (ORM) such as Sequelize which will protect your queries. + metadata: + references: + - https://owasp.org/www-community/attacks/SQL_Injection + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/vX3Y + semgrep.dev: + rule: + r_id: 18233 + rv_id: 1262910 + rule_id: 0oUwqg + version_id: DkTRbRL + url: https://semgrep.dev/playground/r/DkTRbRL/go.aws-lambda.security.tainted-sql-string.tainted-sql-string + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: 'func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...} + + ... + + lambda.Start($HANDLER, ...) + + ' + - patterns: + - pattern-inside: 'func $HANDLER($EVENT $TYPE) {...} + + ... + + lambda.Start($HANDLER, ...) + + ' + - pattern-not-inside: 'func $HANDLER($EVENT context.Context) {...} + + ... + + lambda.Start($HANDLER, ...) + + ' + - focus-metavariable: $EVENT + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: '"$SQLSTR" + ... + + ' + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(\s*select|\s*delete|\s*insert|\s*create|\s*update|\s*alter|\s*drop).* + - patterns: + - pattern-either: + - pattern: fmt.Fprintf($F, "$SQLSTR", ...) + - pattern: fmt.Sprintf("$SQLSTR", ...) + - pattern: fmt.Printf("$SQLSTR", ...) + - metavariable-regex: + metavariable: $SQLSTR + regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* + - pattern-not-inside: 'log.$PRINT(...) + + ' + pattern-sanitizers: + - pattern: strconv.Atoi(...) +- id: go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly + patterns: + - pattern-not-inside: "&sessions.Options{\n ...,\n HttpOnly: true,\n ...,\n}\n" + - pattern: "&sessions.Options{\n ...,\n}\n" + message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the + browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by + setting 'HttpOnly' to 'true' in the Options struct. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69 + category: security + technology: + - gorilla + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly + shortlink: https://sg.run/4xJZ + semgrep.dev: + rule: + r_id: 9088 + rv_id: 1262911 + rule_id: qNUj6g + version_id: WrTqKqe + url: https://semgrep.dev/playground/r/WrTqKqe/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly + origin: community + fix-regex: + regex: (HttpOnly\s*:\s+)false + replacement: \1true + severity: WARNING + languages: + - go +- id: go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure + patterns: + - pattern-not-inside: "&sessions.Options{\n ...,\n Secure: true,\n ...,\n}\n" + - pattern: "&sessions.Options{\n ...,\n}\n" + message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client + from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' + in the Options struct. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69 + category: security + technology: + - gorilla + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure + shortlink: https://sg.run/PJdE + semgrep.dev: + rule: + r_id: 9089 + rv_id: 1262912 + rule_id: lBU9kw + version_id: 0bTKzKk + url: https://semgrep.dev/playground/r/0bTKzKk/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure + origin: community + fix-regex: + regex: (Secure\s*:\s+)false + replacement: \1true + severity: WARNING + languages: + - go +- id: go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone + patterns: + - pattern-inside: "&sessions.Options{\n ...,\n SameSite: http.SameSiteNoneMode,\n ...,\n}\n" + - pattern: "&sessions.Options{\n ...,\n}\n" + message: Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default + for enhanced security. + metadata: + cwe: + - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://pkg.go.dev/github.com/gorilla/sessions#Options + category: security + technology: + - gorilla + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone + shortlink: https://sg.run/x8Nwj + semgrep.dev: + rule: + r_id: 133074 + rv_id: 1262913 + rule_id: YGUpGd4 + version_id: K3TKkKB + url: https://semgrep.dev/playground/r/K3TKkKB/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone + origin: community + fix-regex: + regex: (SameSite\s*:\s+)http.SameSiteNoneMode + replacement: \1http.SameSiteDefaultMode + severity: WARNING + languages: + - go +- id: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check + patterns: + - pattern-inside: 'import ("github.com/gorilla/websocket") + + ... + + ' + - patterns: + - pattern-not-inside: '$UPGRADER = websocket.Upgrader{..., CheckOrigin: $FN ,...} + + ... + + ' + - pattern-not-inside: '$UPGRADER.CheckOrigin = $FN2 + + ... + + ' + - pattern: '$UPGRADER.Upgrade(...) + + ' + message: 'The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket + is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per "gorilla/websocket" + documentation: "A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery."' + languages: + - go + severity: WARNING + metadata: + category: security + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://pkg.go.dev/github.com/gorilla/websocket#Upgrader + technology: + - gorilla + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + source: https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check + shortlink: https://sg.run/xXpz + semgrep.dev: + rule: + r_id: 18430 + rv_id: 1262914 + rule_id: ReUKdz + version_id: qkTR7RP + url: https://semgrep.dev/playground/r/qkTR7RP/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check + origin: community +- id: go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage + message: Detected usage of dangerous method $METHOD which does not escape inputs (see link in references). If the argument + is user-controlled, this can lead to SQL injection. When using $METHOD function, do not trust user-submitted data and + only allow approved list of input (possibly, use an allowlist approach). + severity: WARNING + languages: + - go + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + pattern-sinks: + - patterns: + - pattern-inside: 'import ("gorm.io/gorm") + + ... + + ' + - patterns: + - pattern-inside: "func $VAL(..., $GORM *gorm.DB,... ) {\n ...\n}\n" + - pattern-either: + - pattern: '$GORM. ... .$METHOD($VALUE) + + ' + - pattern: '$DB := $GORM. ... .$ANYTHING(...) + + ... + + $DB. ... .$METHOD($VALUE) + + ' + - focus-metavariable: $VALUE + - metavariable-regex: + metavariable: $METHOD + regex: ^(Order|Exec|Raw|Group|Having|Distinct|Select|Pluck)$ + pattern-sanitizers: + - pattern-either: + - pattern: strconv.Atoi(...) + - pattern: '($X: bool) + + ' + options: + interfile: true + metadata: + category: security + technology: + - gorm + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://gorm.io/docs/security.html#SQL-injection-Methods + - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage + shortlink: https://sg.run/R4qg + semgrep.dev: + rule: + r_id: 24693 + rv_id: 1262915 + rule_id: AbU5o3 + version_id: l4TJRJK + url: https://semgrep.dev/playground/r/l4TJRJK/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage + origin: community +- id: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection + metadata: + cwe: + - 'CWE-300: Channel Accessible by Non-Endpoint' + references: + - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption + category: security + technology: + - grpc + confidence: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection + shortlink: https://sg.run/J9yZ + semgrep.dev: + rule: + r_id: 9090 + rv_id: 1262916 + rule_id: PeUZ4X + version_id: YDTZeZB + url: https://semgrep.dev/playground/r/YDTZeZB/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection + origin: community + message: 'Found an insecure gRPC connection using ''grpc.WithInsecure()''. This creates a connection without encryption + to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, + establish a secure connection with an SSL certificate using the ''grpc.WithTransportCredentials()'' function. You can + create a create credentials using a ''tls.Config{}'' struct with ''credentials.NewTLS()''. The final fix looks like this: + ''grpc.WithTransportCredentials(credentials.NewTLS())''.' + languages: + - go + severity: ERROR + pattern: $GRPC.Dial($ADDR, ..., $GRPC.WithInsecure(...), ...) + fix-regex: + regex: (.*)WithInsecure\(.*?\) + replacement: \1WithTransportCredentials(credentials.NewTLS()) +- id: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection + metadata: + cwe: + - 'CWE-300: Channel Accessible by Non-Endpoint' + references: + - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption + category: security + technology: + - grpc + confidence: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection + shortlink: https://sg.run/5Q5l + semgrep.dev: + rule: + r_id: 9091 + rv_id: 1262917 + rule_id: JDUy0B + version_id: 6xT2923 + url: https://semgrep.dev/playground/r/6xT2923/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection + origin: community + message: Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection + without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the + machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create + credentials using 'credentials.NewServerTLSFromFile("cert.pem", "cert.key")'. + languages: + - go + severity: ERROR + mode: taint + pattern-sinks: + - requires: OPTIONS and not CREDS + pattern: grpc.NewServer($OPT, ...) + - requires: EMPTY_CONSTRUCTOR + pattern: grpc.NewServer() + pattern-sources: + - label: OPTIONS + pattern: grpc.ServerOption{ ... } + - label: CREDS + pattern: grpc.Creds(...) + - label: EMPTY_CONSTRUCTOR + pattern: grpc.NewServer() +- id: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified + message: Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're + doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the + signature is valid (because it has been checked previously in the stack) and you want to extract values from it. + metadata: + cwe: + - 'CWE-345: Insufficient Verification of Data Authenticity' + owasp: + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + category: security + technology: + - jwt + confidence: MEDIUM + references: + - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified + shortlink: https://sg.run/Av66 + semgrep.dev: + rule: + r_id: 9094 + rv_id: 1262918 + rule_id: ReUgJJ + version_id: o5TbDbq + url: https://semgrep.dev/playground/r/o5TbDbq/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified + origin: community + languages: + - go + severity: WARNING + patterns: + - pattern-inside: 'import "github.com/dgrijalva/jwt-go" + + ... + + ' + - pattern: '$JWT.ParseUnverified(...) + + ' +- id: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has + already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do + not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + category: security + technology: + - jwt + confidence: HIGH + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm + shortlink: https://sg.run/Gej1 + semgrep.dev: + rule: + r_id: 9092 + rv_id: 1262919 + rule_id: 5rUOWQ + version_id: zyTb2bz + url: https://semgrep.dev/playground/r/zyTb2bz/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm + origin: community + languages: + - go + severity: ERROR + patterns: + - pattern-either: + - pattern-inside: 'import "github.com/golang-jwt/jwt" + + ... + + ' + - pattern-inside: 'import "github.com/dgrijalva/jwt-go" + + ... + + ' + - pattern-either: + - pattern: 'jwt.SigningMethodNone + + ' + - pattern: jwt.UnsafeAllowNoneSignatureType +- id: go.jwt-go.security.jwt.hardcoded-jwt-key + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + options: + interfile: true + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + category: security + technology: + - jwt + - secrets + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key + shortlink: https://sg.run/Rod2 + semgrep.dev: + rule: + r_id: 9093 + rv_id: 1262920 + rule_id: GdU7Ny + version_id: pZT0305 + url: https://semgrep.dev/playground/r/pZT0305/go.jwt-go.security.jwt.hardcoded-jwt-key + origin: community + severity: WARNING + languages: + - go + mode: taint + pattern-sources: + - patterns: + - pattern-inside: '[]byte("$F") + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$TOKEN.SignedString($F) + + ' + - focus-metavariable: $F +- id: go.lang.security.audit.crypto.bad_imports.insecure-module-used + message: The package `net/http/cgi` is on the import blocklist. The package is vulnerable to httpoxy attacks (CVE-2015-5386). + It is recommended to use `net/http` or a web framework to build a web application instead. + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + source-rule-url: https://github.com/securego/gosec + references: + - https://godoc.org/golang.org/x/crypto/sha3 + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used + shortlink: https://sg.run/l2gj + semgrep.dev: + rule: + r_id: 9113 + rv_id: 1262921 + rule_id: yyUnov + version_id: 2KTv2vJ + url: https://semgrep.dev/playground/r/2KTv2vJ/go.lang.security.audit.crypto.bad_imports.insecure-module-used + origin: community + languages: + - go + severity: WARNING + pattern-either: + - patterns: + - pattern-inside: 'import "net/http/cgi" + + ... + + ' + - pattern: 'cgi.$FUNC(...) + + ' +- id: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key + message: Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' + package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn + more about the problem and how to fix it. + metadata: + cwe: + - 'CWE-322: Key Exchange without Entity Authentication' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec + references: + - https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ + - https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key + shortlink: https://sg.run/Yv6X + semgrep.dev: + rule: + r_id: 9114 + rv_id: 1262922 + rule_id: r6UrW9 + version_id: X0TzyzN + url: https://semgrep.dev/playground/r/X0TzyzN/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key + origin: community + languages: + - go + severity: WARNING + pattern: ssh.InsecureIgnoreHostKey() +- id: go.lang.security.audit.crypto.math_random.math-random-used + metadata: + cwe: + - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used + shortlink: https://sg.run/6nK6 + semgrep.dev: + rule: + r_id: 9115 + rv_id: 1262923 + rule_id: bwUwy8 + version_id: jQTn5nj + url: https://semgrep.dev/playground/r/jQTn5nj/go.lang.security.audit.crypto.math_random.math-random-used + origin: community + message: Do not use `math/rand`. Use `crypto/rand` instead. + languages: + - go + severity: WARNING + patterns: + - pattern-either: + - pattern: 'import $RAND "$MATH" + + ' + - pattern: 'import "$MATH" + + ' + - metavariable-regex: + metavariable: $MATH + regex: ^(math/rand(\/v[0-9]+)*)$ + - pattern-either: + - pattern-inside: '... + + rand.$FUNC(...) + + ' + - pattern-inside: '... + + $RAND.$FUNC(...) + + ' + - focus-metavariable: + - $MATH + fix: 'crypto/rand + + ' +- id: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + message: '`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as + the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where + it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer + 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13'' to the TLS configuration + to bump the minimum version to TLS 1.3.' + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go + references: + - https://go.dev/doc/go1.22#minor_library_changes + - https://pkg.go.dev/crypto/tls#:~:text=MinVersion + - https://www.us-cert.gov/ncas/alerts/TA14-290A + category: security + technology: + - go + confidence: HIGH + subcategory: + - audit + likelihood: MEDIUM + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + shortlink: https://sg.run/oxEN + semgrep.dev: + rule: + r_id: 9116 + rv_id: 1262924 + rule_id: NbUk4X + version_id: 1QTypyp + url: https://semgrep.dev/playground/r/1QTypyp/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + origin: community + languages: + - go + severity: WARNING + patterns: + - pattern: 'tls.Config{ $...CONF } + + ' + - pattern-not: 'tls.Config{..., MinVersion: ..., ...} + + ' + fix: 'tls.Config{ $...CONF, MinVersion: tls.VersionTLS13 } + + ' +- id: go.lang.security.audit.crypto.sha224-hash.sha224-hash + pattern-either: + - patterns: + - pattern-inside: 'import "crypto/sha256" + + ... + + ' + - pattern-either: + - pattern: 'sha256.New224() + + ' + - pattern: 'sha256.Sum224(...) + + ' + - patterns: + - pattern-inside: 'import "golang.org/x/crypto/sha3" + + ... + + ' + - pattern-either: + - pattern: 'sha3.New224() + + ' + - pattern: 'sha3.Sum224(...) + + ' + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating + to a stronger hash function such as SHA-384 or higher to ensure compliance and security. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + category: security + technology: + - go + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf + - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/go.lang.security.audit.crypto.sha224-hash.sha224-hash + shortlink: https://sg.run/ReJwY + semgrep.dev: + rule: + r_id: 151749 + rv_id: 1262925 + rule_id: GdUvElR + version_id: 9lT4b4w + url: https://semgrep.dev/playground/r/9lT4b4w/go.lang.security.audit.crypto.sha224-hash.sha224-hash + origin: community +- id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + message: SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use + 'tls.VersionTLS13'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go + references: + - https://golang.org/doc/go1.14#crypto/tls + - https://www.us-cert.gov/ncas/alerts/TA14-290A + category: security + technology: + - go + confidence: HIGH + subcategory: + - vuln + likelihood: MEDIUM + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + shortlink: https://sg.run/zvE1 + semgrep.dev: + rule: + r_id: 9117 + rv_id: 1262926 + rule_id: kxUkJ2 + version_id: yeTxpxj + url: https://semgrep.dev/playground/r/yeTxpxj/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + origin: community + languages: + - go + severity: WARNING + fix-regex: + regex: VersionSSL30 + replacement: VersionTLS13 + pattern: 'tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}' +- id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher + message: Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' + to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other + cipher suites to use. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go + references: + - https://golang.org/pkg/crypto/tls/#InsecureCipherSuites + category: security + technology: + - go + confidence: HIGH + subcategory: + - vuln + likelihood: HIGH + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher + shortlink: https://sg.run/px8N + semgrep.dev: + rule: + r_id: 9118 + rv_id: 1262927 + rule_id: wdUJYk + version_id: rxTAKAZ + url: https://semgrep.dev/playground/r/rxTAKAZ/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher + origin: community + languages: + - go + severity: WARNING + pattern-either: + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}} + + ' + - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}} + + ' + - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...} + + ' + - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...} + + ' +- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES + message: Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use + AES instead. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + source-rule-url: https://github.com/securego/gosec#available-rules + category: security + technology: + - go + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES + shortlink: https://sg.run/jREA + semgrep.dev: + rule: + r_id: 9121 + rv_id: 1262930 + rule_id: eqU8B3 + version_id: kbTzGzA + url: https://semgrep.dev/playground/r/kbTzGzA/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES + origin: community + patterns: + - pattern-inside: 'import "crypto/des" + + ... + + ' + - pattern-either: + - pattern: 'des.NewTripleDESCipher(...) + + ' + - pattern: 'des.NewCipher(...) + + ' +- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use SHA256 or SHA3 instead. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + source-rule-url: https://github.com/securego/gosec#available-rules + category: security + technology: + - go + confidence: MEDIUM + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 + shortlink: https://sg.run/2xB5 + semgrep.dev: + rule: + r_id: 9119 + rv_id: 1262928 + rule_id: x8Un6q + version_id: bZT535Y + url: https://semgrep.dev/playground/r/bZT535Y/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 + origin: community + patterns: + - pattern-inside: 'import "crypto/md5" + + ... + + ' + - pattern-either: + - pattern: 'md5.New() + + ' + - pattern: 'md5.Sum(...) + + ' +- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 + message: Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + source-rule-url: https://github.com/securego/gosec#available-rules + category: security + technology: + - go + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 + shortlink: https://sg.run/1ZAD + semgrep.dev: + rule: + r_id: 9122 + rv_id: 1262931 + rule_id: v8Unl0 + version_id: w8TRoRQ + url: https://semgrep.dev/playground/r/w8TRoRQ/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 + origin: community + patterns: + - pattern-inside: 'import "crypto/rc4" + + ... + + ' + - pattern: rc4.NewCipher(...) +- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + languages: + - go + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + source-rule-url: https://github.com/securego/gosec#available-rules + category: security + technology: + - go + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 + shortlink: https://sg.run/XBYA + semgrep.dev: + rule: + r_id: 9120 + rv_id: 1262929 + rule_id: OrU31O + version_id: NdTzyz1 + url: https://semgrep.dev/playground/r/NdTzyz1/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 + origin: community + patterns: + - pattern-inside: 'import "crypto/sha1" + + ... + + ' + - pattern-either: + - pattern: 'sha1.New() + + ' + - pattern: 'sha1.Sum(...) + + ' +- id: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key + message: RSA keys should be at least 2048 bits + languages: + - go + severity: WARNING + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/securego/gosec/blob/master/rules/rsa.go + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms + category: security + technology: + - go + confidence: HIGH + subcategory: + - audit + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key + shortlink: https://sg.run/9oY4 + semgrep.dev: + rule: + r_id: 9123 + rv_id: 1262932 + rule_id: d8UjY3 + version_id: xyTjz8L + url: https://semgrep.dev/playground/r/xyTjz8L/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key + origin: community + patterns: + - pattern-either: + - pattern: 'rsa.GenerateKey(..., $BITS) + + ' + - pattern: 'rsa.GenerateMultiPrimeKey(..., $BITS) + + ' + - metavariable-comparison: + metavariable: $BITS + comparison: $BITS < 2048 + - focus-metavariable: + - $BITS + fix: '2048 + + ' +- id: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd + patterns: + - pattern-either: + - patterns: + - pattern: 'exec.Cmd {...,Path: $CMD,...} + + ' + - pattern-not: 'exec.Cmd {...,Path: "...",...} + + ' + - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); + + ... + + ' + - pattern-not-inside: '$CMD = "..."; + + ... + + ' + - patterns: + - pattern: 'exec.Cmd {...,Args: $ARGS,...} + + ' + - pattern-not: 'exec.Cmd {...,Args: []string{...},...} + + ' + - pattern-not-inside: '$ARGS = []string{"...",...}; + + ... + + ' + - pattern-not-inside: '$CMD = "..."; + + ... + + $ARGS = []string{$CMD,...}; + + ... + + ' + - pattern-not-inside: '$CMD = exec.LookPath("..."); + + ... + + $ARGS = []string{$CMD,...}; + + ... + + ' + - patterns: + - pattern: 'exec.Cmd {...,Args: []string{$CMD,...},...} + + ' + - pattern-not: 'exec.Cmd {...,Args: []string{"...",...},...} + + ' + - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); + + ... + + ' + - pattern-not-inside: '$CMD = "..."; + + ... + + ' + - patterns: + - pattern-either: + - pattern: 'exec.Cmd {...,Args: []string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...},...} + + ' + - patterns: + - pattern: 'exec.Cmd {...,Args: []string{$CMD,"-c",$EXE,...},...} + + ' + - pattern-inside: '$CMD,$ERR := exec.LookPath("=~/(sh|bash|ksh|csh|tcsh|zsh)/"); + + ... + + ' + - pattern-not: 'exec.Cmd {...,Args: []string{"...","...","...",...},...} + + ' + - pattern-not-inside: '$EXE = "..."; + + ... + + ' + - pattern-inside: 'import "os/exec" + + ... + + ' + message: Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this + call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary + code. + metadata: + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - go + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd + shortlink: https://sg.run/Dorj + semgrep.dev: + rule: + r_id: 9108 + rv_id: 1262934 + rule_id: 2ZUb8l + version_id: e1Tyjeg + url: https://semgrep.dev/playground/r/e1Tyjeg/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd + origin: community + severity: ERROR + languages: + - go +- id: go.lang.security.audit.md5-used-as-password.md5-used-as-password + languages: + - go + severity: WARNING + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked + by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` + package. + options: + interfile: true + metadata: + category: security + technology: + - md5 + references: + - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html + - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords + - https://github.com/returntocorp/semgrep-rules/issues/1609 + - https://pkg.go.dev/golang.org/x/crypto/bcrypt + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password + shortlink: https://sg.run/4eOE + semgrep.dev: + rule: + r_id: 14688 + rv_id: 1262938 + rule_id: 4bU1Wj + version_id: nWT2L9r + url: https://semgrep.dev/playground/r/nWT2L9r/go.lang.security.audit.md5-used-as-password.md5-used-as-password + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: md5.New + - pattern: md5.Sum + pattern-sinks: + - patterns: + - pattern: $FUNCTION(...) + - metavariable-regex: + metavariable: $FUNCTION + regex: (?i)(.*password.*) +- id: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces + message: Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server + publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty + string. + languages: + - go + severity: WARNING + metadata: + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://github.com/securego/gosec + category: security + technology: + - go + confidence: HIGH + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces + shortlink: https://sg.run/rdE0 + semgrep.dev: + rule: + r_id: 9125 + rv_id: 1262939 + rule_id: nJUz3J + version_id: ExTExoK + url: https://semgrep.dev/playground/r/ExTExoK/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces + origin: community + pattern-either: + - pattern: tls.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) + - pattern: net.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) + - pattern: tls.Listen($NETWORK, "=~/^:.*$/", ...) + - pattern: net.Listen($NETWORK, "=~/^:.*$/", ...) +- id: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + patterns: + - pattern-not-inside: "http.Cookie{\n ...,\n HttpOnly: true,\n ...,\n}\n" + - pattern: "http.Cookie{\n ...,\n}\n" + message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the + browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by + setting 'HttpOnly' to 'true' in the Cookie. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go + - https://golang.org/src/net/http/cookie.go + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + shortlink: https://sg.run/b73e + semgrep.dev: + rule: + r_id: 9126 + rv_id: 1262940 + rule_id: EwU2Z6 + version_id: 7ZTE3BW + url: https://semgrep.dev/playground/r/7ZTE3BW/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + origin: community + fix-regex: + regex: (HttpOnly\s*:\s+)false + replacement: \1true + severity: WARNING + languages: + - go +- id: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure + patterns: + - pattern-not-inside: "http.Cookie{\n ...,\n Secure: true,\n ...,\n}\n" + - pattern: "http.Cookie{\n ...,\n}\n" + message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client + from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' + in the Options struct. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go + - https://golang.org/src/net/http/cookie.go + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure + shortlink: https://sg.run/N4G7 + semgrep.dev: + rule: + r_id: 9127 + rv_id: 1262941 + rule_id: 7KUQ8X + version_id: LjTkgGE + url: https://semgrep.dev/playground/r/LjTkgGE/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure + origin: community + fix-regex: + regex: (Secure\s*:\s+)false + replacement: \1true + severity: WARNING + languages: + - go +- id: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace + message: Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for + '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events + occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined. + metadata: + cwe: + - 'CWE-913: Improper Control of Dynamically-Managed Code Resources' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://github.com/returntocorp/semgrep-rules/issues/518 + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace + shortlink: https://sg.run/kXEK + semgrep.dev: + rule: + r_id: 9128 + rv_id: 1262942 + rule_id: L1Uyjp + version_id: 8KT5rNv + url: https://semgrep.dev/playground/r/8KT5rNv/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace + origin: community + patterns: + - pattern-not-inside: 'package $PACKAGE + + ... + + &httptrace.ClientTrace { ... } + + ... + + ' + - pattern: httptrace.WithClientTrace($ANY, $TRACE) + severity: WARNING + languages: + - go +- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string + message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely + sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://golang.org/pkg/html/template/#HTML + category: security + technology: + - go + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string + shortlink: https://sg.run/weE0 + semgrep.dev: + rule: + r_id: 9129 + rv_id: 1262943 + rule_id: 8GUjDW + version_id: gETB7Pe + url: https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string + origin: community + languages: + - go + severity: WARNING + patterns: + - pattern-not: template.HTML("..." + "...") + - pattern-either: + - pattern: template.HTML($T + $X, ...) + - pattern: template.HTML(fmt.$P("...", ...), ...) + - pattern: '$T = "..." + + ... + + $T = $FXN(..., $T, ...) + + ... + + template.HTML($T, ...) + + ' + - pattern: '$T = fmt.$P("...", ...) + + ... + + template.HTML($T, ...) + + ' + - pattern: '$T, $ERR = fmt.$P("...", ...) + + ... + + template.HTML($T, ...) + + ' + - pattern: '$T = $X + $Y + + ... + + template.HTML($T, ...) + + ' + - pattern: '$T = "..." + + ... + + $OTHER, $ERR = fmt.$P(..., $T, ...) + + ... + + template.HTML($OTHER, ...)' +- id: go.lang.security.audit.net.fs-directory-listing.fs-directory-listing + message: 'Detected usage of ''http.FileServer'' as handler: this allows directory listing and an attacker could navigate + through directories looking for sensitive files. Be sure to disable directory listing or restrict access to specific directories/files.' + severity: WARNING + languages: + - go + patterns: + - pattern-either: + - patterns: + - pattern-inside: '$FS := http.FileServer(...) + + ... + + ' + - pattern-either: + - pattern: 'http.ListenAndServe(..., $FS) + + ' + - pattern: 'http.ListenAndServeTLS(..., $FS) + + ' + - pattern: 'http.Handle(..., $FS) + + ' + - pattern: 'http.HandleFunc(..., $FS) + + ' + - patterns: + - pattern: 'http.$FN(..., http.FileServer(...)) + + ' + - metavariable-regex: + metavariable: $FN + regex: (ListenAndServe|ListenAndServeTLS|Handle|HandleFunc) + metadata: + category: security + cwe: + - 'CWE-548: Exposure of Information Through Directory Listing' + owasp: + - A06:2017 - Security Misconfiguration + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://github.com/OWASP/Go-SCP + - https://cwe.mitre.org/data/definitions/548.html + confidence: MEDIUM + technology: + - go + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing + shortlink: https://sg.run/4R8x + semgrep.dev: + rule: + r_id: 21300 + rv_id: 1262944 + rule_id: 5rU9JO + version_id: QkTGqX0 + url: https://semgrep.dev/playground/r/QkTGqX0/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing + origin: community +- id: go.lang.security.audit.net.use-tls.use-tls + pattern: http.ListenAndServe($ADDR, $HANDLER) + fix: http.ListenAndServeTLS($ADDR, certFile, keyFile, $HANDLER) + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://golang.org/pkg/net/http/#ListenAndServeTLS + category: security + technology: + - go + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls + shortlink: https://sg.run/dKbY + semgrep.dev: + rule: + r_id: 9134 + rv_id: 1262948 + rule_id: PeUZ8X + version_id: JdTzxkn + url: https://semgrep.dev/playground/r/JdTzxkn/go.lang.security.audit.net.use-tls.use-tls + origin: community + message: Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS + for more information. + languages: + - go + severity: WARNING +- id: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf + patterns: + - pattern-inside: "func $FUNC(..., $W http.ResponseWriter, ...) {\n ...\n var $TEMPLATE = \"...\"\n ...\n $W.Write([]byte(fmt.$PRINTF($TEMPLATE,\ + \ ...)), ...)\n ...\n}\n" + - pattern-either: + - pattern: '$PARAMS = r.URL.Query() + + ... + + $DATA, $ERR := $PARAMS[...] + + ... + + $INTERM = $ANYTHING(..., $DATA, ...) + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) + + ' + - pattern: '$PARAMS = r.URL.Query() + + ... + + $DATA, $ERR := $PARAMS[...] + + ... + + $INTERM = $DATA[...] + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) + + ' + - pattern: '$DATA, $ERR := r.URL.Query()[...] + + ... + + $INTERM = $DATA[...] + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) + + ' + - pattern: '$DATA, $ERR := r.URL.Query()[...] + + ... + + $INTERM = $ANYTHING(..., $DATA, ...) + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) + + ' + - pattern: '$PARAMS = r.URL.Query() + + ... + + $DATA, $ERR := $PARAMS[...] + + ... + + $W.Write([]byte(fmt.$PRINTF(..., $DATA, ...))) + + ' + message: Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and + should not be done. If you must do this, ensure your data is sanitized or escaped. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - go + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf + shortlink: https://sg.run/Zvon + semgrep.dev: + rule: + r_id: 9135 + rv_id: 1262949 + rule_id: JDUyXB + version_id: 5PTo1qr + url: https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf + origin: community + severity: WARNING + languages: + - go +- id: go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface + languages: + - go + message: Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security vulnerabilities + (CWE-502). Use a concrete struct type instead. + severity: WARNING + metadata: + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + category: security + technology: + - go + confidence: HIGH + likelihood: MEDIUM + impact: HIGH + subcategory: + - vuln + references: + - https://cwe.mitre.org/data/definitions/502.html + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface + shortlink: https://sg.run/6WbKL + semgrep.dev: + rule: + r_id: 274359 + rv_id: 1409387 + rule_id: 4bUAQDG + version_id: ZRTDkjk + url: https://semgrep.dev/playground/r/ZRTDkjk/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface + origin: community + patterns: + - pattern-either: + - pattern: 'var $VAR interface{} + + ... + + json.Unmarshal($DATA, &$VAR) + + ' + - pattern: 'var $VAR interface{} + + ... + + yaml.Unmarshal($DATA, &$VAR) + + ' + - pattern: 'var $VAR interface{} + + ... + + xml.Unmarshal($DATA, &$VAR) + + ' +- id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse + message: '`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest + path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal + attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path, + "/")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.' + severity: ERROR + languages: + - go + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + pattern-sinks: + - patterns: + - pattern-either: + - pattern: filepath.Clean($...INNER) + - pattern: path.Clean($...INNER) + pattern-sanitizers: + - pattern-either: + - pattern: '"/" + ... + + ' + fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/"))) + options: + interfile: true + metadata: + references: + - https://pkg.go.dev/path#Clean + - http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html + - https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/ + - https://dzx.cz/2021/04/02/go_path_traversal/ + - https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - go + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse + shortlink: https://sg.run/ZKzw + semgrep.dev: + rule: + r_id: 18235 + rv_id: 1262967 + rule_id: qNUQJe + version_id: jQTn5Bj + url: https://semgrep.dev/playground/r/jQTn5Bj/go.lang.security.filepath-clean-misuse.filepath-clean-misuse + origin: community +- id: go.lang.security.injection.raw-html-format.raw-html-format + languages: + - go + severity: WARNING + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect + that the HTML is rendered safely. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - go + references: + - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format + shortlink: https://sg.run/3r1G + semgrep.dev: + rule: + r_id: 14443 + rv_id: 1262968 + rule_id: PeUonQ + version_id: 1QTyp2p + url: https://semgrep.dev/playground/r/1QTyp2p/go.lang.security.injection.raw-html-format.raw-html-format + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + pattern-sanitizers: + - pattern: html.EscapeString(...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: fmt.Printf("$HTMLSTR", ...) + - pattern: fmt.Sprintf("$HTMLSTR", ...) + - pattern: fmt.Fprintf($W, "$HTMLSTR", ...) + - pattern: '"$HTMLSTR" + ...' + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... +- id: go.lang.security.injection.tainted-sql-string.tainted-sql-string + languages: + - go + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using + prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of + SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements + (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library. + options: + interfile: true + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://golang.org/doc/database/sql-injection + - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/ + category: security + technology: + - go + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/PbEq + semgrep.dev: + rule: + r_id: 14689 + rv_id: 1409388 + rule_id: PeUoqy + version_id: nWTQ5qD + url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string + origin: community + mode: taint + severity: ERROR + pattern-sources: + - patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$SQLSTR" + ... + + ' + - patterns: + - pattern-inside: '$VAR = "$SQLSTR"; + + ... + + ' + - pattern: $VAR += ... + - patterns: + - pattern-inside: 'var $SB strings.Builder + + ... + + ' + - pattern-inside: '$SB.WriteString("$SQLSTR") + + ... + + $SB.String(...) + + ' + - pattern: '$SB.WriteString(...) + + ' + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(select|delete|insert|create|update|alter|drop).* + - patterns: + - pattern-either: + - pattern: fmt.Fprintf($F, "$SQLSTR", ...) + - pattern: fmt.Sprintf("$SQLSTR", ...) + - pattern: fmt.Printf("$SQLSTR", ...) + - metavariable-regex: + metavariable: $SQLSTR + regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* + pattern-sanitizers: + - pattern-either: + - pattern: strconv.Atoi(...) + - pattern: '($X: bool) + + ' +- id: go.lang.security.injection.tainted-url-host.tainted-url-host + languages: + - go + message: A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) + vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft + the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the + request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist. + options: + interfile: true + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://goteleport.com/blog/ssrf-attacks/ + category: security + technology: + - go + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host + shortlink: https://sg.run/5DjW + semgrep.dev: + rule: + r_id: 14391 + rv_id: 1262970 + rule_id: AbUQLr + version_id: yeTxpOj + url: https://semgrep.dev/playground/r/yeTxpOj/go.lang.security.injection.tainted-url-host.tainted-url-host + origin: community + mode: taint + pattern-sources: + - label: INPUT + patterns: + - pattern-either: + - pattern: '($REQUEST : *http.Request).$ANYTHING + + ' + - pattern: '($REQUEST : http.Request).$ANYTHING + + ' + - metavariable-regex: + metavariable: $ANYTHING + regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + - label: CLEAN + requires: INPUT + patterns: + - pattern-either: + - pattern: '"$URLSTR" + $INPUT + + ' + - patterns: + - pattern-either: + - pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...) + - pattern: fmt.Sprintf("$URLSTR", $INPUT, ...) + - pattern: fmt.Printf("$URLSTR", $INPUT, ...) + - metavariable-regex: + metavariable: $URLSTR + regex: .*//[a-zA-Z0-10]+\..* + pattern-sinks: + - requires: INPUT and not CLEAN + patterns: + - pattern-either: + - patterns: + - pattern-either: + - patterns: + - pattern-inside: '$CLIENT := &http.Client{...} + + ... + + ' + - pattern: $CLIENT.$METHOD($URL, ...) + - pattern: http.$METHOD($URL, ...) + - metavariable-regex: + metavariable: $METHOD + regex: ^(Get|Head|Post|PostForm)$ + - patterns: + - pattern: 'http.NewRequest("$METHOD", $URL, ...) + + ' + - metavariable-regex: + metavariable: $METHOD + regex: ^(GET|HEAD|POST|POSTFORM)$ + - focus-metavariable: $URL + severity: WARNING +- id: html.security.plaintext-http-link.plaintext-http-link + metadata: + category: security + technology: + - html + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + confidence: HIGH + subcategory: + - vuln + references: + - https://cwe.mitre.org/data/definitions/319.html + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link + shortlink: https://sg.run/RA5q + semgrep.dev: + rule: + r_id: 39193 + rv_id: 1262976 + rule_id: AbUnNo + version_id: xyTjzRL + url: https://semgrep.dev/playground/r/xyTjzRL/html.security.plaintext-http-link.plaintext-http-link + origin: community + patterns: + - pattern: ... + - metavariable-regex: + metavariable: $URL + regex: ^(?i)http:// + message: This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible. + severity: WARNING + languages: + - html +- id: java.android.security.exported_activity.exported_activity + patterns: + - pattern-not-inside: + - pattern-inside: " \n" + - pattern-either: + - pattern: ' + + ' + - pattern: ' ... /> + + ' + message: The application exports an activity. Any application on the device can launch the exported activity which may compromise + the integrity of your application or its data. Ensure that any exported activities do not have privileged access to your + application's control plane. + languages: + - generic + severity: WARNING + paths: + exclude: + - sources/ + - classes3.dex + - '*.so' + include: + - '*AndroidManifest.xml' + metadata: + category: security + subcategory: + - vuln + cwe: + - 'CWE-926: Improper Export of Android Application Components' + confidence: MEDIUM + likelihood: MEDIUM + impact: MEDIUM + owasp: + - A5:2021 Security Misconfiguration + technology: + - Android + references: + - https://cwe.mitre.org/data/definitions/926.html + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/java.android.security.exported_activity.exported_activity + shortlink: https://sg.run/eNGZ + semgrep.dev: + rule: + r_id: 60632 + rv_id: 945629 + rule_id: v8Ul0r + version_id: rxT6rGR + url: https://semgrep.dev/playground/r/rxT6rGR/java.android.security.exported_activity.exported_activity + origin: community +- id: java.aws-lambda.security.tainted-sql-string.tainted-sql-string + languages: + - java + severity: ERROR + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction + could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the + database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider + using an object-relational mapper (ORM) such as Sequelize which will protect your queries. + options: + interfile: true + metadata: + references: + - https://owasp.org/www-community/attacks/SQL_Injection + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/EBYN + semgrep.dev: + rule: + r_id: 18237 + rv_id: 1262977 + rule_id: YGUl4z + version_id: O9TpxQN + url: https://semgrep.dev/playground/r/O9TpxQN/java.aws-lambda.security.tainted-sql-string.tainted-sql-string + origin: community + mode: taint + pattern-sources: + - patterns: + - focus-metavariable: $EVENT + - pattern-either: + - pattern: "$HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {\n ...\n}\n" + - pattern: "$HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context\ + \ $CONTEXT) {\n ...\n}\n" + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '"$SQLSTR" + ... + + ' + - pattern: '"$SQLSTR".concat(...) + + ' + - patterns: + - pattern-inside: 'StringBuilder $SB = new StringBuilder("$SQLSTR"); + + ... + + ' + - pattern: $SB.append(...) + - patterns: + - pattern-inside: '$VAR = "$SQLSTR"; + + ... + + ' + - pattern: $VAR += ... + - pattern: String.format("$SQLSTR", ...) + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(select|delete|insert|create|update|alter|drop)\b + - pattern-not-inside: 'System.out.$PRINTLN(...) + + ' +- id: java.aws-lambda.security.tainted-sqli.tainted-sqli + message: Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the + SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead. + languages: + - java + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - focus-metavariable: $EVENT + - pattern-either: + - pattern: "$HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {\n ...\n}\n" + - pattern: "$HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context\ + \ $CONTEXT) {\n ...\n}\n" + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "(java.sql.CallableStatement $STMT) = ...; \n" + - pattern: '(java.sql.Statement $STMT) = ...; + + ' + - pattern: '(java.sql.PreparedStatement $STMT) = ...; + + ' + - pattern: '$VAR = $CONN.prepareStatement(...) + + ' + - pattern: '$PATH.queryForObject(...); + + ' + - pattern: '(java.util.Map $STMT) = $PATH.queryForMap(...); + + ' + - pattern: '(org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...; + + ' + - patterns: + - pattern-inside: '(String $SQL) = "$SQLSTR" + ...; + + ... + + ' + - pattern: $PATH.$SQLCMD(..., $SQL, ...); + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*) + - metavariable-regex: + metavariable: $SQLCMD + regex: (execute|query|executeUpdate|batchUpdate) + options: + interfile: true + metadata: + category: security + technology: + - sql + - java + - aws-lambda + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli + shortlink: https://sg.run/7942 + semgrep.dev: + rule: + r_id: 18238 + rv_id: 1262978 + rule_id: 6JUDWk + version_id: e1Tyj4g + url: https://semgrep.dev/playground/r/e1Tyj4g/java.aws-lambda.security.tainted-sqli.tainted-sqli + origin: community +- id: java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify + message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the + token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before + using the token. + metadata: + cwe: + - 'CWE-345: Insufficient Verification of Data Authenticity' + owasp: + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + category: security + technology: + - jwt + confidence: MEDIUM + references: + - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures + subcategory: + - vuln + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify + shortlink: https://sg.run/Bk95 + semgrep.dev: + rule: + r_id: 9151 + rv_id: 1262979 + rule_id: pKUOE9 + version_id: vdT06Lp + url: https://semgrep.dev/playground/r/vdT06Lp/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify + origin: community + languages: + - java + severity: WARNING + patterns: + - pattern: 'com.auth0.jwt.JWT.decode(...); + + ' + - pattern-not-inside: "class $CLASS {\n ...\n $RETURNTYPE $FUNC (...) {\n ...\n $VERIFIER.verify(...);\n ...\n\ + \ }\n}" +- id: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + technology: + - java + - secrets + - jwt + category: security + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret + shortlink: https://sg.run/RoDK + semgrep.dev: + rule: + r_id: 9149 + rv_id: 1262980 + rule_id: oqUeAn + version_id: d6Tyx8j + url: https://semgrep.dev/playground/r/d6Tyx8j/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret + origin: community + languages: + - java + severity: WARNING + patterns: + - pattern-either: + - pattern: '(Algorithm $ALG) = $ALGO.$HMAC("$Y"); + + ' + - pattern: '$SECRET = "$Y"; + + ... + + (Algorithm $ALG) = $ALGO.$HMAC($SECRET); + + ' + - pattern: "class $CLASS {\n ...\n $TYPE $SECRET = \"$Y\";\n ...\n $RETURNTYPE $FUNC (...) {\n ...\n (Algorithm\ + \ $ALG) = $ALGO.$HMAC($SECRET);\n ...\n }\n ...\n}\n" + - focus-metavariable: $Y + - metavariable-regex: + metavariable: $HMAC + regex: (HMAC384|HMAC256|HMAC512) +- id: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has + already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do + not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + category: security + technology: + - jwt + confidence: HIGH + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg + shortlink: https://sg.run/Av14 + semgrep.dev: + rule: + r_id: 9150 + rv_id: 1262981 + rule_id: zdUkzR + version_id: ZRTKADq + url: https://semgrep.dev/playground/r/ZRTKADq/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg + origin: community + languages: + - java + severity: ERROR + pattern-either: + - pattern: '$JWT.sign(com.auth0.jwt.algorithms.Algorithm.none()); + + ' + - pattern: '$NONE = com.auth0.jwt.algorithms.Algorithm.none(); + + ... + + $JWT.sign($NONE); + + ' + - pattern: "class $CLASS {\n ...\n $TYPE $NONE = com.auth0.jwt.algorithms.Algorithm.none();\n ...\n $RETURNTYPE $FUNC\ + \ (...) {\n ...\n $JWT.sign($NONE);\n ...\n }\n ...\n}" +- id: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal + metadata: + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN + references: + - https://www.owasp.org/index.php/Path_Traversal + category: security + technology: + - jax-rs + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal + shortlink: https://sg.run/DoWj + semgrep.dev: + rule: + r_id: 9152 + rv_id: 1262984 + rule_id: 2ZUb9l + version_id: 7ZTE3KW + url: https://semgrep.dev/playground/r/7ZTE3KW/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal + origin: community + message: Detected a potential path traversal. A malicious actor could control the location of this file, to include going + backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. + You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve + the file name from the path. + severity: WARNING + languages: + - java + pattern-either: + - pattern: "$RETURNTYPE $FUNC (..., @PathParam(...) $TYPE $VAR, ...) {\n ...\n new File(..., $VAR, ...);\n ...\n}\n" + - pattern: "$RETURNTYPE $FUNC (..., @javax.ws.rs.PathParam(...) $TYPE $VAR, ...) {\n ...\n new File(..., $VAR, ...);\n\ + \ ...\n}" +- id: java.jboss.security.session_sqli.find-sql-string-concatenation + message: In $METHOD, $X is used to construct a SQL query via string concatenation. + languages: + - java + severity: ERROR + pattern-either: + - pattern: "$RETURN $METHOD(...,String $X,...){\n ...\n Session $SESSION = ...;\n ...\n String $QUERY = ... + $X + ...;\n\ + \ ...\n PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY);\n ...\n ResultSet $RESULT = $PS.executeQuery();\n\ + \ ...\n}\n" + - pattern: "$RETURN $METHOD(...,String $X,...){\n ...\n String $QUERY = ... + $X + ...;\n ...\n Session $SESSION = ...;\n\ + \ ...\n PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY);\n ...\n ResultSet $RESULT = $PS.executeQuery();\n\ + \ ...\n}\n" + metadata: + category: security + technology: + - jboss + confidence: MEDIUM + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation + shortlink: https://sg.run/W8kA + semgrep.dev: + rule: + r_id: 9153 + rv_id: 1262986 + rule_id: X5U8rQ + version_id: 8KT5r3v + url: https://semgrep.dev/playground/r/8KT5r3v/java.jboss.security.session_sqli.find-sql-string-concatenation + origin: community +- id: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BLOWFISH_KEY_SIZE + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + category: security + technology: + - java + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size + shortlink: https://sg.run/9o74 + semgrep.dev: + rule: + r_id: 9167 + rv_id: 1262989 + rule_id: d8UjJ3 + version_id: 3ZT4X2r + url: https://semgrep.dev/playground/r/3ZT4X2r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size + origin: community + message: Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead. + severity: WARNING + languages: + - java + patterns: + - pattern: '$KEYGEN = KeyGenerator.getInstance("Blowfish"); + + ... + + $KEYGEN.init($SIZE); + + ' + - metavariable-comparison: + metavariable: $SIZE + comparison: $SIZE < 128 +- id: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle + message: Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference + between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' + instead. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PADDING_ORACLE + references: + - https://capec.mitre.org/data/definitions/463.html + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes + - https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY + category: security + technology: + - java + subcategory: + - audit + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle + shortlink: https://sg.run/ydxr + semgrep.dev: + rule: + r_id: 9168 + rv_id: 1262990 + rule_id: ZqU5oD + version_id: 44TEjbE + url: https://semgrep.dev/playground/r/44TEjbE/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle + origin: community + severity: WARNING + fix: '"AES/GCM/NoPadding" + + ' + languages: + - java + patterns: + - pattern-inside: Cipher.getInstance("=~/.*\/CBC\/PKCS5Padding/") + - pattern: '"=~/.*\/CBC\/PKCS5Padding/" + + ' +- id: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs + message: When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge + log entries or include malicious content. + metadata: + cwe: + - 'CWE-93: Improper Neutralization of CRLF Sequences (''CRLF Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#CRLF_INJECTION_LOGS + category: security + technology: + - java + references: + - https://owasp.org/Top10/A03_2021-Injection + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs + shortlink: https://sg.run/wek0 + semgrep.dev: + rule: + r_id: 9173 + rv_id: 1262995 + rule_id: 8GUjwW + version_id: RGT0LEr + url: https://semgrep.dev/playground/r/RGT0LEr/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs + origin: community + severity: WARNING + languages: + - java + patterns: + - pattern-either: + - patterns: + - pattern-inside: "class $CLASS {\n ...\n Logger $LOG = ...;\n ...\n}\n" + - pattern-either: + - pattern-inside: "$X $METHOD(...,HttpServletRequest $REQ,...) {\n ...\n}\n" + - pattern-inside: "$X $METHOD(...,ServletRequest $REQ,...) {\n ...\n}\n" + - pattern-inside: "$X $METHOD(...) {\n ...\n HttpServletRequest $REQ = ...;\n ...\n}\n" + - pattern-inside: "$X $METHOD(...) {\n ...\n ServletRequest $REQ = ...;\n ...\n}\n" + - pattern-inside: "$X $METHOD(...) {\n ...\n Logger $LOG = ...;\n ...\n HttpServletRequest $REQ = ...;\n ...\n}\n" + - pattern-inside: "$X $METHOD(...) {\n ...\n Logger $LOG = ...;\n ...\n ServletRequest $REQ = ...;\n ...\n}\n" + - pattern-either: + - pattern: 'String $VAL = $REQ.getParameter(...); + + ... + + $LOG.$LEVEL(<... $VAL ...>); + + ' + - pattern: 'String $VAL = $REQ.getParameter(...); + + ... + + $LOG.log($LEVEL,<... $VAL ...>); + + ' + - pattern: '$LOG.$LEVEL(<... $REQ.getParameter(...) ...>); + + ' + - pattern: '$LOG.log($LEVEL,<... $REQ.getParameter(...) ...>); + + ' +- id: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated + message: DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard + for more information. + metadata: + functional-categories: + - crypto::search::symmetric-algorithm::javax.crypto + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DES_USAGE + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + references: + - https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms + category: security + technology: + - java + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated + shortlink: https://sg.run/5Q73 + semgrep.dev: + rule: + r_id: 9191 + rv_id: 1262996 + rule_id: PeUZNg + version_id: A8TgdEn + url: https://semgrep.dev/playground/r/A8TgdEn/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated + origin: community + severity: WARNING + patterns: + - pattern-either: + - pattern-inside: $CIPHER.getInstance("=~/DES/.*/") + - pattern-inside: $CIPHER.getInstance("DES") + - pattern-either: + - pattern: '"=~/DES/.*/" + + ' + - pattern: '"DES" + + ' + fix: '"AES/GCM/NoPadding" + + ' + languages: + - java + - kt +- id: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated + message: Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES. + metadata: + functional-categories: + - crypto::search::symmetric-algorithm::javax.crypto + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#TDES_USAGE + references: + - https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA + category: security + technology: + - java + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated + shortlink: https://sg.run/Geqn + semgrep.dev: + rule: + r_id: 9192 + rv_id: 1262997 + rule_id: JDUy8J + version_id: BjTkZyQ + url: https://semgrep.dev/playground/r/BjTkZyQ/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated + origin: community + severity: WARNING + patterns: + - pattern-either: + - pattern: '$CIPHER.getInstance("=~/DESede.*/") + + ' + - pattern: '$CRYPTO.KeyGenerator.getInstance("DES") + + ' + languages: + - java + - kt +- id: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher + metadata: + functional-categories: + - crypto::search::mode::javax.crypto + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE + category: security + technology: + - java + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher + shortlink: https://sg.run/Ro9K + semgrep.dev: + rule: + r_id: 9193 + rv_id: 1262998 + rule_id: 5rUOb6 + version_id: DkTRbwL + url: https://semgrep.dev/playground/r/DkTRbwL/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher + origin: community + message: Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an + attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY. + severity: WARNING + languages: + - java + patterns: + - pattern: 'Cipher $VAR = $CIPHER.getInstance($MODE); + + ' + - metavariable-regex: + metavariable: $MODE + regex: .*ECB.* +- id: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse + metadata: + functional-categories: + - crypto::search::randomness::javax.crypto + cwe: + - 'CWE-323: Reusing a Nonce, Key Pair in Encryption' + category: security + source-rule-url: https://www.youtube.com/watch?v=r1awgAl90wM + technology: + - java + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse + shortlink: https://sg.run/Dww2 + semgrep.dev: + rule: + r_id: 11908 + rv_id: 1263000 + rule_id: GdUZZ3 + version_id: 0bTKzGk + url: https://semgrep.dev/playground/r/0bTKzGk/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse + origin: community + languages: + - java + message: 'GCM IV/nonce is reused: encryption can be totally useless' + patterns: + - pattern-either: + - pattern: new GCMParameterSpec(..., "...".getBytes(...), ...); + - pattern: byte[] $NONCE = "...".getBytes(...); ... new GCMParameterSpec(..., $NONCE, ...); + severity: ERROR +- id: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher + patterns: + - pattern-either: + - pattern: new NullCipher(...); + - pattern: new javax.crypto.NullCipher(...); + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + category: security + technology: + - java + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher + shortlink: https://sg.run/AvA4 + semgrep.dev: + rule: + r_id: 9194 + rv_id: 1263001 + rule_id: GdU7pw + version_id: K3TKkgB + url: https://semgrep.dev/playground/r/K3TKkgB/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher + origin: community + message: 'NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use + a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions + for more information.' + severity: WARNING + languages: + - java +- id: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector + message: Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static + IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption. + metadata: + cwe: + - 'CWE-329: Generation of Predictable IV with CBC Mode' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#STATIC_IV + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + references: + - https://cwe.mitre.org/data/definitions/329.html + category: security + technology: + - java + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector + shortlink: https://sg.run/BkB5 + semgrep.dev: + rule: + r_id: 9195 + rv_id: 1263002 + rule_id: ReUgj1 + version_id: qkTR7vP + url: https://semgrep.dev/playground/r/qkTR7vP/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector + origin: community + severity: WARNING + languages: + - java + pattern-either: + - pattern: "byte[] $IV = {\n ...\n};\n...\nnew IvParameterSpec($IV, ...);\n" + - pattern: "class $CLASS {\n byte[] $IV = {\n ...\n };\n ...\n $METHOD(...) {\n ...\n new\ + \ IvParameterSpec($IV, ...);\n ...\n }\n}\n" +- id: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding + metadata: + functional-categories: + - crypto::search::mode::javax.crypto + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_NO_PADDING + references: + - https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/ + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + category: security + technology: + - java + - kotlin + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding + shortlink: https://sg.run/DoOj + semgrep.dev: + rule: + r_id: 9196 + rv_id: 1263003 + rule_id: AbUzoj + version_id: l4TJRpK + url: https://semgrep.dev/playground/r/l4TJRpK/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding + origin: community + message: Using RSA without OAEP mode weakens the encryption. + severity: WARNING + languages: + - java + - kt + pattern: $CIPHER.getInstance("=~/RSA/[Nn][Oo][Nn][Ee]/NoPadding/") +- id: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket + metadata: + functional-categories: + - net::search::crypto-config::java.net + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNENCRYPTED_SOCKET + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + category: security + technology: + - java + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket + shortlink: https://sg.run/W8zA + semgrep.dev: + rule: + r_id: 9197 + rv_id: 1263008 + rule_id: BYUN3X + version_id: RGT0LEj + url: https://semgrep.dev/playground/r/RGT0LEj/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket + origin: community + message: Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting + the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead. + severity: WARNING + languages: + - java + pattern-either: + - pattern: new ServerSocket(...) + - pattern: new Socket(...) +- id: java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb + pattern: $CIPHER.getInstance("=~/AES/ECB.*/") + metadata: + functional-categories: + - crypto::search::mode::javax.crypto + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + category: security + technology: + - java + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb + shortlink: https://sg.run/dB2Y + semgrep.dev: + rule: + r_id: 48734 + rv_id: 1263009 + rule_id: WAU2yA + version_id: A8TgdEo + url: https://semgrep.dev/playground/r/A8TgdEo/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb + origin: community + message: 'Use of AES with ECB mode detected. ECB doesn''t provide message confidentiality and is not semantically secure + so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions + for more information.' + severity: WARNING + languages: + - java +- id: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish + pattern: $CIPHER.getInstance("Blowfish") + metadata: + functional-categories: + - crypto::search::symmetric-algorithm::javax.crypto + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + category: security + technology: + - java + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish + shortlink: https://sg.run/ZE4n + semgrep.dev: + rule: + r_id: 48735 + rv_id: 1263010 + rule_id: 0oUR28 + version_id: BjTkZy0 + url: https://semgrep.dev/playground/r/BjTkZy0/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish + origin: community + message: 'Use of Blowfish was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, + and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). + See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' + severity: WARNING + languages: + - java +- id: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes + pattern-either: + - patterns: + - pattern-either: + - pattern-inside: 'import javax; + + ... + + ' + - pattern-either: + - pattern: javax.crypto.Cipher.getInstance("AES") + - pattern: (javax.crypto.Cipher $CIPHER).getInstance("AES") + - patterns: + - pattern-either: + - pattern-inside: 'import javax.*; + + ... + + ' + - pattern-inside: 'import javax.crypto; + + ... + + ' + - pattern-either: + - pattern: crypto.Cipher.getInstance("AES") + - pattern: (crypto.Cipher $CIPHER).getInstance("AES") + - patterns: + - pattern-either: + - pattern-inside: 'import javax.crypto.*; + + ... + + ' + - pattern-inside: 'import javax.crypto.Cipher; + + ... + + ' + - pattern-either: + - pattern: Cipher.getInstance("AES") + - pattern: (Cipher $CIPHER).getInstance("AES") + metadata: + functional-categories: + - crypto::search::mode::javax.crypto + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + category: security + technology: + - java + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes + shortlink: https://sg.run/nzKO + semgrep.dev: + rule: + r_id: 48736 + rv_id: 1263011 + rule_id: KxUB7Z + version_id: DkTRbwy + url: https://semgrep.dev/playground/r/DkTRbwy/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes + origin: community + message: 'Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn''t provide message + confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance("AES/CBC/PKCS7PADDING"). + See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' + severity: WARNING + languages: + - java +- id: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use HMAC instead. + languages: + - java + severity: WARNING + metadata: + functional-categories: + - crypto::search::hash-algorithm::org.apache.commons + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5 + category: security + technology: + - java + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils + shortlink: https://sg.run/AWL2 + semgrep.dev: + rule: + r_id: 39194 + rv_id: 1263012 + rule_id: BYUGK0 + version_id: WrTqK7K + url: https://semgrep.dev/playground/r/WrTqK7K/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils + origin: community + patterns: + - pattern: '$DU.$GET_ALGO().digest(...) + + ' + - metavariable-pattern: + metavariable: $GET_ALGO + pattern: getMd5Digest + - metavariable-pattern: + metavariable: $DU + pattern: DigestUtils + - focus-metavariable: $GET_ALGO + fix: 'getSha512Digest + + ' +- id: java.lang.security.audit.crypto.use-of-md5.use-of-md5 + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use HMAC instead. + languages: + - java + severity: WARNING + metadata: + functional-categories: + - crypto::search::hash-algorithm::java.security + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5 + category: security + technology: + - java + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5 + shortlink: https://sg.run/ryJn + semgrep.dev: + rule: + r_id: 17325 + rv_id: 1263013 + rule_id: KxU5lW + version_id: 0bTKzGX + url: https://semgrep.dev/playground/r/0bTKzGX/java.lang.security.audit.crypto.use-of-md5.use-of-md5 + origin: community + patterns: + - pattern: 'java.security.MessageDigest.getInstance($ALGO, ...); + + ' + - metavariable-regex: + metavariable: $ALGO + regex: (?i)(.MD5.) + - focus-metavariable: $ALGO + fix: '"SHA-512" + + ' +- id: java.lang.security.audit.crypto.use-of-rc2.use-of-rc2 + pattern: $CIPHER.getInstance("RC2") + metadata: + functional-categories: + - crypto::search::symmetric-algorithm::javax.crypto + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + category: security + technology: + - java + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2 + shortlink: https://sg.run/EEvA + semgrep.dev: + rule: + r_id: 48737 + rv_id: 1263014 + rule_id: qNUzXG + version_id: K3TKkg0 + url: https://semgrep.dev/playground/r/K3TKkg0/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2 + origin: community + message: 'Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. + Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions + for more information.' + severity: WARNING + languages: + - java +- id: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4 + pattern: $CIPHER.getInstance("RC4") + metadata: + functional-categories: + - crypto::search::symmetric-algorithm::javax.crypto + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + category: security + technology: + - java + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4 + shortlink: https://sg.run/7OYR + semgrep.dev: + rule: + r_id: 48738 + rv_id: 1263015 + rule_id: lBUw8k + version_id: qkTR7vk + url: https://semgrep.dev/playground/r/qkTR7vk/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4 + origin: community + message: 'Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping + attacks. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions + for more information.' + severity: WARNING + languages: + - java +- id: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1 + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not + suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function + applications. + languages: + - java + severity: WARNING + metadata: + functional-categories: + - crypto::search::hash-algorithm::javax.crypto + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1 + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + category: security + technology: + - java + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1 + shortlink: https://sg.run/bXNp + semgrep.dev: + rule: + r_id: 17326 + rv_id: 1263016 + rule_id: qNUWNn + version_id: l4TJRpL + url: https://semgrep.dev/playground/r/l4TJRpL/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1 + origin: community + pattern-either: + - patterns: + - pattern: 'java.security.MessageDigest.getInstance("$ALGO", ...); + + ' + - metavariable-regex: + metavariable: $ALGO + regex: (SHA1|SHA-1) + - pattern: '$DU.getSha1Digest().digest(...) + + ' +- id: java.lang.security.audit.crypto.use-of-sha224.use-of-sha224 + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating + to a stronger hash function such as SHA-384 or higher to ensure compliance and security. + languages: + - java + severity: WARNING + metadata: + functional-categories: + - crypto::search::hash-algorithm::javax.crypto + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + category: security + technology: + - java + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf + - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha224.use-of-sha224 + shortlink: https://sg.run/Ab2KQ + semgrep.dev: + rule: + r_id: 151750 + rv_id: 1263017 + rule_id: ReUDGEz + version_id: YDTZewo + url: https://semgrep.dev/playground/r/YDTZewo/java.lang.security.audit.crypto.use-of-sha224.use-of-sha224 + origin: community + pattern-either: + - pattern: org.apache.commons.codec.digest.DigestUtils.getSha3_224Digest() + - pattern: org.apache.commons.codec.digest.DigestUtils.getSha512_224Digest() + - pattern: org.apache.commons.codec.digest.DigestUtils.sha3_224(...) + - pattern: org.apache.commons.codec.digest.DigestUtils.sha3_224Hex(...) + - pattern: org.apache.commons.codec.digest.DigestUtils.sha512_224(...) + - pattern: org.apache.commons.codec.digest.DigestUtils.sha512_224Hex(...) + - pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_224) + - pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_512_224) + - pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA3_224) + - patterns: + - pattern: java.security.MessageDigest.getInstance("$ALGO", ...); + - metavariable-regex: + metavariable: $ALGO + regex: .*224 +- id: java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key + message: RSA keys should be at least 2048 bits based on NIST recommendation. + languages: + - java + severity: WARNING + metadata: + functional-categories: + - crypto::search::key-length::java.security + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_KEY_SIZE + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms + category: security + technology: + - java + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key + shortlink: https://sg.run/4x6x + semgrep.dev: + rule: + r_id: 9200 + rv_id: 1263019 + rule_id: 0oU5P5 + version_id: o5TbDLY + url: https://semgrep.dev/playground/r/o5TbDLY/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key + origin: community + patterns: + - pattern: 'KeyPairGenerator $KEY = $G.getInstance("RSA"); + + ... + + $KEY.initialize($BITS); + + ' + - metavariable-comparison: + metavariable: $BITS + comparison: $BITS < 2048 +- id: java.lang.security.audit.formatted-sql-string.formatted-sql-string + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.5 Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html + - https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps + - https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement + category: security + technology: + - java + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string + shortlink: https://sg.run/OPXp + semgrep.dev: + rule: + r_id: 9175 + rv_id: 1409389 + rule_id: QrUzxR + version_id: ExTeyBP + url: https://semgrep.dev/playground/r/ExTeyBP/java.lang.security.audit.formatted-sql-string.formatted-sql-string + origin: community + options: + taint_assume_safe_numbers: true + taint_assume_safe_booleans: true + message: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement + are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement + using 'connection.prepareStatement'. + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '(HttpServletRequest $REQ) + + ' + - patterns: + - pattern-inside: "$ANNOT $FUNC (..., $INPUT, ...) {\n ...\n}\n" + - pattern: (String $INPUT) + - focus-metavariable: $INPUT + label: INPUT + - patterns: + - pattern-either: + - pattern: $X + $INPUT + - pattern: $X += $INPUT + - pattern: String.format(..., $INPUT, ...) + - pattern: String.join(..., $INPUT, ...) + - pattern: (String $STR).concat($INPUT) + - pattern: $INPUT.concat(...) + - patterns: + - pattern-either: + - pattern: $STRB.append($INPUT) + - pattern: new $STRB(..., $INPUT, ...) + - metavariable-type: + metavariable: $STRB + type: StringBuilder + label: CONCAT + requires: INPUT + pattern-propagators: + - pattern: (StringBuffer $S).append($X) + from: $X + to: $S + - pattern: (StringBuilder $S).append($X) + from: $X + to: $S + pattern-sinks: + - patterns: + - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE *$/" ...>) + - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE %s$/" ...>) + - pattern-either: + - pattern: (Statement $S).$SQLFUNC(...) + - pattern: (PreparedStatement $P).$SQLFUNC(...) + - pattern: (Connection $C).createStatement(...).$SQLFUNC(...) + - pattern: (Connection $C).prepareStatement(...).$SQLFUNC(...) + - pattern: (EntityManager $EM).$SQLFUNC(...) + - metavariable-regex: + metavariable: $SQLFUNC + regex: execute|executeQuery|createQuery|query|addBatch|nativeSQL|create|prepare + requires: CONCAT + pattern-sanitizers: + - patterns: + - pattern: (CriteriaBuilder $CB).$ANY(...) + severity: ERROR + languages: + - java +- id: java.lang.security.audit.http-response-splitting.http-response-splitting + metadata: + cwe: + - 'CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (''HTTP Request/Response Splitting'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTP_RESPONSE_SPLITTING + references: + - https://www.owasp.org/index.php/HTTP_Response_Splitting + category: security + technology: + - java + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting + shortlink: https://sg.run/eL0l + semgrep.dev: + rule: + r_id: 9176 + rv_id: 1263023 + rule_id: 3qUPyK + version_id: X0Tzykw + url: https://semgrep.dev/playground/r/X0Tzykw/java.lang.security.audit.http-response-splitting.http-response-splitting + origin: community + message: Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can + be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment + is not affected by testing this yourself. + severity: INFO + languages: + - java + pattern-either: + - pattern: '$VAR = $REQ.getParameter(...); + + ... + + $COOKIE = new Cookie(..., $VAR, ...); + + ... + + $RESP.addCookie($COOKIE, ...); + + ' + - patterns: + - pattern-inside: "$RETTYPE $FUNC(...,@PathVariable $TYPE $VAR, ...) {\n ...\n}\n" + - pattern: '$COOKIE = new Cookie(..., $VAR, ...); + + ... + + $RESP.addCookie($COOKIE, ...); + + ' +- id: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection + metadata: + cwe: + - 'CWE-297: Improper Validation of Certificate with Host Mismatch' + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_SMTP_SSL + category: security + technology: + - java + references: + - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection + shortlink: https://sg.run/vzN4 + semgrep.dev: + rule: + r_id: 9177 + rv_id: 1263024 + rule_id: 4bUkrW + version_id: jQTn5Dv + url: https://semgrep.dev/playground/r/jQTn5Dv/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection + origin: community + message: Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification + by setting 'email.setSSLCheckServerIdentity(true)'. + severity: WARNING + patterns: + - pattern-not-inside: '$EMAIL.setSSLCheckServerIdentity(true); + + ... + + ' + - pattern-inside: '$EMAIL = new SimpleEmail(...); + + ... + + ' + - pattern: $EMAIL.send(...); + languages: + - java +- id: java.lang.security.audit.md5-used-as-password.md5-used-as-password + languages: + - java + severity: WARNING + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked + by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use + `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1")` or, if using Spring, `org.springframework.security.crypto.bcrypt`. + metadata: + category: security + technology: + - java + - md5 + references: + - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html + - https://github.com/returntocorp/semgrep-rules/issues/1609 + - https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory + - https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password + shortlink: https://sg.run/JxEQ + semgrep.dev: + rule: + r_id: 14690 + rv_id: 1263029 + rule_id: JDULAW + version_id: bZT53QB + url: https://semgrep.dev/playground/r/bZT53QB/java.lang.security.audit.md5-used-as-password.md5-used-as-password + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-inside: '$TYPE $MD = MessageDigest.getInstance("MD5"); + + ... + + ' + - pattern: $MD.digest(...); + pattern-sinks: + - patterns: + - pattern: $MODEL.$METHOD(...); + - metavariable-regex: + metavariable: $METHOD + regex: (?i)(.*password.*) +- id: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request + message: Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if + variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input + instead. + severity: WARNING + metadata: + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + category: security + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + cwe2021-top25: true + cwe2022-top25: true + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html + - https://owasp.org/www-community/attacks/SQL_Injection + subcategory: + - vuln + technology: + - sql + - java + - servlets + - spring + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request + shortlink: https://sg.run/Lg56 + semgrep.dev: + rule: + r_id: 18239 + rv_id: 1409390 + rule_id: oqUBJG + version_id: 7ZTKJNj + url: https://semgrep.dev/playground/r/7ZTKJNj/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request + origin: community + languages: + - java + mode: taint + options: + taint_assume_safe_numbers: true + taint_assume_safe_booleans: true + pattern-sources: + - patterns: + - pattern-either: + - pattern: '(HttpServletRequest $REQ).$REQFUNC(...) + + ' + - pattern: "(ServletRequest $REQ).$REQFUNC(...) \n" + - metavariable-regex: + metavariable: $REQFUNC + regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "(java.sql.CallableStatement $STMT) = ...; \n" + - pattern: '(java.sql.Statement $STMT) = ...; + + ... + + $OUTPUT = $STMT.$FUNC(...); + + ' + - pattern: '(java.sql.PreparedStatement $STMT) = ...; + + ' + - pattern: '$VAR = $CONN.prepareStatement(...) + + ' + - pattern: '$PATH.queryForObject(...); + + ' + - pattern: '(java.util.Map $STMT) = $PATH.queryForMap(...); + + ' + - pattern: '(org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...; + + ' + - pattern: '(org.springframework.jdbc.core.JdbcTemplate $TEMPL).batchUpdate(...) + + ' + - patterns: + - pattern-inside: '(String $SQL) = "$SQLSTR" + ...; + + ... + + ' + - pattern: $PATH.$SQLCMD(..., $SQL, ...); + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*) + - metavariable-regex: + metavariable: $SQLCMD + regex: (execute|query|executeUpdate|batchUpdate) +- id: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request + message: Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command + injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands + with user-supplied input, or, if you must use these commands, use a whitelist of specific values. + languages: + - java + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '(HttpServletRequest $REQ) + + ' + - patterns: + - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie\ + \ $COOKIE: $COOKIES) {\n ...\n}\n" + - pattern: '$COOKIE.getValue(...) + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '(ProcessBuilder $PB) = ...; + + ' + - patterns: + - pattern: '(Process $P) = ...; + + ' + - pattern-not: '(Process $P) = (java.lang.Runtime $R).exec(...); + + ' + - patterns: + - pattern: (java.lang.Runtime $R).exec($CMD, ...); + - focus-metavariable: $CMD + - patterns: + - pattern-either: + - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(ProcessBuilder $PB) = ...;\n...\n$PB.command($ARGLIST);\n" + - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(ProcessBuilder $PB) = ...;\n" + - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(Process $P) = ...;\n" + - pattern: '$ARGLIST.add(...); + + ' + metadata: + category: security + technology: + - java + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request + shortlink: https://sg.run/8zPN + semgrep.dev: + rule: + r_id: 18240 + rv_id: 1263042 + rule_id: zdUWrg + version_id: LjTkg9J + url: https://semgrep.dev/playground/r/LjTkg9J/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request + origin: community +- id: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request + message: Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command. Instead, call + the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({"command", + "arg1", "arg2"})`. + languages: + - java + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '(HttpServletRequest $REQ) + + ' + - patterns: + - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie\ + \ $COOKIE: $COOKIES) {\n ...\n}\n" + - pattern: '$COOKIE.getValue(...) + + ' + pattern-sinks: + - patterns: + - pattern: (java.lang.Runtime $R).exec($CMD, $ENV_ARGS, ...); + - focus-metavariable: $ENV_ARGS + metadata: + category: security + technology: + - java + cwe: + - 'CWE-454: External Initialization of Trusted Variables or Data Stores' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: false + cwe2021-top25: false + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request + shortlink: https://sg.run/EJAB + semgrep.dev: + rule: + r_id: 70981 + rv_id: 1409391 + rule_id: nJULjy + version_id: LjTRL6W + url: https://semgrep.dev/playground/r/LjTRL6W/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request + origin: community +- id: java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request + message: Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input + is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed + to an LDAP query is not controllable or properly sanitize the data. + metadata: + cwe: + - 'CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (''LDAP Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection + category: security + technology: + - java + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - LDAP Injection + source: https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request + shortlink: https://sg.run/gRg0 + semgrep.dev: + rule: + r_id: 18241 + rv_id: 1409392 + rule_id: pKUXAv + version_id: 8KT3Pe6 + url: https://semgrep.dev/playground/r/8KT3Pe6/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request + origin: community + severity: WARNING + languages: + - java + mode: taint + pattern-sources: + - patterns: + - pattern: (HttpServletRequest $REQ) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '(javax.naming.directory.InitialDirContext $IDC).search(...) + + ' + - pattern: '(javax.naming.directory.DirContext $CTX).search(...) + + ' + - pattern-not: '(javax.naming.directory.InitialDirContext $IDC).search($Y, "...", ...) + + ' + - pattern-not: '(javax.naming.directory.DirContext $CTX).search($Y, "...", ...) + + ' +- id: java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request + message: Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such + a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's + trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated + data. Instead, thoroughly sanitize user input before passing it into such function calls. + languages: + - java + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern: '(HttpServletRequest $REQ).$FUNC(...) + + ' + - pattern-not: '(HttpServletRequest $REQ).getSession() + + ' + - patterns: + - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie\ + \ $COOKIE: $COOKIES) {\n ...\n}\n" + - pattern: '$COOKIE.getValue(...) + + ' + - patterns: + - pattern-inside: '$TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(... ); + + ... + + ' + - pattern: '$PARAM = $VALS[$INDEX]; + + ' + - patterns: + - pattern-inside: '$HEADERS = (HttpServletRequest $REQ).getHeaders(...); + + ... + + $PARAM = $HEADERS.$FUNC(...); + + ... + + ' + - pattern: 'java.net.URLDecoder.decode($PARAM, ...) + + ' + pattern-sinks: + - patterns: + - pattern: (HttpServletRequest $REQ).getSession().$FUNC($NAME, $VALUE); + - metavariable-regex: + metavariable: $FUNC + regex: ^(putValue|setAttribute)$ + - focus-metavariable: $VALUE + options: + interfile: true + metadata: + category: security + technology: + - java + cwe: + - 'CWE-501: Trust Boundary Violation' + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request + shortlink: https://sg.run/QbDZ + semgrep.dev: + rule: + r_id: 18242 + rv_id: 1409393 + rule_id: 2ZU7Eo + version_id: gETrv9j + url: https://semgrep.dev/playground/r/gETrv9j/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request + origin: community +- id: java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request + message: Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath + injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could + lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use + parameterized xpath queries if you can. + languages: + - java + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern: '(HttpServletRequest $REQ).$FUNC(...) + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '(javax.xml.xpath.XPath $XP).evaluate(...) + + ' + - pattern: '(javax.xml.xpath.XPath $XP).compile(...).evaluate(...) + + ' + metadata: + category: security + technology: + - java + cwe: + - 'CWE-643: Improper Neutralization of Data within XPath Expressions (''XPath Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XPath Injection + source: https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request + shortlink: https://sg.run/3BvK + semgrep.dev: + rule: + r_id: 18243 + rv_id: 1409394 + rule_id: X5U5nj + version_id: QkTERKP + url: https://semgrep.dev/playground/r/QkTERKP/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request + origin: community +- id: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect + message: Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could + direct users to malicious locations. Consider using an allowlist to validate URLs. + metadata: + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.1.5 Open Redirect + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation-requirements + version: '4' + category: security + technology: + - java + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + impact: LOW + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect + shortlink: https://sg.run/Q51P + semgrep.dev: + rule: + r_id: 9186 + rv_id: 1263048 + rule_id: WAUo0p + version_id: PkTR329 + url: https://semgrep.dev/playground/r/PkTR329/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect + origin: community + severity: WARNING + languages: + - java + pattern-either: + - pattern: "$X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {\n ...\n $RES.sendRedirect($URL);\n ...\n}\n" + - pattern: "$X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {\n ...\n $RES.sendRedirect($URL);\n ...\n}\n" + - pattern: "$X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {\n ...\n String $URL = $REQ.getParameter(...);\n\ + \ ...\n $RES.sendRedirect($URL);\n ...\n}\n" + - pattern: "$X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {\n ...\n String $URL = $REQ.getParameter(...);\n\ + \ ...\n $RES.sendRedirect($URL);\n ...\n}\n" + - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n HttpServletResponse $RES = ...;\n ...\n $RES.sendRedirect($URL);\n\ + \ ...\n}\n" + - pattern: "$X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {\n ...\n $RES.sendRedirect($REQ.getParameter(...));\n\ + \ ...\n}\n" + - pattern: "$X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {\n ...\n $RES.sendRedirect($REQ.getParameter(...));\n\ + \ ...\n}\n" + - pattern: "$X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {\n ...\n $RES.addHeader(\"Location\",$URL);\n\ + \ ...\n}\n" + - pattern: "$X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {\n ...\n $RES.addHeader(\"Location\",$URL);\n\ + \ ...\n}\n" + - pattern: "$X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {\n ...\n String $URL = $REQ.getParameter(...);\n\ + \ ...\n $RES.addHeader(\"Location\",$URL);\n ...\n}\n" + - pattern: "$X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {\n ...\n String $URL = $REQ.getParameter(...);\n\ + \ ...\n $RES.addHeader(\"Location\",$URL);\n ...\n}\n" + - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n HttpServletResponse $RES = ...;\n ...\n $RES.addHeader(\"Location\"\ + ,$URL);\n ...\n}\n" + - pattern: "$X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {\n ...\n $RES.addHeader(\"Location\"\ + ,$REQ.getParameter(...));\n ...\n}\n" + - pattern: "$X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {\n ...\n $RES.addHeader(\"Location\"\ + ,$REQ.getParameter(...));\n ...\n}" +- id: java.lang.security.audit.weak-ssl-context.weak-ssl-context + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source_rule_url: https://find-sec-bugs.github.io/bugs.htm#SSL_CONTEXT + references: + - https://tools.ietf.org/html/rfc7568 + - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html + category: security + technology: + - java + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context + shortlink: https://sg.run/4x7E + semgrep.dev: + rule: + r_id: 9188 + rv_id: 1263050 + rule_id: KxUb1k + version_id: 5PTo1rW + url: https://semgrep.dev/playground/r/5PTo1rW/java.lang.security.audit.weak-ssl-context.weak-ssl-context + origin: community + message: An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption + and are deprecated. Use SSLContext.getInstance("TLSv1.2") for the best security. + severity: WARNING + languages: + - java + patterns: + - pattern-not: SSLContext.getInstance("TLSv1.3") + - pattern-not: SSLContext.getInstance("TLSv1.2") + - pattern: SSLContext.getInstance("...") + fix-regex: + regex: (.*?)\.getInstance\(.*?\) + replacement: \1.getInstance("TLSv1.2") +- id: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer + message: Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view + or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. + Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views. + severity: WARNING + options: + interfile: true + metadata: + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + category: security + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + cwe2021-top25: true + cwe2022-top25: true + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html + subcategory: + - vuln + technology: + - java + - servlets + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer + shortlink: https://sg.run/KlRL + semgrep.dev: + rule: + r_id: 9211 + rv_id: 1263055 + rule_id: j2Uv7B + version_id: DkTRbXy + url: https://semgrep.dev/playground/r/DkTRbXy/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer + origin: community + languages: + - java + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '(HttpServletRequest $REQ).$REQFUNC(...) + + ' + - pattern: "(ServletRequest $REQ).$REQFUNC(...) \n" + - metavariable-regex: + metavariable: $REQFUNC + regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '(HttpServletResponse $RESPONSE).getWriter(...).$WRITE(...) + + ' + - pattern: '(HttpServletResponse $RESPONSE).getOutputStream(...).$WRITE(...) + + ' + - pattern: '(java.io.PrintWriter $WRITER).$WRITE(...) + + ' + - pattern: '(PrintWriter $WRITER).$WRITE(...) + + ' + - pattern: '(javax.servlet.ServletOutputStream $WRITER).$WRITE(...) + + ' + - pattern: '(ServletOutputStream $WRITER).$WRITE(...) + + ' + - pattern: '(java.io.OutputStream $WRITER).$WRITE(...) + + ' + - pattern: '(OutputStream $WRITER).$WRITE(...) + + ' + pattern-sanitizers: + - pattern-either: + - pattern: Encode.forHtml(...) + - pattern: (PolicyFactory $POLICY).sanitize(...) + - pattern: (AntiSamy $AS).scan(...) + - pattern: JSoup.clean(...) + - pattern: org.apache.commons.lang.StringEscapeUtils.escapeHtml(...) + - pattern: org.springframework.web.util.HtmlUtils.htmlEscape(...) + - pattern: org.owasp.esapi.ESAPI.encoder().encodeForHTML(...) +- id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false + severity: ERROR + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://semgrep.dev/blog/2022/xml-security-in-java + - https://semgrep.dev/docs/cheat-sheets/java-xxe/ + - https://blog.sonarsource.com/secure-xml-processor + - https://xerces.apache.org/xerces2-j/features.html + category: security + technology: + - java + - xml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false + shortlink: https://sg.run/4Dv5 + semgrep.dev: + rule: + r_id: 18244 + rv_id: 1263057 + rule_id: j2UrJ8 + version_id: 0bTKzgX + url: https://semgrep.dev/playground/r/0bTKzgX/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false + origin: community + message: DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable + to XML external entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" + to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done + by setting the features "http://xml.org/sax/features/external-general-entities" and "http://xml.org/sax/features/external-parameter-entities" + to false. + patterns: + - pattern: $DBFACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false); + - pattern-not-inside: "$RETURNTYPE $METHOD(...){\n ...\n $DBF.setFeature(\"http://xml.org/sax/features/external-general-entities\"\ + , false);\n ...\n $DBF.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n}\n" + - pattern-not-inside: "$RETURNTYPE $METHOD(...){\n ...\n $DBF.setFeature(\"http://xml.org/sax/features/external-parameter-entities\"\ + , false);\n ...\n $DBF.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n ...\n}\n" + - pattern-not-inside: "$RETURNTYPE $METHOD(...){\n ...\n $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n\ + \ ...\n $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\");\n ...\n}\n" + - pattern-not-inside: "$RETURNTYPE $METHOD(...){\n ...\n $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\");\n\ + \ ...\n $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n ...\n}\n" + languages: + - java +- id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing + severity: ERROR + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://semgrep.dev/blog/2022/xml-security-in-java + - https://semgrep.dev/docs/cheat-sheets/java-xxe/ + - https://blog.sonarsource.com/secure-xml-processor + - https://xerces.apache.org/xerces2-j/features.html + category: security + technology: + - java + - xml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing + shortlink: https://sg.run/PYBz + semgrep.dev: + rule: + r_id: 18245 + rv_id: 1263058 + rule_id: 10UPQB + version_id: K3TKk80 + url: https://semgrep.dev/playground/r/K3TKk80/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing + origin: community + message: DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. + Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively, allow + DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities" + and "http://xml.org/sax/features/external-parameter-entities" to false. + mode: taint + pattern-sources: + - by-side-effect: true + patterns: + - pattern-either: + - pattern: '$FACTORY = DocumentBuilderFactory.newInstance(); + + ' + - patterns: + - pattern: $FACTORY + - pattern-inside: "class $C {\n ...\n $V $FACTORY = DocumentBuilderFactory.newInstance();\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = DocumentBuilderFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n ...\n }\n ...\n\ + }\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = DocumentBuilderFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n $FACTORY.setFeature(\"\ + http://xml.org/sax/features/external-general-entities\", false);\n ...\n }\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = DocumentBuilderFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n ...\n $FACTORY.setFeature(\"\ + http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n }\n ...\n}\n" + pattern-sinks: + - patterns: + - pattern: $FACTORY.newDocumentBuilder(); + pattern-sanitizers: + - by-side-effect: true + pattern-either: + - patterns: + - pattern-either: + - pattern: '$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + + ' + - pattern: '$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); + + ... + + $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + + ' + - pattern: '$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + + ... + + $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); + + ' + - focus-metavariable: $FACTORY + - patterns: + - pattern-either: + - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\"\ + ,\n true);\n ...\n }\n ...\n}\n" + - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\"\ + , false);\n ...\n $FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n\ + \ ...\n }\n ...\n}\n" + - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\"\ + , false);\n ...\n $FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\",false);\n\ + \ ...\n }\n ...\n}\n" + - pattern: $M($X) + - focus-metavariable: $X + fix: '$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + + $FACTORY.newDocumentBuilder(); + + ' + languages: + - java +- id: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true + severity: ERROR + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://semgrep.dev/blog/2022/xml-security-in-java + - https://semgrep.dev/docs/cheat-sheets/java-xxe/ + - https://blog.sonarsource.com/secure-xml-processor + category: security + technology: + - java + - xml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true + shortlink: https://sg.run/JgPy + semgrep.dev: + rule: + r_id: 18246 + rv_id: 1263059 + rule_id: 9AUJ6r + version_id: qkTR7Lk + url: https://semgrep.dev/playground/r/qkTR7Lk/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true + origin: community + message: External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by + setting the feature "http://xml.org/sax/features/external-general-entities" to false. + pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities", true); + fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); + languages: + - java +- id: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true + severity: ERROR + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://semgrep.dev/blog/2022/xml-security-in-java + - https://semgrep.dev/docs/cheat-sheets/java-xxe/ + - https://blog.sonarsource.com/secure-xml-processor + category: security + technology: + - java + - xml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true + shortlink: https://sg.run/5Lv0 + semgrep.dev: + rule: + r_id: 18247 + rv_id: 1263060 + rule_id: yyUNeo + version_id: l4TJRoL + url: https://semgrep.dev/playground/r/l4TJRoL/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true + origin: community + message: External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by + setting the feature "http://xml.org/sax/features/external-parameter-entities" to false. + pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", true); + fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + languages: + - java +- id: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing + severity: ERROR + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://semgrep.dev/blog/2022/xml-security-in-java + - https://semgrep.dev/docs/cheat-sheets/java-xxe/ + - https://blog.sonarsource.com/secure-xml-processor + - https://xerces.apache.org/xerces2-j/features.html + category: security + technology: + - java + - xml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing + shortlink: https://sg.run/Gj32 + semgrep.dev: + rule: + r_id: 59048 + rv_id: 1263061 + rule_id: j2Udpk + version_id: YDTZeko + url: https://semgrep.dev/playground/r/YDTZeko/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing + origin: community + message: DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. + Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow + DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` + and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be + clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, + see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory. + mode: taint + pattern-sources: + - by-side-effect: true + patterns: + - pattern-either: + - pattern: '$FACTORY = SAXParserFactory.newInstance(); + + ' + - patterns: + - pattern: $FACTORY + - pattern-inside: "class $C {\n ...\n $V $FACTORY = SAXParserFactory.newInstance();\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = SAXParserFactory.newInstance();\n static {\n ...\n \ + \ $FACTORY.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n ...\n }\n ...\n\ + }\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = SAXParserFactory.newInstance();\n static {\n ...\n \ + \ $FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n $FACTORY.setFeature(\"\ + http://xml.org/sax/features/external-general-entities\", false);\n ...\n }\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = SAXParserFactory.newInstance();\n static {\n ...\n \ + \ $FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n ...\n $FACTORY.setFeature(\"\ + http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n }\n ...\n}\n" + pattern-sinks: + - patterns: + - pattern: $FACTORY.newSAXParser(); + pattern-sanitizers: + - by-side-effect: true + pattern-either: + - patterns: + - pattern-either: + - pattern: '$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + + ' + - pattern: '$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); + + ... + + $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + + ' + - pattern: '$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + + ... + + $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); + + ' + - focus-metavariable: $FACTORY + - patterns: + - pattern-either: + - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\"\ + ,\n true);\n ...\n }\n ...\n}\n" + - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\"\ + , false);\n ...\n $FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n\ + \ ...\n }\n ...\n}\n" + - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\"\ + , false);\n ...\n $FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\",false);\n\ + \ ...\n }\n ...\n}\n" + - pattern: $M($X) + - focus-metavariable: $X + fix: '$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + + $FACTORY.newSAXParser(); + + ' + languages: + - java +- id: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled + severity: ERROR + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://semgrep.dev/blog/2022/xml-security-in-java + - https://semgrep.dev/docs/cheat-sheets/java-xxe/ + - https://blog.sonarsource.com/secure-xml-processor + - https://xerces.apache.org/xerces2-j/features.html + category: security + technology: + - java + - xml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled + shortlink: https://sg.run/1wyQ + semgrep.dev: + rule: + r_id: 59622 + rv_id: 1263062 + rule_id: v8UeQ1 + version_id: 6xT29GK + url: https://semgrep.dev/playground/r/6xT29GK/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled + origin: community + message: DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. + Disable this by setting the attributes "accessExternalDTD" and "accessExternalStylesheet" to "". + mode: taint + pattern-sources: + - by-side-effect: true + patterns: + - pattern-either: + - pattern: '$FACTORY = TransformerFactory.newInstance(); + + ' + - patterns: + - pattern: $FACTORY + - pattern-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET,\ + \ \"\");\n ...\n }\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, \"\");\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD,\ + \ \"\");\n ...\n }\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setAttribute(\"=~/.*accessExternalDTD.*/\", \"\");\n ...\n $FACTORY.setAttribute(\"=~/.*accessExternalStylesheet.*/\"\ + , \"\");\n ...\n }\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setAttribute(\"=~/.*accessExternalStylesheet.*/\", \"\");\n ...\n $FACTORY.setAttribute(\"\ + =~/.*accessExternalDTD.*/\", \"\");\n ...\n }\n ...\n}\n" + pattern-sinks: + - patterns: + - pattern: $FACTORY.newTransformer(...); + pattern-sanitizers: + - by-side-effect: true + pattern-either: + - patterns: + - pattern-either: + - pattern: '$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ... + + $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); + + ' + - pattern: '$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); + + ... + + $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); + + ' + - pattern: '$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ... + + $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); + + ' + - pattern: '$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); + + ... + + $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); + + ' + - focus-metavariable: $FACTORY + - patterns: + - pattern-either: + - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET,\ + \ \"\");\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n ...\n }\n ...\n}\n" + - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD,\ + \ \"\");\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, \"\");\n ...\n }\n \ + \ ...\n}\n" + - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setAttribute(\"=~/.*accessExternalStylesheet.*/\"\ + , \"\");\n ...\n $FACTORY.setAttribute(\"=~/.*accessExternalDTD.*/\", \"\");\n ...\n }\n ...\n}\n" + - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setAttribute(\"=~/.*accessExternalDTD.*/\"\ + , \"\");\n ...\n $FACTORY.setAttribute(\"=~/.*accessExternalStylesheet.*/\", \"\");\n ...\n }\n ...\n\ + }\n" + - pattern: $M($X) + - focus-metavariable: $X + fix: '$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, + ""); + + $FACTORY.newTransformer(...); + + ' + languages: + - java +- id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal + metadata: + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN + references: + - https://www.owasp.org/index.php/Path_Traversal + category: security + technology: + - java + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal + shortlink: https://sg.run/oxXN + semgrep.dev: + rule: + r_id: 9160 + rv_id: 1263064 + rule_id: NbUk7X + version_id: zyTb2rq + url: https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal + origin: community + message: Detected a potential path traversal. A malicious actor could control the location of this file, to include going + backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. + You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve + the file name from the path. + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '(HttpServletRequest $REQ) + + ' + - patterns: + - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie\ + \ $COOKIE: $COOKIES) {\n ...\n}\n" + - pattern: '$COOKIE.getValue(...) + + ' + - patterns: + - pattern-inside: '$TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...); + + ... + + ' + - pattern: '$PARAM = $VALS[$INDEX]; + + ' + pattern-sanitizers: + - pattern: org.apache.commons.io.FilenameUtils.getName(...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '(java.io.File $FILE) = ... + + ' + - pattern: '(java.io.FileOutputStream $FOS) = ... + + ' + - pattern: 'new java.io.FileInputStream(...) + + ' + severity: ERROR + languages: + - java +- id: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization + severity: WARNING + languages: + - java + metadata: + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.3 Insecue Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf + category: security + technology: + - java + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization + shortlink: https://sg.run/zvO1 + semgrep.dev: + rule: + r_id: 9161 + rv_id: 1263065 + rule_id: kxUk12 + version_id: pZT03A1 + url: https://semgrep.dev/playground/r/pZT03A1/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization + origin: community + message: JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() + is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage + to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the + JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code + execution when calling the $Y.getObject method. + patterns: + - pattern-inside: "public class $JMS_LISTENER implements MessageListener {\n ...\n public void onMessage(Message $JMS_MSG)\ + \ {\n ...\n }\n}\n" + - pattern-either: + - pattern-inside: $X = $Y.getObject(...); + - pattern-inside: $X = ($Z) $Y.getObject(...); +- id: java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization + patterns: + - pattern-either: + - patterns: + - pattern-inside: 'ObjectMapper $OM = new ObjectMapper(...); + + ... + + ' + - pattern-inside: '$OM.enableDefaultTyping(); + + ... + + ' + - pattern: $OM.readValue($JSON, ...); + - patterns: + - pattern-inside: "class $CLASS {\n ...\n @JsonTypeInfo(use = Id.CLASS,...)\n $TYPE $VAR;\n ...\n}\n" + - metavariable-regex: + metavariable: $TYPE + regex: (Object|Serializable|Comparable) + - pattern: $OM.readValue($JSON, $CLASS.class); + - patterns: + - pattern-inside: "class $CLASS {\n ...\n ObjectMapper $OM;\n ...\n $INITMETHODTYPE $INITMETHOD(...) {\n ...\n\ + \ $OM = new ObjectMapper();\n ...\n $OM.enableDefaultTyping();\n ...\n }\n ...\n}\n" + - pattern-inside: "$METHODTYPE $METHOD(...) {\n ... \n}\n" + - pattern: $OM.readValue($JSON, ...); + message: When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead + to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit + unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using "Per-class" + annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes + for Jackson based deserialization. + languages: + - java + severity: WARNING + metadata: + category: security + subcategory: + - audit + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + confidence: MEDIUM + likelihood: LOW + impact: HIGH + owasp: + - A8:2017 Insecure Deserialization + - A8:2021 Software and Data Integrity Failures + references: + - https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038 + - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 + - https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/ + technology: + - jackson + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization + shortlink: https://sg.run/GDop + semgrep.dev: + rule: + r_id: 56948 + rv_id: 945724 + rule_id: QrUD20 + version_id: 2KTYbA9 + url: https://semgrep.dev/playground/r/2KTYbA9/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization + origin: community +- id: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss + message: 'Cross-site scripting detected in HttpServletResponse writer with variable ''$VAR''. User input was detected going + directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: + ''Encode.forHtml($VAR)''.' + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET + category: security + technology: + - java + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss + shortlink: https://sg.run/pxjN + semgrep.dev: + rule: + r_id: 9162 + rv_id: 1263066 + rule_id: wdUJOk + version_id: 2KTv2EG + url: https://semgrep.dev/playground/r/2KTv2EG/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss + origin: community + severity: ERROR + patterns: + - pattern-inside: $TYPE $FUNC(..., HttpServletResponse $RESP, ...) { ... } + - pattern-inside: $VAR = $REQ.getParameter(...); ... + - pattern-either: + - pattern: $RESP.getWriter(...).write(..., $VAR, ...); + - pattern: '$WRITER = $RESP.getWriter(...); + + ... + + $WRITER.write(..., $VAR, ...); + + ' + languages: + - java +- id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe + severity: WARNING + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://semgrep.dev/blog/2022/xml-security-in-java + - https://semgrep.dev/docs/cheat-sheets/java-xxe/ + - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf + - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser + category: security + technology: + - java + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe + shortlink: https://sg.run/XBwA + semgrep.dev: + rule: + r_id: 9164 + rv_id: 1263069 + rule_id: OrU35O + version_id: 1QTypQZ + url: https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe + origin: community + message: XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external + entity vulnerabilities. Explicitly disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" + to false. + patterns: + - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(\"javax.xml.stream.isSupportingExternalEntities\"\ + , false);\n ...\n}\n" + - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES,\ + \ false);\n ...\n}\n" + - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(\"javax.xml.stream.isSupportingExternalEntities\"\ + , Boolean.FALSE);\n ...\n}\n" + - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES,\ + \ Boolean.FALSE);\n ...\n}\n" + - pattern-either: + - pattern: javax.xml.stream.XMLInputFactory.newFactory(...) + - pattern: new XMLInputFactory(...) + languages: + - java +- id: java.spring.security.audit.spring-actuator-fully-enabled-yaml.spring-actuator-fully-enabled-yaml + patterns: + - pattern-inside: "management:\n ...\n endpoints:\n ...\n web:\n ...\n exposure:\n ...\n" + - pattern: 'include: "*" + + ' + message: Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, + /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this + functionality is available without authentication, causing a severe security risk. + severity: WARNING + languages: + - yaml + metadata: + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints + - https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785 + - https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators + category: security + technology: + - spring + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled-yaml.spring-actuator-fully-enabled-yaml + shortlink: https://sg.run/1Bzw + semgrep.dev: + rule: + r_id: 29422 + rv_id: 1263076 + rule_id: eqUerQ + version_id: w8TRo5n + url: https://semgrep.dev/playground/r/w8TRo5n/java.spring.security.audit.spring-actuator-fully-enabled-yaml.spring-actuator-fully-enabled-yaml + origin: community +- id: java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled + pattern: management.endpoints.web.exposure.include=* + message: Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, + /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this + functionality is available without authentication, causing a significant security risk. + severity: ERROR + languages: + - generic + paths: + include: + - '*properties' + metadata: + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints + - https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785 + - https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators + category: security + technology: + - spring + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled + shortlink: https://sg.run/L0vY + semgrep.dev: + rule: + r_id: 10439 + rv_id: 1263077 + rule_id: EwU4vg + version_id: xyTjzwp + url: https://semgrep.dev/playground/r/xyTjzwp/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled + origin: community +- id: java.spring.security.audit.spring-actuator-non-health-enabled-yaml.spring-actuator-dangerous-endpoints-enabled-yaml + patterns: + - pattern-inside: "management:\n ...\n endpoints:\n ...\n web:\n ...\n exposure:\n ...\n \ + \ include:\n ...\n" + - pattern: 'include: [..., $ACTUATOR, ...] + + ' + - metavariable-comparison: + metavariable: $ACTUATOR + comparison: not str($ACTUATOR) in ["health","*"] + message: Spring Boot Actuator "$ACTUATOR" is enabled. Depending on the actuator, this can pose a significant security risk. + Please double-check if the actuator is needed and properly secured. + severity: WARNING + languages: + - yaml + metadata: + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints + - https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785 + - https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators + category: security + technology: + - spring + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/java.spring.security.audit.spring-actuator-non-health-enabled-yaml.spring-actuator-dangerous-endpoints-enabled-yaml + shortlink: https://sg.run/JzKQ + semgrep.dev: + rule: + r_id: 32290 + rv_id: 1263078 + rule_id: kxUWpX + version_id: O9TpxBp + url: https://semgrep.dev/playground/r/O9TpxBp/java.spring.security.audit.spring-actuator-non-health-enabled-yaml.spring-actuator-dangerous-endpoints-enabled-yaml + origin: community +- id: java.spring.security.audit.spring-actuator-non-health-enabled.spring-actuator-dangerous-endpoints-enabled + patterns: + - pattern: management.endpoints.web.exposure.include=$...ACTUATORS + - metavariable-comparison: + metavariable: $...ACTUATORS + comparison: not str($...ACTUATORS) in ["health","*"] + message: Spring Boot Actuators "$...ACTUATORS" are enabled. Depending on the actuators, this can pose a significant security + risk. Please double-check if the actuators are needed and properly secured. + severity: WARNING + languages: + - generic + options: + generic_ellipsis_max_span: 0 + metadata: + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints + - https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785 + - https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators + category: security + technology: + - spring + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/java.spring.security.audit.spring-actuator-non-health-enabled.spring-actuator-dangerous-endpoints-enabled + shortlink: https://sg.run/5g23 + semgrep.dev: + rule: + r_id: 32291 + rv_id: 1263079 + rule_id: wdUWrZ + version_id: e1Tyjqe + url: https://semgrep.dev/playground/r/e1Tyjqe/java.spring.security.audit.spring-actuator-non-health-enabled.spring-actuator-dangerous-endpoints-enabled + origin: community +- id: java.spring.security.audit.spring-sqli.spring-sqli + mode: taint + pattern-sources: + - patterns: + - pattern: $ARG + - pattern-inside: 'public $T $M (..., String $ARG,...){...} + + ' + pattern-sanitizers: + - not_conflicting: true + pattern-either: + - patterns: + - focus-metavariable: $A + - pattern-inside: 'new $TYPE(...,$A,...); + + ' + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - focus-metavariable: $A + - pattern: 'new PreparedStatementCreatorFactory($A,...); + + ' + - patterns: + - focus-metavariable: $A + - pattern: '(JdbcTemplate $T).$M($A,...) + + ' + - patterns: + - pattern: (String $A) + - pattern-inside: '(JdbcTemplate $T).batchUpdate(...) + + ' + - patterns: + - focus-metavariable: $A + - pattern: 'NamedParameterBatchUpdateUtils.$M($A,...) + + ' + - patterns: + - focus-metavariable: $A + - pattern: 'BatchUpdateUtils.$M($A,...) + + ' + message: Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection + if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. + You can obtain a PreparedStatement using 'connection.prepareStatement'. + languages: + - java + severity: WARNING + options: + taint_assume_safe_numbers: true + taint_assume_safe_booleans: true + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + category: security + technology: + - spring + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli + shortlink: https://sg.run/1Z3x + semgrep.dev: + rule: + r_id: 9222 + rv_id: 1263082 + rule_id: eqU8N2 + version_id: ZRTKAWW + url: https://semgrep.dev/playground/r/ZRTKAWW/java.spring.security.audit.spring-sqli.spring-sqli + origin: community +- id: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect + message: Application redirects a user to a destination URL specified by a user supplied parameter that is not validated. + metadata: + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT + category: security + technology: + - spring + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect + shortlink: https://sg.run/9oXz + semgrep.dev: + rule: + r_id: 9223 + rv_id: 1263083 + rule_id: v8Un7w + version_id: nWT2Lk0 + url: https://semgrep.dev/playground/r/nWT2Lk0/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect + origin: community + severity: WARNING + languages: + - java + pattern-either: + - pattern: "$X $METHOD(...,String $URL,...) {\n return \"redirect:\" + $URL;\n}\n" + - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n String $REDIR = \"redirect:\" + $URL;\n ...\n return $REDIR;\n\ + \ ...\n}\n" + - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n new ModelAndView(\"redirect:\" + $URL);\n ...\n}\n" + - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n String $REDIR = \"redirect:\" + $URL;\n ...\n new ModelAndView($REDIR);\n\ + \ ...\n}" +- id: java.spring.security.injection.tainted-file-path.tainted-file-path + languages: + - java + severity: ERROR + message: Detected user input controlling a file path. An attacker could control the location of this file, to include going + backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. + You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve + the file name from the path. + options: + interfile: true + metadata: + cwe: + - 'CWE-23: Relative Path Traversal' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/www-community/attacks/Path_Traversal + category: security + technology: + - java + - spring + subcategory: + - vuln + impact: HIGH + likelihood: MEDIUM + confidence: HIGH + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path + shortlink: https://sg.run/x9o0 + semgrep.dev: + rule: + r_id: 22074 + rv_id: 1263084 + rule_id: lBUxok + version_id: ExTEx6Y + url: https://semgrep.dev/playground/r/ExTEx6Y/java.spring.security.injection.tainted-file-path.tainted-file-path + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {\n ...\n}\n" + - pattern-inside: "$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {\n ...\n}\n" + - metavariable-regex: + metavariable: $TYPE + regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) + - metavariable-regex: + metavariable: $REQ + regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) + - focus-metavariable: $SOURCE + pattern-sinks: + - patterns: + - pattern-either: + - pattern: new File(...) + - pattern: new java.io.File(...) + - pattern: new FileReader(...) + - pattern: new java.io.FileReader(...) + - pattern: new FileInputStream(...) + - pattern: new java.io.FileInputStream(...) + - pattern: (Paths $PATHS).get(...) + - patterns: + - pattern: '$CLASS.$FUNC(...) + + ' + - metavariable-regex: + metavariable: $FUNC + regex: ^(getResourceAsStream|getResource)$ + - patterns: + - pattern-either: + - pattern: new ClassPathResource($FILE, ...) + - pattern: ResourceUtils.getFile($FILE, ...) + - pattern: new FileOutputStream($FILE, ...) + - pattern: new java.io.FileOutputStream($FILE, ...) + - pattern: new StreamSource($FILE, ...) + - pattern: new javax.xml.transform.StreamSource($FILE, ...) + - pattern: FileUtils.openOutputStream($FILE, ...) + - focus-metavariable: $FILE + pattern-sanitizers: + - pattern: org.apache.commons.io.FilenameUtils.getName(...) +- id: java.spring.security.injection.tainted-html-string.tainted-html-string + languages: + - java + severity: ERROR + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use + the OWASP ESAPI encoder if you must render user data. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + category: security + technology: + - java + - spring + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string + shortlink: https://sg.run/ObdR + semgrep.dev: + rule: + r_id: 22075 + rv_id: 1409395 + rule_id: YGUvkL + version_id: 3ZT2598 + url: https://semgrep.dev/playground/r/3ZT2598/java.spring.security.injection.tainted-html-string.tainted-html-string + origin: community + mode: taint + pattern-sources: + - label: INPUT + patterns: + - pattern-either: + - pattern-inside: "$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {\n ...\n}\n" + - pattern-inside: "$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {\n ...\n}\n" + - metavariable-regex: + metavariable: $TYPE + regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) + - metavariable-regex: + metavariable: $REQ + regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) + - focus-metavariable: $SOURCE + - label: CONCAT + by-side-effect: true + requires: INPUT + patterns: + - pattern-either: + - pattern: '"$HTMLSTR" + ... + + ' + - pattern: '"$HTMLSTR".concat(...) + + ' + - patterns: + - pattern-inside: 'StringBuilder $SB = new StringBuilder("$HTMLSTR"); + + ... + + ' + - pattern: $SB.append(...) + - patterns: + - pattern-inside: '$VAR = "$HTMLSTR"; + + ... + + ' + - pattern: $VAR += ... + - pattern: String.format("$HTMLSTR", ...) + - patterns: + - pattern-inside: 'String $VAR = "$HTMLSTR"; + + ... + + ' + - pattern: String.format($VAR, ...) + - metavariable-regex: + metavariable: $HTMLSTR + regex: ^<\w+ + pattern-propagators: + - pattern: (StringBuilder $SB).append($...TAINTED) + from: $...TAINTED + to: $SB + - pattern: $VAR += $...TAINTED + from: $...TAINTED + to: $VAR + pattern-sinks: + - requires: CONCAT + patterns: + - pattern-either: + - pattern: new ResponseEntity<>($PAYLOAD, ...) + - pattern: new ResponseEntity<$ERROR>($PAYLOAD, ...) + - pattern: ResponseEntity. ... .body($PAYLOAD) + - patterns: + - pattern: 'ResponseEntity.$RESPFUNC($PAYLOAD). ... + + ' + - metavariable-regex: + metavariable: $RESPFUNC + regex: ^(ok|of)$ + - focus-metavariable: $PAYLOAD + pattern-sanitizers: + - pattern-either: + - pattern: Encode.forHtml(...) + - pattern: (PolicyFactory $POLICY).sanitize(...) + - pattern: (AntiSamy $AS).scan(...) + - pattern: JSoup.clean(...) +- id: java.spring.security.injection.tainted-sql-string.tainted-sql-string + languages: + - java + severity: ERROR + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using + prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of + SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements + (`connection.PreparedStatement`) or a safe library. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html + category: security + technology: + - spring + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/9rzz + semgrep.dev: + rule: + r_id: 14767 + rv_id: 1409396 + rule_id: 10UdRR + version_id: 44TbKvr + url: https://semgrep.dev/playground/r/44TbKvr/java.spring.security.injection.tainted-sql-string.tainted-sql-string + origin: community + options: + taint_assume_safe_numbers: true + taint_assume_safe_booleans: true + interfile: true + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {\n ...\n}\n" + - pattern-inside: "$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {\n ...\n}\n" + - metavariable-regex: + metavariable: $REQ + regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue) + - metavariable-regex: + metavariable: $TYPE + regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) + - focus-metavariable: $SOURCE + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '"$SQLSTR" + ... + + ' + - pattern: '"$SQLSTR".concat(...) + + ' + - patterns: + - pattern-inside: 'StringBuilder $SB = new StringBuilder("$SQLSTR"); + + ... + + ' + - pattern: $SB.append(...) + - patterns: + - pattern-inside: '$VAR = "$SQLSTR"; + + ... + + ' + - pattern: $VAR += ... + - pattern: String.format("$SQLSTR", ...) + - patterns: + - pattern-inside: 'String $VAR = "$SQLSTR"; + + ... + + ' + - pattern: String.format($VAR, ...) + - pattern-not-inside: System.out.println(...) + - pattern-not-inside: $LOG.info(...) + - pattern-not-inside: $LOG.warn(...) + - pattern-not-inside: $LOG.warning(...) + - pattern-not-inside: $LOG.debug(...) + - pattern-not-inside: $LOG.debugging(...) + - pattern-not-inside: $LOG.error(...) + - pattern-not-inside: new Exception(...) + - pattern-not-inside: throw ...; + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(select|delete|insert|create|update|alter|drop)\b +- id: java.spring.security.injection.tainted-system-command.tainted-system-command + languages: + - java + severity: ERROR + mode: taint + pattern-propagators: + - pattern: (StringBuilder $STRB).append($INPUT) + from: $INPUT + to: $STRB + label: CONCAT + requires: INPUT + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {\n ...\n}\n" + - pattern-inside: "$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {\n ...\n}\n" + - metavariable-regex: + metavariable: $TYPE + regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) + - metavariable-regex: + metavariable: $REQ + regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) + - focus-metavariable: $SOURCE + label: INPUT + - patterns: + - pattern-either: + - pattern: $X + $SOURCE + - pattern: $SOURCE + $Y + - pattern: String.format("...", ..., $SOURCE, ...) + - pattern: String.join("...", ..., $SOURCE, ...) + - pattern: (String $STR).concat($SOURCE) + - pattern: $SOURCE.concat(...) + - pattern: $X += $SOURCE + - pattern: $SOURCE += $X + label: CONCAT + requires: INPUT + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '(Process $P) = new Process(...); + + ' + - pattern: '(ProcessBuilder $PB).command(...); + + ' + - patterns: + - pattern-either: + - pattern: '(Runtime $R).$EXEC(...); + + ' + - pattern: 'Runtime.getRuntime(...).$EXEC(...); + + ' + - metavariable-regex: + metavariable: $EXEC + regex: (exec|loadLibrary|load) + - patterns: + - pattern: '(ProcessBuilder $PB).command(...).$ADD(...); + + ' + - metavariable-regex: + metavariable: $ADD + regex: (add|addAll) + - patterns: + - pattern-either: + - patterns: + - pattern-inside: '$BUILDER = new ProcessBuilder(...); + + ... + + ' + - pattern: $BUILDER.start(...) + - pattern: 'new ProcessBuilder(...). ... .start(...); + + ' + requires: CONCAT + message: 'Detected user input entering a method which executes a system command. This could result in a command injection + vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download + malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, + like this: `new ProcessBuilder("ls", "-al", targetDirectory)`. Further, make sure you hardcode or allowlist the actual + command so that attackers can''t run arbitrary commands.' + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - java + - spring + confidence: HIGH + references: + - https://www.stackhawk.com/blog/command-injection-java/ + - https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html + - https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command + shortlink: https://sg.run/epY0 + semgrep.dev: + rule: + r_id: 22076 + rv_id: 1263087 + rule_id: 6JUxGN + version_id: 8KT5rnP + url: https://semgrep.dev/playground/r/8KT5rnP/java.spring.security.injection.tainted-system-command.tainted-system-command + origin: community +- id: java.spring.security.injection.tainted-url-host.tainted-url-host + languages: + - java + severity: ERROR + message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data + to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. + They could also probe internal servers or other resources that the server running this code can access. (This is called + server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, + hardcode the correct host, or ensure that the user data can only affect the path or parameters. + options: + interfile: true + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html + category: security + technology: + - java + - spring + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host + shortlink: https://sg.run/vkYn + semgrep.dev: + rule: + r_id: 22077 + rv_id: 1263088 + rule_id: oqUZo8 + version_id: gETB708 + url: https://semgrep.dev/playground/r/gETB708/java.spring.security.injection.tainted-url-host.tainted-url-host + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {\n ...\n}\n" + - pattern-inside: "$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {\n ...\n}\n" + - metavariable-regex: + metavariable: $TYPE + regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) + - metavariable-regex: + metavariable: $REQ + regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) + - focus-metavariable: $SOURCE + pattern-sinks: + - pattern-either: + - pattern: new URL($ONEARG) + - patterns: + - pattern-either: + - pattern: '"$URLSTR" + ... + + ' + - pattern: '"$URLSTR".concat(...) + + ' + - patterns: + - pattern-inside: 'StringBuilder $SB = new StringBuilder("$URLSTR"); + + ... + + ' + - pattern: $SB.append(...) + - patterns: + - pattern-inside: '$VAR = "$URLSTR"; + + ... + + ' + - pattern: $VAR += ... + - patterns: + - pattern: String.format("$URLSTR", ...) + - pattern-not: String.format("$URLSTR", "...", ...) + - patterns: + - pattern-inside: 'String $VAR = "$URLSTR"; + + ... + + ' + - pattern: String.format($VAR, ...) + - metavariable-regex: + metavariable: $URLSTR + regex: http(s?)://%(v|s|q).* +- id: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint + message: Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It + is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved + it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize. + metadata: + confidence: MEDIUM + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + references: + - https://docs.angularjs.org/api/ng/function/angular.element + - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf + category: security + technology: + - angularjs + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint + shortlink: https://sg.run/5AQ0 + semgrep.dev: + rule: + r_id: 21503 + rv_id: 1263091 + rule_id: GdUP71 + version_id: 44TEj8L + url: https://semgrep.dev/playground/r/44TEj8L/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: window.location.search + - pattern: window.document.location.search + - pattern: document.location.search + - pattern: location.search + - pattern: $location.search(...) + - patterns: + - pattern-either: + - pattern: $DECODE(<... location.hash ...>) + - pattern: $DECODE(<... window.location.hash ...>) + - pattern: $DECODE(<... document.location.hash ...>) + - pattern: $DECODE(<... location.href ...>) + - pattern: $DECODE(<... window.location.href ...>) + - pattern: $DECODE(<... document.location.href ...>) + - pattern: $DECODE(<... document.URL ...>) + - pattern: $DECODE(<... window.document.URL ...>) + - pattern: $DECODE(<... document.location.href ...>) + - pattern: $DECODE(<... document.location.href ...>) + - pattern: $DECODE(<... $location.absUrl() ...>) + - pattern: $DECODE(<... $location.url() ...>) + - pattern: $DECODE(<... $location.hash() ...>) + - metavariable-regex: + metavariable: $DECODE + regex: ^(unescape|decodeURI|decodeURIComponent)$ + - patterns: + - pattern-inside: $http.$METHOD(...).$CONTINUE(function $FUNC($RES) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|delete|head|jsonp|post|put|patch) + - pattern: $RES.data + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: 'angular.element(...). ... .$SINK($QUERY) + + ' + - pattern-inside: '$ANGULAR = angular.element(...) + + ... + + $ANGULAR. ... .$SINK($QUERY) + + ' + - metavariable-regex: + metavariable: $SINK + regex: ^(after|append|html|prepend|replaceWith|wrap)$ + - focus-metavariable: $QUERY + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern: $sce.getTrustedHtml(...) + - pattern: $sanitize(...) + - pattern: DOMPurify.sanitize(...) +- id: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled + message: $sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide + additional attack surface for XSS vulnerabilities. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + references: + - https://docs.angularjs.org/api/ng/service/$sce + - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf + category: security + technology: + - angular + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled + shortlink: https://sg.run/N4DG + semgrep.dev: + rule: + r_id: 9227 + rv_id: 1263094 + rule_id: EwU20Z + version_id: 5PTo1EW + url: https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled + origin: community + languages: + - javascript + - typescript + severity: ERROR + pattern: '$sceProvider.enabled(false); + + ' +- id: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method + message: The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API. + metadata: + references: + - https://docs.angularjs.org/api/ng/service/$sce + - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf + category: security + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + technology: + - angular + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method + shortlink: https://sg.run/OPW2 + semgrep.dev: + rule: + r_id: 9231 + rv_id: 1263098 + rule_id: gxU1QX + version_id: BjTkZv0 + url: https://semgrep.dev/playground/r/BjTkZv0/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-inside: 'app.controller(..., function($scope,$sce) { + + ... + + }); + + ' + - pattern: $scope.$X + pattern-sinks: + - pattern: $sce.trustAs(...) + - pattern: $sce.trustAsHtml(...) +- id: javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config + message: Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee + an adversary has no direct access to the computing environment. + metadata: + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html + - https://eprint.iacr.org/2016/759.pdf + - https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf + - https://datatracker.ietf.org/doc/html/rfc9106#section-4 + category: security + cwe: + - 'CWE-916: Use of Password Hash With Insufficient Computational Effort' + technology: + - argon2 + - cryptography + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + impact: LOW + likelihood: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config + shortlink: https://sg.run/ALq4 + semgrep.dev: + rule: + r_id: 20150 + rv_id: 1263103 + rule_id: DbU2X8 + version_id: qkTR7Jk + url: https://semgrep.dev/playground/r/qkTR7Jk/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-inside: '$ARGON = require(''argon2''); + + ... + + ' + - pattern: '{type: ...} + + ' + pattern-sinks: + - patterns: + - pattern: '$Y + + ' + - pattern-inside: '$ARGON.hash(...,$Y) + + ' + pattern-sanitizers: + - patterns: + - pattern: '{type: $ARGON.argon2id}' +- id: javascript.aws-lambda.security.detect-child-process.detect-child-process + message: Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command + injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let + running arbitrary commands, use a white list for inputs. + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - javascript + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process + shortlink: https://sg.run/Ggoq + semgrep.dev: + rule: + r_id: 18248 + rv_id: 1263105 + rule_id: r6UDNQ + version_id: YDTZe4o + url: https://semgrep.dev/playground/r/YDTZe4o/javascript.aws-lambda.security.detect-child-process.detect-child-process + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern: $EVENT + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + pattern-sinks: + - patterns: + - focus-metavariable: $CMD + - pattern-either: + - pattern: exec($CMD,...) + - pattern: execSync($CMD,...) + - pattern: spawn($CMD,...) + - pattern: spawnSync($CMD,...) + - pattern: $CP.exec($CMD,...) + - pattern: $CP.execSync($CMD,...) + - pattern: $CP.spawn($CMD,...) + - pattern: $CP.spawnSync($CMD,...) + - pattern-either: + - pattern-inside: 'require(''child_process'') + + ... + + ' + - pattern-inside: 'import ''child_process'' + + ... + + ' +- id: javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object + message: Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable + is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly + to DynamoDB client. + metadata: + cwe: + - 'CWE-943: Improper Neutralization of Special Elements in Data Query Logic' + owasp: + - A01:2017 - Injection + category: security + technology: + - javascript + - aws-lambda + - dynamodb + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object + shortlink: https://sg.run/X1e4 + semgrep.dev: + rule: + r_id: 21320 + rv_id: 945766 + rule_id: 0oU1xk + version_id: GxTP7gN + url: https://semgrep.dev/playground/r/GxTP7gN/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern: $EVENT + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern: '$DC.$METHOD($SINK, ...) + + ' + - metavariable-regex: + metavariable: $METHOD + regex: (query|send|scan|delete|put|transactWrite|update|batchExecuteStatement|executeStatement|executeTransaction|transactWriteItems) + - pattern-either: + - pattern-inside: '$DC = new $AWS.DocumentClient(...); + + ... + + ' + - pattern-inside: '$DC = new $AWS.DynamoDB(...); + + ... + + ' + - pattern-inside: '$DC = new DynamoDBClient(...); + + ... + + ' + - pattern-inside: '$DC = DynamoDBDocumentClient.from(...); + + ... + + ' + pattern-sanitizers: + - patterns: + - pattern: '{...} + + ' +- id: javascript.aws-lambda.security.knex-sqli.knex-sqli + message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `knex.raw(''SELECT $1 from table'', [userinput])`' + metadata: + references: + - https://knexjs.org/#Builder-fromRaw + - https://knexjs.org/#Builder-whereRaw + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - knex + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli + shortlink: https://sg.run/RgWq + semgrep.dev: + rule: + r_id: 18249 + rv_id: 1263106 + rule_id: bwUBlj + version_id: JdTzxKg + url: https://semgrep.dev/playground/r/JdTzxKg/javascript.aws-lambda.security.knex-sqli.knex-sqli + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern: $EVENT + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $KNEX.fromRaw($QUERY, ...) + - pattern: $KNEX.whereRaw($QUERY, ...) + - pattern: $KNEX.raw($QUERY, ...) + - pattern-either: + - pattern-inside: 'require(''knex'') + + ... + + ' + - pattern-inside: 'import ''knex'' + + ... + + ' +- id: javascript.aws-lambda.security.mysql-sqli.mysql-sqli + message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `connection.query(''SELECT $1 from table'', [userinput])`' + metadata: + references: + - https://www.npmjs.com/package/mysql2 + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - mysql + - mysql2 + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli + shortlink: https://sg.run/A502 + semgrep.dev: + rule: + r_id: 18250 + rv_id: 1263107 + rule_id: NbUBJ2 + version_id: 5PTo1En + url: https://semgrep.dev/playground/r/5PTo1En/javascript.aws-lambda.security.mysql-sqli.mysql-sqli + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern: $EVENT + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $POOL.query($QUERY, ...) + - pattern: $POOL.execute($QUERY, ...) + - pattern-either: + - pattern-inside: 'require(''mysql'') + + ... + + ' + - pattern-inside: 'require(''mysql2'') + + ... + + ' + - pattern-inside: 'require(''mysql2/promise'') + + ... + + ' + - pattern-inside: 'import ''mysql'' + + ... + + ' + - pattern-inside: 'import ''mysql2'' + + ... + + ' + - pattern-inside: 'import ''mysql2/promise'' + + ... + + ' +- id: javascript.aws-lambda.security.pg-sqli.pg-sqli + message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `connection.query(''SELECT $1 from table'', [userinput])`' + metadata: + references: + - https://node-postgres.com/features/queries + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - postgres + - pg + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli + shortlink: https://sg.run/BGKA + semgrep.dev: + rule: + r_id: 18251 + rv_id: 1263108 + rule_id: kxU25P + version_id: GxTkeJL + url: https://semgrep.dev/playground/r/GxTkeJL/javascript.aws-lambda.security.pg-sqli.pg-sqli + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern: $EVENT + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $DB.query($QUERY, ...) + - pattern-either: + - pattern-inside: 'require(''pg'') + + ... + + ' + - pattern-inside: 'import ''pg'' + + ... + + ' +- id: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli + message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `sequelize.query(''SELECT * FROM projects WHERE status = ?'', { + replacements: [''active''], type: QueryTypes.SELECT });`' + metadata: + references: + - https://sequelize.org/master/manual/raw-queries.html + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - sequelize + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli + shortlink: https://sg.run/DAlP + semgrep.dev: + rule: + r_id: 18252 + rv_id: 1263109 + rule_id: wdUA5o + version_id: RGT0LrD + url: https://semgrep.dev/playground/r/RGT0LrD/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern: $EVENT + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $DB.query($QUERY, ...) + - pattern-either: + - pattern-inside: 'require(''sequelize'') + + ... + + ' + - pattern-inside: 'import ''sequelize'' + + ... + + ' +- id: javascript.aws-lambda.security.tainted-html-response.tainted-html-response + message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering + HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers + steal sensitive user data. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response + shortlink: https://sg.run/0Gvj + semgrep.dev: + rule: + r_id: 18254 + rv_id: 1263111 + rule_id: OrUJBY + version_id: BjTkZ8D + url: https://semgrep.dev/playground/r/BjTkZ8D/javascript.aws-lambda.security.tainted-html-response.tainted-html-response + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern: $EVENT + pattern-sinks: + - patterns: + - focus-metavariable: $BODY + - pattern-inside: '{..., headers: {..., ''Content-Type'': ''text/html'', ...}, body: $BODY, ... } + + ' +- id: javascript.aws-lambda.security.tainted-html-string.tainted-html-string + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use + templates which will safely render HTML instead. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string + shortlink: https://sg.run/Lgqr + semgrep.dev: + rule: + r_id: 18483 + rv_id: 1263112 + rule_id: PeUxwW + version_id: DkTRbvp + url: https://semgrep.dev/playground/r/DkTRbvp/javascript.aws-lambda.security.tainted-html-string.tainted-html-string + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern: $EVENT + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$HTMLSTR" + $EXPR + + ' + - pattern: '"$HTMLSTR".concat(...) + + ' + - pattern: $UTIL.format($HTMLSTR, ...) + - pattern: format($HTMLSTR, ...) + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... + - patterns: + - pattern: '`...${...}...` + + ' + - pattern-regex: '.*<\w+.* + + ' + - pattern-not-inside: 'console.$LOG(...) + + ' +- id: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection + message: The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a + security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input + it could result in command injection. Do not let user input in `vm` functions. + metadata: + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + category: security + technology: + - javascript + - aws-lambda + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection + shortlink: https://sg.run/q9w7 + semgrep.dev: + rule: + r_id: 18256 + rv_id: 1263114 + rule_id: v8UOdZ + version_id: 0bTKz9J + url: https://semgrep.dev/playground/r/0bTKz9J/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern: $EVENT + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: 'function $FUNC ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + - pattern-inside: '$FUNC = function ($EVENT, ...) {...} + + ... + + exports.handler = $FUNC + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: 'require(''vm''); + + ... + + ' + - pattern-inside: 'import ''vm'' + + ... + + ' + - pattern-either: + - pattern: $VM.runInContext($X,...) + - pattern: $VM.runInNewContext($X,...) + - pattern: $VM.runInThisContext($X,...) + - pattern: $VM.compileFunction($X,...) + - pattern: new $VM.Script($X,...) + - pattern: new $VM.SourceTextModule($X,...) + - pattern: runInContext($X,...) + - pattern: runInNewContext($X,...) + - pattern: runInThisContext($X,...) + - pattern: compileFunction($X,...) + - pattern: new Script($X,...) + - pattern: new SourceTextModule($X,...) +- id: javascript.browser.security.open-redirect.js-open-redirect + message: The application accepts potentially user-controlled input `$PROP` which can control the location of the current + window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript + URIs. It is recommended to validate user-controllable input before allowing it to control the redirection. + options: + interfile: true + metadata: + interfile: true + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.1 Insecue Redirect + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation + version: '4' + category: security + confidence: HIGH + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html + technology: + - browser + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect + shortlink: https://sg.run/3xRe + semgrep.dev: + rule: + r_id: 9243 + rv_id: 1263122 + rule_id: WAUopl + version_id: pZT03x0 + url: https://semgrep.dev/playground/r/pZT03x0/javascript.browser.security.open-redirect.js-open-redirect + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: 'new URLSearchParams($WINDOW. ... .location.search).get(''...'') + + ' + - pattern: 'new URLSearchParams(location.search).get(''...'') + + ' + - pattern: 'new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get(''...'') + + ' + - pattern: 'new URLSearchParams(location.hash.substring(1)).get(''...'') + + ' + - patterns: + - pattern-either: + - pattern-inside: '$PROPS = new URLSearchParams($WINDOW. ... .location.search) + + ... + + ' + - pattern-inside: '$PROPS = new URLSearchParams(location.search) + + ... + + ' + - pattern-inside: '$PROPS = new URLSearchParams($WINDOW. ... .location.hash.substring(1)) + + ... + + ' + - pattern-inside: '$PROPS = new URLSearchParams(location.hash.substring(1)) + + ... + + ' + - pattern: $PROPS.get('...') + - patterns: + - pattern-either: + - pattern-inside: '$PROPS = new URL($WINDOW. ... .location.href) + + ... + + ' + - pattern-inside: '$PROPS = new URL(location.href) + + ... + + ' + - pattern: $PROPS.searchParams.get('...') + - patterns: + - pattern-either: + - pattern: 'new URL($WINDOW. ... .location.href).searchParams.get(''...'') + + ' + - pattern: 'new URL(location.href).searchParams.get(''...'') + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern: location.href = $SINK + - pattern: $THIS. ... .location.href = $SINK + - pattern: location.replace($SINK) + - pattern: $THIS. ... .location.replace($SINK) + - pattern: location = $SINK + - pattern: $WINDOW. ... .location = $SINK + - focus-metavariable: $SINK + - metavariable-pattern: + patterns: + - pattern-not: '"..." + $VALUE + + ' + - pattern-not: '`...${$VALUE}` + + ' + metavariable: $SINK +- id: javascript.browser.security.raw-html-concat.raw-html-concat + message: User controlled data in a HTML string may result in XSS + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/xss/ + category: security + technology: + - browser + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat + shortlink: https://sg.run/4xAx + semgrep.dev: + rule: + r_id: 9244 + rv_id: 1263123 + rule_id: 0oU5b5 + version_id: 2KTv2wp + url: https://semgrep.dev/playground/r/2KTv2wp/javascript.browser.security.raw-html-concat.raw-html-concat + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: location.href + - pattern: location.hash + - pattern: location.search + - pattern: $WINDOW. ... .location.href + - pattern: $WINDOW. ... .location.hash + - pattern: $WINDOW. ... .location.search + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: $STRING + $EXPR + - pattern-not: $STRING + "..." + - metavariable-pattern: + patterns: + - pattern: <$TAG ... + - pattern-not: <$TAG ...>...... + metavariable: $STRING + language: generic + - patterns: + - pattern: $EXPR + $STRING + - pattern-not: '"..." + $STRING' + - metavariable-pattern: + patterns: + - pattern: '... ,...) + - pattern-not-inside: '$OPTS = <... {name:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.name = ...; + + ... + + $SESSION($OPTS,...); + + ' +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain + message: 'Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare + against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.' + severity: WARNING + languages: + - javascript + - typescript + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + category: security + technology: + - express + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: LOW + confidence: MEDIUM + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain + shortlink: https://sg.run/rd41 + semgrep.dev: + rule: + r_id: 9269 + rv_id: 1263133 + rule_id: ZqU5Pn + version_id: w8TRoyd + url: https://semgrep.dev/playground/r/w8TRoyd/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain + origin: community + patterns: + - pattern-either: + - pattern-inside: '$SESSION = require(''cookie-session''); + + ... + + ' + - pattern-inside: '$SESSION = require(''express-session''); + + ... + + ' + - pattern: $SESSION(...) + - pattern-not-inside: $SESSION(<... {cookie:{domain:...}} ...>,...) + - pattern-not-inside: '$OPTS = <... {cookie:{domain:...}} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE = <... {domain:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie = <... {domain:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE.domain = ...; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie.domain = ...; + + ... + + $SESSION($OPTS,...); + + ' +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires + message: 'Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.' + severity: WARNING + languages: + - javascript + - typescript + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + category: security + technology: + - express + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: LOW + confidence: MEDIUM + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires + shortlink: https://sg.run/N4eG + semgrep.dev: + rule: + r_id: 9271 + rv_id: 1263135 + rule_id: EwU2DZ + version_id: O9TpxRq + url: https://semgrep.dev/playground/r/O9TpxRq/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires + origin: community + patterns: + - pattern-either: + - pattern-inside: '$SESSION = require(''cookie-session''); + + ... + + ' + - pattern-inside: '$SESSION = require(''express-session''); + + ... + + ' + - pattern: $SESSION(...) + - pattern-not-inside: $SESSION(<... {cookie:{expires:...}} ...>,...) + - pattern-not-inside: '$OPTS = <... {cookie:{expires:...}} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE = <... {expires:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie = <... {expires:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE.expires = ...; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie.expires = ...; + + ... + + $SESSION($OPTS,...);' +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly + message: 'Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not + client JavaScript, helping to protect against cross-site scripting attacks.' + severity: WARNING + languages: + - javascript + - typescript + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + category: security + technology: + - express + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: LOW + confidence: MEDIUM + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly + shortlink: https://sg.run/ydBO + semgrep.dev: + rule: + r_id: 9268 + rv_id: 1263132 + rule_id: d8UjGo + version_id: kbTzGev + url: https://semgrep.dev/playground/r/kbTzGev/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly + origin: community + patterns: + - pattern-either: + - pattern-inside: '$SESSION = require(''cookie-session''); + + ... + + ' + - pattern-inside: '$SESSION = require(''express-session''); + + ... + + ' + - pattern: $SESSION(...) + - pattern-not-inside: $SESSION(<... {cookie:{httpOnly:true}} ...>,...) + - pattern-not-inside: '$OPTS = <... {cookie:{httpOnly:true}} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE = <... {httpOnly:true} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie = <... {httpOnly:true} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE.httpOnly = true; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie.httpOnly = true; + + ... + + $SESSION($OPTS,...); + + ' +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path + message: 'Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against + the request path. If this and domain match, then send the cookie in the request.' + severity: WARNING + languages: + - javascript + - typescript + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + category: security + technology: + - express + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: LOW + confidence: MEDIUM + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path + shortlink: https://sg.run/b7pd + semgrep.dev: + rule: + r_id: 9270 + rv_id: 1263134 + rule_id: nJUz4X + version_id: xyTjzQD + url: https://semgrep.dev/playground/r/xyTjzQD/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path + origin: community + patterns: + - pattern-either: + - pattern-inside: '$SESSION = require(''cookie-session''); + + ... + + ' + - pattern-inside: '$SESSION = require(''express-session''); + + ... + + ' + - pattern: $SESSION(...) + - pattern-not-inside: $SESSION(<... {cookie:{path:...}} ...>,...) + - pattern-not-inside: '$OPTS = <... {cookie:{path:...}} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE = <... {path:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie = <... {path:...} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE.path = ...; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie.path = ...; + + ... + + $SESSION($OPTS,...); + + ' +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure + message: 'Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.' + severity: WARNING + languages: + - javascript + - typescript + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + category: security + technology: + - express + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: LOW + confidence: MEDIUM + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure + shortlink: https://sg.run/9oKz + semgrep.dev: + rule: + r_id: 9267 + rv_id: 1263131 + rule_id: v8Unzw + version_id: NdTzyrv + url: https://semgrep.dev/playground/r/NdTzyrv/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure + origin: community + patterns: + - pattern-either: + - pattern-inside: '$SESSION = require(''cookie-session''); + + ... + + ' + - pattern-inside: '$SESSION = require(''express-session''); + + ... + + ' + - pattern: $SESSION(...) + - pattern-not-inside: $SESSION(<... {cookie:{secure:true}} ...>,...) + - pattern-not-inside: '$OPTS = <... {cookie:{secure:true}} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE = <... {secure:true} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie = <... {secure:true} ...>; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $COOKIE.secure = true; + + ... + + $SESSION($OPTS,...); + + ' + - pattern-not-inside: '$OPTS = ...; + + ... + + $OPTS.cookie.secure = true; + + ... + + $SESSION($OPTS,...); + + ' +- id: javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked + message: No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider + using function as the `isRevoked` option. + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://github.com/goldbergyoni/nodebestpractices/blob/master/sections/security/expirejwt.md + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.3 Insecure Stateless Session Tokens + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - express + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked + shortlink: https://sg.run/kXNo + semgrep.dev: + rule: + r_id: 9272 + rv_id: 1263137 + rule_id: 7KUQ9k + version_id: vdT06Bg + url: https://semgrep.dev/playground/r/vdT06Bg/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked + origin: community + languages: + - javascript + - typescript + severity: WARNING + patterns: + - pattern-inside: '$JWT = require(''express-jwt''); + + ... + + ' + - pattern: $JWT(...) + - pattern-not-inside: $JWT(<... {isRevoked:...} ...>,...) + - pattern-not-inside: '$OPTS = <... {isRevoked:...} ...>; + + ... + + $JWT($OPTS,...);' +- id: javascript.express.security.audit.express-libxml-noent.express-libxml-noent + message: The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable + to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure + you are protected. + options: + interfile: true + metadata: + interfile: true + references: + - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html + technology: + - express + category: security + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent + shortlink: https://sg.run/Z75x + semgrep.dev: + rule: + r_id: 22079 + rv_id: 1263138 + rule_id: pKUNeD + version_id: d6TyxpX + url: https://semgrep.dev/playground/r/d6TyxpX/javascript.express.security.audit.express-libxml-noent.express-libxml-noent + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - pattern: $REQ.files.$ANYTHING.data.toString('utf8') + - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - pattern: files.$ANYTHING.data.toString('utf8') + - pattern: files.$ANYTHING['data'].toString('utf8') + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: '$XML = require(''$IMPORT'') + + ... + + ' + - pattern-inside: "import $XML from '$IMPORT'\n ...\n" + - pattern-inside: 'import * as $XML from ''$IMPORT'' + + ... + + ' + - metavariable-regex: + metavariable: $IMPORT + regex: ^(libxmljs|libxmljs2)$ + - pattern-inside: $XML.$FUNC($QUERY, {...,noent:true,...}) + - metavariable-regex: + metavariable: $FUNC + regex: ^(parseXmlString|parseXml)$ + - focus-metavariable: $QUERY +- id: javascript.express.security.audit.express-open-redirect.express-open-redirect + message: The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect + users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected + to a third-party website. + metadata: + technology: + - express + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + category: security + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect + shortlink: https://sg.run/EpoP + semgrep.dev: + rule: + r_id: 22081 + rv_id: 1263140 + rule_id: X5ULkq + version_id: nWT2L0v + url: https://semgrep.dev/playground/r/nWT2L0v/javascript.express.security.audit.express-open-redirect.express-open-redirect + origin: community + languages: + - javascript + - typescript + severity: WARNING + options: + taint_unify_mvars: true + symbolic_propagation: true + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.redirect("$HTTP"+$REQ. ... .$VALUE) + - pattern: $RES.redirect("$HTTP"+$REQ. ... .$VALUE + $...A) + - pattern: $RES.redirect(`$HTTP${$REQ. ... .$VALUE}...`) + - pattern: $RES.redirect("$HTTP"+$REQ.$VALUE[...]) + - pattern: $RES.redirect("$HTTP"+$REQ.$VALUE[...] + $...A) + - pattern: $RES.redirect(`$HTTP${$REQ.$VALUE[...]}...`) + - metavariable-regex: + metavariable: $HTTP + regex: ^https?:\/\/$ + - pattern-either: + - pattern: $REQ. ... .$VALUE + - patterns: + - pattern-either: + - pattern: $RES.redirect($REQ. ... .$VALUE) + - pattern: $RES.redirect($REQ. ... .$VALUE + $...A) + - pattern: $RES.redirect(`${$REQ. ... .$VALUE}...`) + - pattern: $REQ. ... .$VALUE + - patterns: + - pattern-either: + - pattern: $RES.redirect($REQ.$VALUE['...']) + - pattern: $RES.redirect($REQ.$VALUE['...'] + $...A) + - pattern: $RES.redirect(`${$REQ.$VALUE['...']}...`) + - pattern: $REQ.$VALUE + - patterns: + - pattern-either: + - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE + + ... + + ' + - pattern-inside: '$ASSIGN = $REQ.$VALUE[''...''] + + ... + + ' + - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE + $...A + + ... + + ' + - pattern-inside: "$ASSIGN = $REQ.$VALUE['...'] + $...A\n... \n" + - pattern-inside: '$ASSIGN = `${$REQ. ... .$VALUE}...` + + ... + + ' + - pattern-inside: "$ASSIGN = `${$REQ.$VALUE['...']}...`\n... \n" + - pattern-either: + - pattern: $RES.redirect($ASSIGN) + - pattern: $RES.redirect($ASSIGN + $...FOO) + - pattern: $RES.redirect(`${$ASSIGN}...`) + - focus-metavariable: $ASSIGN +- id: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal + message: Possible writing outside of the destination, make sure that the target path is nested in the intended destination + metadata: + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + category: security + references: + - https://owasp.org/www-community/attacks/Path_Traversal + technology: + - express + - node.js + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal + shortlink: https://sg.run/weRn + semgrep.dev: + rule: + r_id: 9273 + rv_id: 1263141 + rule_id: L1Uyb8 + version_id: ExTExX0 + url: https://semgrep.dev/playground/r/ExTExX0/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern-either: + - pattern-inside: '$PATH = require(''path''); + + ... + + ' + - pattern-inside: 'import $PATH from ''path''; + + ... + + ' + - pattern-either: + - pattern: $PATH.join(...,$SINK,...) + - pattern: $PATH.resolve(...,$SINK,...) + - patterns: + - focus-metavariable: $SINK + - pattern-inside: 'import ''path''; + + ... + + ' + - pattern-either: + - pattern: path.join(...,$SINK,...) + - pattern: path.resolve(...,$SINK,...) + pattern-sanitizers: + - pattern: $Y.replace(...) + - pattern: $Y.indexOf(...) + - pattern: "function ... (...) {\n ...\n <... $Y.indexOf(...) ...>\n ...\n}\n" + - patterns: + - pattern: $FUNC(...) + - metavariable-regex: + metavariable: $FUNC + regex: sanitize +- id: javascript.express.security.audit.express-res-sendfile.express-res-sendfile + message: The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily + read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing + the path. This allows you to validate the path against the intended directory it should be accessing. + metadata: + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html + technology: + - express + category: security + cwe: + - 'CWE-73: External Control of File Name or Path' + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile + shortlink: https://sg.run/7DJk + semgrep.dev: + rule: + r_id: 22082 + rv_id: 1263142 + rule_id: j2UzDx + version_id: 7ZTE3X9 + url: https://semgrep.dev/playground/r/7ZTE3X9/javascript.express.security.audit.express-res-sendfile.express-res-sendfile + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: 'function ... (...,$REQ: $TYPE, ...) {...} + + ' + - metavariable-regex: + metavariable: $TYPE + regex: ^(string|String) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.$METH($QUERY,...) + - pattern-not-inside: $RES.$METH($QUERY,$OPTIONS) + - metavariable-regex: + metavariable: $METH + regex: ^(sendfile|sendFile)$ + - focus-metavariable: $QUERY +- id: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + options: + interfile: true + metadata: + interfile: true + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + category: security + technology: + - express + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret + shortlink: https://sg.run/LYvG + semgrep.dev: + rule: + r_id: 22083 + rv_id: 1263143 + rule_id: 10Uo39 + version_id: LjTkgle + url: https://semgrep.dev/playground/r/LjTkgle/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret + origin: community + languages: + - javascript + - typescript + severity: WARNING + patterns: + - pattern-either: + - pattern-inside: '$SESSION = require(''express-session''); + + ... + + ' + - pattern-inside: 'import $SESSION from ''express-session'' + + ... + + ' + - pattern-inside: 'import {..., $SESSION, ...} from ''express-session'' + + ... + + ' + - pattern-inside: 'import * as $SESSION from ''express-session'' + + ... + + ' + - patterns: + - pattern-either: + - pattern-inside: $APP.use($SESSION({...})) + - pattern: '$SECRET = $VALUE + + ... + + $APP.use($SESSION($SECRET)) + + ' + - pattern: 'secret: ''$Y'' + + ' +- id: javascript.express.security.audit.express-ssrf.express-ssrf + message: 'The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side + Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, + but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded + to follow OWASP best practices to prevent abuse. ' + metadata: + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + technology: + - express + category: security + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf + shortlink: https://sg.run/0PNw + semgrep.dev: + rule: + r_id: 22554 + rv_id: 1263144 + rule_id: eqU9l2 + version_id: 8KT5rBr + url: https://semgrep.dev/playground/r/8KT5rBr/javascript.express.security.audit.express-ssrf.express-ssrf + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + options: + taint_unify_mvars: true + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, ...) {...} + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,...) => + + {...} + + ' + - pattern-inside: '({ $REQ }: $EXPRESS.Request,...) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$REQUEST = require(''request'') + + ... + + ' + - pattern-inside: 'import * as $REQUEST from ''request'' + + ... + + ' + - pattern-inside: 'import $REQUEST from ''request'' + + ... + + ' + - pattern-either: + - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE) + - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE + $...A) + - pattern: $REQUEST.$METHOD(`$HTTP${$REQ. ... .$VALUE}...`) + - pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...]) + - pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...] + $...A) + - pattern: $REQUEST.$METHOD(`$HTTP${$REQ.$VALUE[...]}...`) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|patch|del|head|delete)$ + - metavariable-regex: + metavariable: $HTTP + regex: ^(https?:\/\/|//)$ + - pattern-either: + - pattern: $REQ. ... .$VALUE + - patterns: + - pattern-either: + - pattern-inside: '$REQUEST = require(''request'') + + ... + + ' + - pattern-inside: 'import * as $REQUEST from ''request'' + + ... + + ' + - pattern-inside: 'import $REQUEST from ''request'' + + ... + + ' + - pattern-either: + - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE,...) + - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE + $...A,...) + - pattern: $REQUEST.$METHOD(`${$REQ. ... .$VALUE}...`,...) + - pattern: $REQ. ... .$VALUE + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|patch|del|head|delete)$ + - patterns: + - pattern-either: + - pattern-inside: '$REQUEST = require(''request'') + + ... + + ' + - pattern-inside: 'import * as $REQUEST from ''request'' + + ... + + ' + - pattern-inside: 'import $REQUEST from ''request'' + + ... + + ' + - pattern-either: + - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'],...) + - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'] + $...A,...) + - pattern: $REQUEST.$METHOD(`${$REQ.$VALUE['...']}...`,...) + - pattern: $REQ.$VALUE + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|patch|del|head|delete)$ + - patterns: + - pattern-either: + - pattern-inside: '$REQUEST = require(''request'') + + ... + + ' + - pattern-inside: 'import * as $REQUEST from ''request'' + + ... + + ' + - pattern-inside: 'import $REQUEST from ''request'' + + ... + + ' + - pattern-either: + - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE + + ... + + ' + - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE[''...''] + + ... + + ' + - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE + $...A + + ... + + ' + - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE['...'] + $...A\n... \n" + - pattern-inside: '$ASSIGN = `${$REQ. ... .$VALUE}...` + + ... + + ' + - pattern-inside: "$ASSIGN = `${$REQ. ... .$VALUE['...']}...`\n... \n" + - patterns: + - pattern-either: + - pattern-inside: '$ASSIGN = "$HTTP"+ $REQ. ... .$VALUE + + ... + + ' + - pattern-inside: '$ASSIGN = "$HTTP"+$REQ. ... .$VALUE + $...A + + ... + + ' + - pattern-inside: '$ASSIGN = "$HTTP"+$REQ.$VALUE[...] + + ... + + ' + - pattern-inside: '$ASSIGN = "$HTTP"+$REQ.$VALUE[...] + $...A + + ... + + ' + - pattern-inside: '$ASSIGN = `$HTTP${$REQ.$VALUE[...]}...` + + ... + + ' + - metavariable-regex: + metavariable: $HTTP + regex: ^(https?:\/\/|//)$ + - pattern-either: + - pattern: $REQUEST.$METHOD($ASSIGN,...) + - pattern: $REQUEST.$METHOD($ASSIGN + $...FOO,...) + - pattern: $REQUEST.$METHOD(`${$ASSIGN}...`,...) + - patterns: + - pattern-either: + - pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN,...) + - pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN + $...A,...) + - pattern: $REQUEST.$METHOD(`$HTTP${$ASSIGN}...`,...) + - metavariable-regex: + metavariable: $HTTP + regex: ^(https?:\/\/|//)$ + - pattern: $ASSIGN + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|patch|del|head|delete)$ +- id: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization + message: The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) + through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and + Buffer.from(). + options: + interfile: true + metadata: + interfile: true + technology: + - express + category: security + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html + source_rule_url: + - https://github.com/ajinabraham/njsscan/blob/75bfbeb9c8d72999e4d527dfa2548f7f0f3cc48a/njsscan/rules/semantic_grep/eval/eval_deserialize.yaml + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization + shortlink: https://sg.run/8W5j + semgrep.dev: + rule: + r_id: 22084 + rv_id: 1263145 + rule_id: 9AUyqj + version_id: gETB7nD + url: https://semgrep.dev/playground/r/gETB7nD/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - pattern: $REQ.files.$ANYTHING.data.toString('utf8') + - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - pattern: files.$ANYTHING.data.toString('utf8') + - pattern: files.$ANYTHING['data'].toString('utf8') + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: '$SER = require(''$IMPORT'') + + ... + + ' + - pattern-inside: "import $SER from '$IMPORT'\n ...\n" + - pattern-inside: 'import * as $SER from ''$IMPORT'' + + ... + + ' + - metavariable-regex: + metavariable: $IMPORT + regex: ^(node-serialize|serialize-to-js)$ + - pattern: $SER.$FUNC(...) + - metavariable-regex: + metavariable: $FUNC + regex: ^(unserialize|deserialize)$ +- id: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event + message: Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it + can result in XML External or Internal Entity (XXE) Processing vulnerabilities + metadata: + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + category: security + technology: + - express + references: + - https://www.npmjs.com/package/xml2json + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event + shortlink: https://sg.run/x1AA + semgrep.dev: + rule: + r_id: 9274 + rv_id: 1263146 + rule_id: 8GUjkk + version_id: QkTGqgo + url: https://semgrep.dev/playground/r/QkTGqgo/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: 'require(''xml2json''); + + ... + + ' + - pattern-inside: 'import ''xml2json''; + + ... + + ' + - pattern: $REQ.on('...', function(...) { ... $EXPAT.toJson($INPUT,...); ... }) + - focus-metavariable: $INPUT +- id: javascript.express.security.audit.res-render-injection.res-render-injection + message: User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages + that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` + to access other HTML pages on the file system. Where possible, do not allow users to define what should be loaded in + $RES.render or use an allow list for the existing application. + options: + interfile: true + metadata: + interfile: true + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' + category: security + technology: + - express + references: + - http://expressjs.com/en/4x/api.html#res.render + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection + shortlink: https://sg.run/eLjd + semgrep.dev: + rule: + r_id: 9276 + rv_id: 1263149 + rule_id: QrUzrq + version_id: PkTR3OY + url: https://semgrep.dev/playground/r/PkTR3OY/javascript.express.security.audit.res-render-injection.res-render-injection + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.render($SINK, ...) + - focus-metavariable: $SINK +- id: javascript.express.security.audit.xss.direct-response-write.direct-response-write + message: Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may + expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped + HTML. + options: + interfile: true + metadata: + interfile: true + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + category: security + technology: + - express + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + vulnerability_class: + - Cross-Site-Scripting (XSS) + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write + shortlink: https://sg.run/vzGl + semgrep.dev: + rule: + r_id: 9277 + rv_id: 1263150 + rule_id: 3qUPA1 + version_id: JdTzxeg + url: https://semgrep.dev/playground/r/JdTzxeg/javascript.express.security.audit.xss.direct-response-write.direct-response-write + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options) + - pattern-not-inside: "function ... ($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" + - pattern-not-inside: "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n\ + })\n" + - pattern-not-inside: "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" + - pattern-not-inside: "function ... ($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n}\n" + - pattern-not-inside: "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n})\n" + - pattern-not-inside: "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.set('$TYPE')\n}\n" + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - pattern-not-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.$SET('Content-Type',\ + \ '$TYPE')\n}\n" + - pattern-not-inside: "({ $REQ }: Request,$RES: Response) => {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" + - pattern-not-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.set('$TYPE')\n\ + }\n" + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: body + pattern-sinks: + - patterns: + - pattern-inside: function ... (..., $RES,...) {...} + - pattern-either: + - pattern: $RES.write($ARG) + - pattern: $RES.send($ARG) + - pattern-not: $RES. ... .set('...'). ... .send($ARG) + - pattern-not: $RES. ... .type('...'). ... .send($ARG) + - pattern-not-inside: $RES.$METHOD({ ... }) + - focus-metavariable: $ARG + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import * as $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: '$S = require("underscore.string") + + ... + + ' + - pattern-either: + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "dompurify" + + ... + + ' + - pattern-inside: 'import { ..., $S,... } from "dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "dompurify" + + ... + + ' + - pattern-inside: '$S = require("dompurify") + + ... + + ' + - pattern-inside: 'import $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: '$S = require("isomorphic-dompurify") + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$VALUE = $S(...) + + ... + + ' + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: '$VALUE = $S.sanitize + + ... + + ' + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''xss''; + + ... + + ' + - pattern-inside: 'import * as $S from ''xss''; + + ... + + ' + - pattern-inside: '$S = require("xss") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''sanitize-html''; + + ... + + ' + - pattern-inside: 'import * as $S from "sanitize-html"; + + ... + + ' + - pattern-inside: '$S = require("sanitize-html") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: '$S = new Remarkable() + + ... + + ' + - pattern: $S.render(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''express-xss-sanitizer''; + + ... + + ' + - pattern-inside: 'import * as $S from "express-xss-sanitizer"; + + ... + + ' + - pattern-inside: 'const { ..., $S, ... } = require(''express-xss-sanitizer''); + + ... + + ' + - pattern-inside: 'var { ..., $S, ... } = require(''express-xss-sanitizer''); + + ... + + ' + - pattern-inside: 'let { ...,$S,... } = require(''express-xss-sanitizer''); + + ... + + ' + - pattern-inside: '$S = require("express-xss-sanitizer") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern: $RES. ... .type('$F'). ... .send(...) + - metavariable-regex: + metavariable: $F + regex: (?!.*text/html) + - patterns: + - pattern-inside: '$X = [...]; + + ... + + ' + - pattern: "if(<... !$X.includes($SOURCE)...>) {\n ...\n return ...\n}\n...\n" + - pattern: $SOURCE +- id: javascript.express.security.cors-misconfiguration.cors-misconfiguration + message: By letting user input control CORS parameters, there is a risk that software does not properly verify that the + source of data or communication is valid. Use literal values for CORS settings. + metadata: + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe: + - 'CWE-346: Origin Validation Error' + category: security + references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS + technology: + - express + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration + shortlink: https://sg.run/nKXO + semgrep.dev: + rule: + r_id: 13580 + rv_id: 1263162 + rule_id: 5rULJQ + version_id: YDTZe8Y + url: https://semgrep.dev/playground/r/YDTZe8Y/javascript.express.security.cors-misconfiguration.cors-misconfiguration + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.set($HEADER, $X) + - pattern: $RES.header($HEADER, $X) + - pattern: $RES.setHeader($HEADER, $X) + - pattern: '$RES.set({$HEADER: $X}, ...) + + ' + - pattern: '$RES.writeHead($STATUS, {$HEADER: $X}, ...) + + ' + - focus-metavariable: $X + - metavariable-regex: + metavariable: $HEADER + regex: .*(Access-Control-Allow-Origin|access-control-allow-origin).* +- id: javascript.express.security.express-expat-xxe.express-expat-xxe + message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal + Entity (XXE) Processing vulnerabilities. + options: + interfile: true + metadata: + interfile: true + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://github.com/astro/node-expat + category: security + technology: + - express + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe + shortlink: https://sg.run/BkXx + semgrep.dev: + rule: + r_id: 9251 + rv_id: 1263164 + rule_id: zdUkJl + version_id: o5TbD5l + url: https://semgrep.dev/playground/r/o5TbD5l/javascript.express.security.express-expat-xxe.express-expat-xxe + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$XML = require(''node-expat'') + + ... + + ' + - pattern-inside: 'import $XML from ''node-expat'' + + ... + + ' + - pattern-inside: 'import * as $XML from ''node-expat'' + + ... + + ' + - pattern-either: + - pattern-inside: '$PARSER = new $XML.Parser(...); + + ... + + ' + - pattern-either: + - pattern: $PARSER.parse($QUERY) + - pattern: $PARSER.write($QUERY) + - focus-metavariable: $QUERY +- id: javascript.express.security.express-insecure-template-usage.express-insecure-template-usage + message: User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) + vulnerability. + options: + interfile: true + metadata: + interfile: true + category: security + cwe: + - 'CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine' + owasp: + - A03:2021 - Injection + - A01:2017 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html + technology: + - javascript + - typescript + - express + - pug + - jade + - dot + - ejs + - nunjucks + - lodash + - handlbars + - mustache + - hogan.js + - eta + - squirrelly + source_rule_url: + - https://github.com/github/codeql/blob/2ba2642c7ab29b9eedef33bcc2b8cd1d203d0c10/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/template-sinks.js + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage + shortlink: https://sg.run/b49v + semgrep.dev: + rule: + r_id: 19226 + rv_id: 1263165 + rule_id: EwUr9k + version_id: zyTb2eD + url: https://semgrep.dev/playground/r/zyTb2eD/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-propagators: + - pattern: $MODEL.$FIND($E).then((...,$S,...)=>{...}) + from: $E + to: $S + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''pug'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''pug'' + + ... + + ' + - pattern-inside: '$PUG = require(''jade'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''jade'' + + ... + + ' + - pattern-either: + - pattern: $PUG.compile(...) + - pattern: $PUG.compileClient(...) + - pattern: $PUG.compileClientWithDependenciesTracked(...) + - pattern: $PUG.render(...) + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''dot'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''dot'' + + ... + + ' + - pattern-either: + - pattern: $PUG.template(...) + - pattern: $PUG.compile(...) + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''ejs'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''ejs'' + + ... + + ' + - pattern-either: + - pattern: $PUG.render(...) + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''nunjucks'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''nunjucks'' + + ... + + ' + - pattern-either: + - pattern: $PUG.renderString(...) + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''lodash'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''lodash'' + + ... + + ' + - pattern-either: + - pattern: $PUG.template(...) + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''mustache'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''mustache'' + + ... + + ' + - pattern-inside: '$PUG = require(''eta'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''eta'' + + ... + + ' + - pattern-inside: '$PUG = require(''squirrelly'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''squirrelly'' + + ... + + ' + - pattern-either: + - pattern: $PUG.render(...) + - patterns: + - pattern-either: + - pattern-inside: '$PUG = require(''hogan.js'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''hogan.js'' + + ... + + ' + - pattern-inside: '$PUG = require(''handlebars'') + + ... + + ' + - pattern-inside: 'import * as $PUG from ''handlebars'' + + ... + + ' + - pattern-either: + - pattern: $PUG.compile(...) +- id: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + options: + interfile: true + metadata: + interfile: true + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + category: security + technology: + - express + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret + shortlink: https://sg.run/Do1d + semgrep.dev: + rule: + r_id: 9252 + rv_id: 1263166 + rule_id: pKUOjy + version_id: pZT03Q0 + url: https://semgrep.dev/playground/r/pZT03Q0/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret + origin: community + languages: + - javascript + - typescript + severity: WARNING + patterns: + - pattern-either: + - pattern-inside: '$JWT = require(''express-jwt''); + + ... + + ' + - pattern-inside: 'import $JWT from ''express-jwt''; + + ... + + ' + - pattern-inside: 'import * as $JWT from ''express-jwt''; + + ... + + ' + - pattern-inside: 'import { ..., $JWT, ... } from ''express-jwt''; + + ... + + ' + - pattern-either: + - pattern: '$JWT({...,secret: "$Y",...},...) + + ' + - pattern: '$OPTS = "$Y"; + + ... + + $JWT({...,secret: $OPTS},...); + + ' + - focus-metavariable: $Y +- id: javascript.express.security.express-phantom-injection.express-phantom-injection + message: If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities + metadata: + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + category: security + technology: + - express + references: + - https://phantomjs.org/page-automation.html + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection + shortlink: https://sg.run/W8BL + semgrep.dev: + rule: + r_id: 9253 + rv_id: 1263167 + rule_id: 2ZUbx3 + version_id: 2KTv26p + url: https://semgrep.dev/playground/r/2KTv26p/javascript.express.security.express-phantom-injection.express-phantom-injection + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: 'require(''phantom''); + + ... + + ' + - pattern-inside: 'import ''phantom''; + + ... + + ' + - pattern-either: + - pattern: $PAGE.open($SINK,...) + - pattern: $PAGE.setContent($SINK,...) + - pattern: $PAGE.openUrl($SINK,...) + - pattern: $PAGE.evaluateJavaScript($SINK,...) + - pattern: $PAGE.property("content",$SINK,...) + - focus-metavariable: $SINK +- id: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection + message: If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities + metadata: + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + category: security + technology: + - express + references: + - https://pptr.dev/api/puppeteer.page + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection + shortlink: https://sg.run/0QJB + semgrep.dev: + rule: + r_id: 9254 + rv_id: 1263168 + rule_id: X5U8Nz + version_id: X0TzyJY + url: https://semgrep.dev/playground/r/X0TzyJY/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: 'require(''puppeteer''); + + ... + + ' + - pattern-inside: 'import ''puppeteer''; + + ... + + ' + - pattern-either: + - pattern: $PAGE.goto($SINK,...) + - pattern: $PAGE.setContent($SINK,...) + - pattern: $PAGE.evaluate($SINK,...) + - pattern: $PAGE.evaluate($CODE,$SINK,...) + - pattern: $PAGE.evaluateHandle($SINK,...) + - pattern: $PAGE.evaluateHandle($CODE,$SINK,...) + - pattern: $PAGE.evaluateOnNewDocument($SINK,...) + - pattern: $PAGE.evaluateOnNewDocument($CODE,$SINK,...) + - focus-metavariable: $SINK +- id: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection + message: Make sure that unverified user data can not reach `sandbox`. + metadata: + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + category: security + technology: + - express + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection + shortlink: https://sg.run/KlwL + semgrep.dev: + rule: + r_id: 9255 + rv_id: 1263169 + rule_id: j2UvXB + version_id: jQTn59D + url: https://semgrep.dev/playground/r/jQTn59D/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-inside: '$SANDBOX = require(''sandbox''); + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$S = new $SANDBOX(...); + + ... + + ' + - pattern: '$S.run(...) + + ' + - pattern: 'new $SANDBOX($OPTS).run(...) + + ' + - pattern: new $SANDBOX().run(...) +- id: javascript.express.security.express-vm-injection.express-vm-injection + message: Make sure that unverified user data can not reach `$VM`. + metadata: + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + category: security + technology: + - express + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection + shortlink: https://sg.run/jkqJ + semgrep.dev: + rule: + r_id: 12821 + rv_id: 1263170 + rule_id: DbUKPX + version_id: 1QTypXQ + url: https://semgrep.dev/playground/r/1QTypXQ/javascript.express.security.express-vm-injection.express-vm-injection + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-inside: '$VM = require(''vm''); + + ... + + ' + - pattern-either: + - pattern: '$VM.runInContext(...) + + ' + - pattern: '$VM.runInNewContext(...) + + ' + - pattern: '$VM.compileFunction(...) + + ' + - pattern: '$VM.runInThisContext(...) + + ' + - pattern: new $VM.Script(...) +- id: javascript.express.security.express-vm2-injection.express-vm2-injection + message: Make sure that unverified user data can not reach `vm2`. + metadata: + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + category: security + technology: + - express + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection + shortlink: https://sg.run/1GWv + semgrep.dev: + rule: + r_id: 12822 + rv_id: 1263171 + rule_id: WAUPXJ + version_id: 9lT4bnX + url: https://semgrep.dev/playground/r/9lT4bnX/javascript.express.security.express-vm2-injection.express-vm2-injection + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-inside: 'require(''vm2'') + + ... + + ' + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: '$VM = new VM(...) + + ... + + ' + - pattern-inside: '$VM = new NodeVM(...) + + ... + + ' + - pattern: '$VM.run(...) + + ' + - pattern: 'new VM(...).run(...) + + ' + - pattern: 'new NodeVM(...).run(...) + + ' + - pattern: 'new VMScript(...) + + ' + - pattern: 'new VM(...) + + ' + - pattern: new NodeVM(...) +- id: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe + message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal + Entity (XXE) Processing vulnerabilities + metadata: + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + category: security + technology: + - express + references: + - https://www.npmjs.com/package/xml2json + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe + shortlink: https://sg.run/XBD4 + semgrep.dev: + rule: + r_id: 9264 + rv_id: 1263174 + rule_id: x8Uneb + version_id: bZT534J + url: https://semgrep.dev/playground/r/bZT534J/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - pattern: $REQ.files.$ANYTHING.data.toString('utf8') + - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - pattern: files.$ANYTHING.data.toString('utf8') + - pattern: files.$ANYTHING['data'].toString('utf8') + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: 'require(''xml2json''); + + ... + + ' + - pattern-inside: 'import ''xml2json''; + + ... + + ' + - pattern: $EXPAT.toJson($SINK,...) + - focus-metavariable: $SINK +- id: javascript.express.security.injection.raw-html-format.raw-html-format + message: User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting + (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to + sanitize the HTML within. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + category: security + technology: + - express + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format + shortlink: https://sg.run/5DO3 + semgrep.dev: + rule: + r_id: 14691 + rv_id: 1263175 + rule_id: 5rUL0X + version_id: NdTzyQv + url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - label: EXPRESS + patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - label: EXPRESSTS + patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - label: CLEAN + by-side-effect: true + patterns: + - pattern-either: + - pattern: $A($SOURCE) + - pattern: $SANITIZE. ... .$A($SOURCE) + - pattern: $A. ... .$SANITIZE($SOURCE) + - focus-metavariable: $SOURCE + - metavariable-regex: + metavariable: $A + regex: (?i)(.*valid|.*sanitiz) + pattern-sinks: + - requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN) + patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$HTMLSTR" + $EXPR' + - pattern: '"$HTMLSTR".concat(...)' + - pattern: util.format($HTMLSTR, ...) + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... + - patterns: + - pattern: '`...` + + ' + - pattern-regex: '.*<\w+.* + + ' +- id: javascript.express.security.require-request.require-request + message: If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the + server. + options: + interfile: true + metadata: + interfile: true + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' + source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html + category: security + technology: + - express + references: + - https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/javascript.express.security.require-request.require-request + shortlink: https://sg.run/jRbl + semgrep.dev: + rule: + r_id: 9265 + rv_id: 1263177 + rule_id: OrU3WK + version_id: w8TRo0d + url: https://semgrep.dev/playground/r/w8TRo0d/javascript.express.security.require-request.require-request + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern: require($SINK) + - focus-metavariable: $SINK +- id: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration + message: By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify + whether or not a browser should be allowed to render a page in an `iframe`. + metadata: + references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + cwe: + - 'CWE-451: User Interface (UI) Misrepresentation of Critical Information' + category: security + technology: + - express + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration + shortlink: https://sg.run/EvjA + semgrep.dev: + rule: + r_id: 13581 + rv_id: 1263178 + rule_id: GdUrLy + version_id: xyTjz3D + url: https://semgrep.dev/playground/r/xyTjz3D/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.set($HEADER, ...) + - pattern: $RES.header($HEADER, ...) + - pattern: $RES.setHeader($HEADER, ...) + - pattern: '$RES.set({$HEADER: ...}, ...) + + ' + - pattern: '$RES.writeHead($STATUS, {$HEADER: ...}, ...) + + ' + - metavariable-regex: + metavariable: $HEADER + regex: .*(X-Frame-Options|x-frame-options).* +- id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + metadata: + interfile: true + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.2 Static API keys or secret + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jose + - jwt + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret + shortlink: https://sg.run/Ro1g + semgrep.dev: + rule: + r_id: 9293 + rv_id: 1263182 + rule_id: JDUyRl + version_id: d6TyxbX + url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret + origin: community + languages: + - javascript + - typescript + severity: WARNING + patterns: + - pattern-inside: '$JOSE = require("jose"); + + ... + + ' + - pattern-either: + - pattern-inside: 'var {JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'var {JWK, JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'const {JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'const {JWK, JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'let {JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'let {JWK, JWT} = $JOSE; + + ... + + ' + - pattern-either: + - pattern: 'JWT.verify($P, "...", ...); + + ' + - pattern: 'JWT.sign($P, "...", ...); + + ' + - pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...); \n" + - pattern: '$JWT.sign($P, JWK.asKey("..."), ...); + + ' + options: + symbolic_propagation: true + interfile: true +- id: javascript.jose.security.jwt-none-alg.jwt-none-alg + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has + already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do + not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.3 Insecue Stateless Session Tokens + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jose + - jwt + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg + shortlink: https://sg.run/AvRL + semgrep.dev: + rule: + r_id: 9294 + rv_id: 1263183 + rule_id: 5rUOGN + version_id: ZRTKAyb + url: https://semgrep.dev/playground/r/ZRTKAyb/javascript.jose.security.jwt-none-alg.jwt-none-alg + origin: community + languages: + - javascript + - typescript + severity: ERROR + pattern-either: + - pattern: 'var $JOSE = require("jose"); + + ... + + var { JWK, JWT } = $JOSE; + + ... + + var $T = JWT.verify($P, JWK.None,...); + + ' + - pattern: 'var $JOSE = require("jose"); + + ... + + var { JWK, JWT } = $JOSE; + + ... + + $T = JWT.verify($P, JWK.None,...); + + ' + - pattern: 'var $JOSE = require("jose"); + + ... + + var { JWK, JWT } = $JOSE; + + ... + + JWT.verify($P, JWK.None,...); + + ' +- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.2 Static API keys or secret + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jwt + - javascript + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret + shortlink: https://sg.run/4xN9 + semgrep.dev: + rule: + r_id: 9300 + rv_id: 1263189 + rule_id: WAUon7 + version_id: gETB75D + url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern: "$X = '...' \n" + - pattern: "$X = '$Y' \n" + - patterns: + - pattern-either: + - pattern-inside: '$JWT.sign($DATA,"...",...); + + ' + - pattern-inside: '$JWT.verify($DATA,"...",...); + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$JWT = require("jsonwebtoken") + + ... + + ' + - pattern-inside: 'import $JWT from "jsonwebtoken" + + ... + + ' + - pattern-inside: 'import * as $JWT from "jsonwebtoken" + + ... + + ' + - pattern-inside: 'import {...,$JWT,...} from "jsonwebtoken" + + ... + + ' + - pattern-either: + - pattern-inside: '$JWT.sign($DATA,$VALUE,...); + + ' + - pattern-inside: '$JWT.verify($DATA,$VALUE,...); + + ' + - focus-metavariable: $VALUE +- id: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has + already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do + not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.3 Insecue Stateless Session Tokens + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jwt + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg + shortlink: https://sg.run/PJXv + semgrep.dev: + rule: + r_id: 9301 + rv_id: 1263190 + rule_id: 0oU53g + version_id: QkTGqQo + url: https://semgrep.dev/playground/r/QkTGqQo/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg + origin: community + languages: + - javascript + - typescript + severity: ERROR + patterns: + - pattern-inside: '$JWT = require("jsonwebtoken"); + + ... + + ' + - pattern: $JWT.verify($P, $X, {algorithms:[...,'none',...]},...) +- id: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify + message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the + token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` + before using the token. + severity: ERROR + metadata: + owasp: + - A05:2021 - Security Misconfiguration + - A07:2021 - Identification and Authentication Failures + - A02:2025 - Security Misconfiguration + - A07:2025 - Authentication Failures + cwe: + - 'CWE-287: Improper Authentication' + - 'CWE-345: Insufficient Verification of Data Authenticity' + - 'CWE-347: Improper Verification of Cryptographic Signature' + category: security + subcategory: + - vuln + technology: + - jwt-simple + - jwt + confidence: HIGH + likelihood: MEDIUM + impact: HIGH + references: + - https://www.npmjs.com/package/jwt-simple + - https://cwe.mitre.org/data/definitions/287 + - https://cwe.mitre.org/data/definitions/345 + - https://cwe.mitre.org/data/definitions/347 + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + - Improper Authentication + source: https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify + shortlink: https://sg.run/zdjod + semgrep.dev: + rule: + r_id: 120561 + rv_id: 1263191 + rule_id: r6UyNLy + version_id: 3ZT4Xxv + url: https://semgrep.dev/playground/r/3ZT4Xxv/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify + origin: community + languages: + - javascript + - typescript + patterns: + - pattern-inside: '$JWT = require(''jwt-simple''); + + ... + + ' + - pattern: $JWT.decode($TOKEN, $SECRET, $NOVERIFY, ...) + - metavariable-pattern: + metavariable: $NOVERIFY + patterns: + - pattern-either: + - pattern: 'true + + ' + - pattern: '"..." + + ' +- id: javascript.lang.security.audit.code-string-concat.code-string-concat + message: Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead + to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible. + options: + interfile: true + metadata: + interfile: true + confidence: HIGH + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + references: + - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval + - https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback + - https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/ + - https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html + category: security + technology: + - node.js + - Express + - Next.js + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat + shortlink: https://sg.run/96Yk + semgrep.dev: + rule: + r_id: 13023 + rv_id: 1263192 + rule_id: DbUKEz + version_id: 44TEjYX + url: https://semgrep.dev/playground/r/44TEjYX/javascript.lang.security.audit.code-string-concat.code-string-concat + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: 'import { ...,$IMPORT,... } from ''next/router'' + + ... + + ' + - pattern-inside: 'import $IMPORT from ''next/router''; + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$ROUTER = $IMPORT() + + ... + + ' + - pattern-either: + - pattern-inside: 'const { ...,$PROPS,... } = $ROUTER.query + + ... + + ' + - pattern-inside: 'var { ...,$PROPS,... } = $ROUTER.query + + ... + + ' + - pattern-inside: 'let { ...,$PROPS,... } = $ROUTER.query + + ... + + ' + - focus-metavariable: $PROPS + - patterns: + - pattern-inside: '$ROUTER = $IMPORT() + + ... + + ' + - pattern: "$ROUTER.query.$VALUE \n" + - patterns: + - pattern: $IMPORT().query.$VALUE + pattern-sinks: + - patterns: + - pattern: 'eval(...) + + ' +- id: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli + message: 'Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled + and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared + statements. An example of parameterized queries like so: `knex.raw(''SELECT $1 from table'', [userinput])` can help prevent + SQLi.' + metadata: + confidence: MEDIUM + references: + - https://knexjs.org/#Builder-fromRaw + - https://knexjs.org/#Builder-whereRaw + - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - express + - nodejs + - knex + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli + shortlink: https://sg.run/l9eE + semgrep.dev: + rule: + r_id: 18257 + rv_id: 1263205 + rule_id: d8UKLD + version_id: l4TJRey + url: https://semgrep.dev/playground/r/l4TJRey/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options) + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - pattern: $REQ.files.$ANYTHING.data.toString('utf8') + - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - pattern: files.$ANYTHING.data.toString('utf8') + - pattern: files.$ANYTHING['data'].toString('utf8') + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern-inside: $KNEX.fromRaw($QUERY, ...) + - pattern-inside: $KNEX.whereRaw($QUERY, ...) + - pattern-inside: $KNEX.raw($QUERY, ...) + - pattern-either: + - pattern-inside: 'require(''knex'') + + ... + + ' + - pattern-inside: 'import ''knex'' + + ... + + ' + pattern-sanitizers: + - patterns: + - pattern: parseInt(...) +- id: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression + message: Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting + (XSS). Where possible avoid including user-input in functions which dynamically execute user-input. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js + references: + - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval! + category: security + technology: + - javascript + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression + shortlink: https://sg.run/6nwK + semgrep.dev: + rule: + r_id: 9315 + rv_id: 1263214 + rule_id: yyUngo + version_id: WrTqKkJ + url: https://semgrep.dev/playground/r/WrTqKkJ/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "$PROP = new URLSearchParams($WINDOW. ... .location.search).get('...')\n ...\n" + - pattern-inside: "$PROP = new URLSearchParams(location.search).get('...')\n ...\n" + - pattern-inside: "$PROP = new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...')\n ...\n" + - pattern-inside: "$PROP = new URLSearchParams(location.hash.substring(1)).get('...')\n ...\n" + - focus-metavariable: $PROP + - patterns: + - pattern-either: + - pattern-inside: "$PROPS = new URLSearchParams($WINDOW. ... .location.search)\n ...\n" + - pattern-inside: "$PROPS = new URLSearchParams(location.search)\n ...\n" + - pattern-inside: "$PROPS = new\nURLSearchParams($WINDOW. ... .location.hash.substring(1))\n ...\n" + - pattern-inside: '$PROPS = new URLSearchParams(location.hash.substring(1)) + + ... + + ' + - pattern: $PROPS.get('...') + - focus-metavariable: $PROPS + - patterns: + - pattern-either: + - pattern: location.href + - pattern: location.hash + - pattern: location.search + - pattern: $WINDOW. ... .location.href + - pattern: $WINDOW. ... .location.hash + - pattern: $WINDOW. ... .location.search + pattern-sinks: + - patterns: + - pattern-either: + - pattern: eval(<... $SINK ...>) + - pattern: window.eval(<... $SINK ...>) + - pattern: new Function(<... $SINK ...>) + - pattern: new Function(<... $SINK ...>)(...) + - pattern: setTimeout(<... $SINK ...>,...) + - pattern: setInterval(<... $SINK ...>,...) + - focus-metavariable: $SINK + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern: location.href = $FUNC(...) + - pattern: location.hash = $FUNC(...) + - pattern: location.search = $FUNC(...) + - pattern: $WINDOW. ... .location.href = $FUNC(...) + - pattern: $WINDOW. ... .location.hash = $FUNC(...) + - pattern: $WINDOW. ... .location.search = $FUNC(...) +- id: javascript.node-crypto.security.aead-no-final.aead-no-final + message: The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing + to call 'final' will invalidate all integrity guarantees of the released ciphertext. + metadata: + cwe: + - 'CWE-310: CWE CATEGORY: Cryptographic Issues' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + category: security + subcategory: + - vuln + technology: + - node-crypto + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + references: + - https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/ + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final + shortlink: https://sg.run/r6EEA + semgrep.dev: + rule: + r_id: 146569 + rv_id: 1263222 + rule_id: 2ZUz884 + version_id: zyTb2X0 + url: https://semgrep.dev/playground/r/zyTb2X0/javascript.node-crypto.security.aead-no-final.aead-no-final + origin: community + languages: + - javascript + - typescript + severity: ERROR + patterns: + - pattern: '$DECIPHER = $CRYPTO.createDecipheriv(''$ALGO'', ...) + + ... + + $DECIPHER.update(...) + + ' + - pattern-not-inside: '$DECIPHER = $CRYPTO.createDecipheriv(''$ALGO'', ...) + + ... + + $DECIPHER.final(...) + + ' + - metavariable-regex: + metavariable: $ALGO + regex: .*(-gcm|-ccm|-ocb|chacha20-poly1305)$ +- id: javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length + message: The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication + tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be + tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts + or recover the implicit authentication key of GCM, allowing arbitrary forgeries. + metadata: + cwe: + - 'CWE-310: CWE CATEGORY: Cryptographic Issues' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + category: security + subcategory: + - vuln + technology: + - node-crypto + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + references: + - https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/ + - https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/ + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length + shortlink: https://sg.run/NbGG1 + semgrep.dev: + rule: + r_id: 146571 + rv_id: 1263223 + rule_id: j2UgPP3 + version_id: pZT03qd + url: https://semgrep.dev/playground/r/pZT03qd/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length + origin: community + languages: + - javascript + - typescript + severity: ERROR + patterns: + - pattern: '$CRYPTO.createDecipheriv(''$ALGO'', $KEY, $IV) + + ' + - metavariable-regex: + metavariable: $ALGO + regex: .*(-gcm)$ +- id: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.2 Static API keys or secret + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jwt + - nodejs + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret + shortlink: https://sg.run/vz70 + semgrep.dev: + rule: + r_id: 9333 + rv_id: 1263225 + rule_id: QrUzq6 + version_id: X0TzyoE + url: https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - by-side-effect: true + patterns: + - pattern-either: + - pattern: '{..., clientSecret: "...", ...} + + ' + - pattern: '{..., secretOrKey: "...", ...} + + ' + - pattern: '{..., consumerSecret: "...", ...} + + ' + - patterns: + - pattern-inside: '$OBJ = {} + + ... + + ' + - pattern-either: + - pattern: '$OBJ.clientSecret = "..." + + ' + - pattern: '$OBJ.secretOrKey = "..." + + ' + - pattern: '$OBJ.consumerSecret = "..." + + ' + - pattern: $OBJ + - patterns: + - pattern-inside: '$SECRET = ''...'' + + ... + + ' + - pattern-either: + - pattern: '{..., clientSecret: $SECRET, ...} + + ' + - pattern: '{..., secretOrKey: $SECRET, ...} + + ' + - pattern: '{..., consumerSecret: $SECRET, ...} + + ' + - patterns: + - pattern-inside: '$SECRET = ''...'' + + ... + + ' + - pattern-either: + - pattern-inside: '$VALUE = {..., clientSecret: $SECRET, ...} + + ... + + ' + - pattern-inside: '$VALUE = {..., secretOrKey: $SECRET, ...} + + ... + + ' + - pattern-inside: '$VALUE = {..., consumerSecret: $SECRET, ...} + + ... + + ' + - pattern: $VALUE + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$F = require("$I").Strategy + + ... + + ' + - pattern-inside: '$F = require("$I") + + ... + + ' + - pattern-inside: 'import { $STRAT as $F } from ''$I'' + + ... + + ' + - pattern-inside: 'import $F from ''$I'' + + ... + + ' + - metavariable-regex: + metavariable: $I + regex: (passport-.*) + - pattern-inside: 'new $F($VALUE,...) + + ' + - focus-metavariable: $VALUE +- id: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection + message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable + is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized + queries or prepared statements. + options: + interfile: true + metadata: + interfile: true + references: + - https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements + category: security + technology: + - express + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection + shortlink: https://sg.run/gjoe + semgrep.dev: + rule: + r_id: 22085 + rv_id: 1263241 + rule_id: yyU0GX + version_id: nWT2Llx + url: https://semgrep.dev/playground/r/nWT2Llx/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection + origin: community + languages: + - javascript + - typescript + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - pattern: $REQ.files.$ANYTHING.data.toString('utf8') + - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') + - patterns: + - pattern-either: + - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => + + {...} + + ' + - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} + + ' + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + - pattern: files.$ANYTHING.data.toString('utf8') + - pattern: files.$ANYTHING['data'].toString('utf8') + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sequelize.query($QUERY,...) + - pattern: $DB.sequelize.query($QUERY,...) + - focus-metavariable: $QUERY + pattern-sanitizers: + - pattern-either: + - pattern: parseInt(...) + - pattern: $FUNC. ... .hash(...) +- id: json.aws.security.public-s3-bucket.public-s3-bucket + languages: + - json + message: Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level + of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket + configuration to make sure they are set with intended values. + metadata: + category: security + cwe: + - 'CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html + technology: + - aws + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket + shortlink: https://sg.run/lxv5 + semgrep.dev: + rule: + r_id: 13413 + rv_id: 1263254 + rule_id: 7KUpLy + version_id: RGT0Ld0 + url: https://semgrep.dev/playground/r/RGT0Ld0/json.aws.security.public-s3-bucket.public-s3-bucket + origin: community + patterns: + - pattern-inside: "$BUCKETNAME: {\n \"Type\": \"AWS::S3::Bucket\",\n \"Properties\": {\n ...,\n },\n ...,\n}\n" + - pattern-either: + - pattern: "\"PublicAccessBlockConfiguration\": {\n ...,\n \"RestrictPublicBuckets\": false,\n ...,\n },\n" + - pattern: "\"PublicAccessBlockConfiguration\": {\n ...,\n \"IgnorePublicAcls\": false,\n ...,\n },\n" + - pattern: "\"PublicAccessBlockConfiguration\": {\n ...,\n \"BlockPublicAcls\": false,\n ...,\n },\n" + - pattern: "\"PublicAccessBlockConfiguration\": {\n ...,\n \"BlockPublicPolicy\": false,\n ...,\n },\n" + severity: WARNING +- id: json.aws.security.public-s3-policy-statement.public-s3-policy-statement + pattern: "{\n \"Effect\": \"Allow\",\n \"Principal\": \"*\",\n \"Resource\": [\n ..., \"=~/arn:aws:s3.*/\", ...\n\ + \ ],\n ...\n}\n" + message: Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. + Do not do this unless you will never have sensitive data inside the bucket. + metadata: + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls' + references: + - https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html + category: security + technology: + - aws + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement + shortlink: https://sg.run/Yv1d + semgrep.dev: + rule: + r_id: 9358 + rv_id: 1263255 + rule_id: 9AU1br + version_id: A8Tgdxq + url: https://semgrep.dev/playground/r/A8Tgdxq/json.aws.security.public-s3-policy-statement.public-s3-policy-statement + origin: community + severity: WARNING + languages: + - json +- id: json.aws.security.wildcard-assume-role.wildcard-assume-role + patterns: + - pattern-inside: '"Statement": [...] + + ' + - pattern-inside: '{..., "Effect": "Allow", ..., "Action": "sts:AssumeRole", ...} + + ' + - pattern: '"Principal": {..., "AWS": "*", ...} + + ' + message: 'Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of + the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam:::root`.' + metadata: + cwe: + - 'CWE-250: Execution with Unnecessary Privileges' + category: security + technology: + - aws + references: + - https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ + owasp: + - A06:2017 - Security Misconfiguration + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role + shortlink: https://sg.run/7YEZ + semgrep.dev: + rule: + r_id: 15138 + rv_id: 1263256 + rule_id: JDULx5 + version_id: BjTkZoy + url: https://semgrep.dev/playground/r/BjTkZoy/json.aws.security.wildcard-assume-role.wildcard-assume-role + origin: community + languages: + - json + severity: ERROR +- id: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded + message: A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and + other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate + the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables + can be used if allowed by your company policy. + severity: WARNING + metadata: + likelihood: LOW + impact: HIGH + confidence: MEDIUM + category: security + subcategory: + - vuln + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + cwe2020-top25: true + cwe2021-top25: true + cwe2022-top25: true + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures + technology: + - secrets + vulnerability_class: + - Hard-coded Secrets + source_rule_url: https://semgrep.dev/playground/r/d8Ur5BA/achufistov6_personal_org.build-gradle-password-hardcoded + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded + shortlink: https://sg.run/qN29x + semgrep.dev: + rule: + r_id: 137856 + rv_id: 1263257 + rule_id: ReUD6Kg + version_id: DkTRbLX + url: https://semgrep.dev/playground/r/DkTRbLX/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded + origin: community + languages: + - kotlin + options: + symbolic_propagation: true + patterns: + - pattern-either: + - pattern: '$PASS = env[...] ?: $VALUE' + - metavariable-regex: + metavariable: $PASS + regex: (password|pass|passwd|loginPassword) + - metavariable-pattern: + language: generic + metavariable: $VALUE + patterns: + - pattern-either: + - pattern-regex: ^[A-Za-z0-9/+=]+$ + paths: + include: + - '*build.gradle.kts' +- id: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind + metadata: + cwe: + - 'CWE-287: Improper Authentication' + owasp: + - A02:2017 - Broken Authentication + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS + category: security + technology: + - kotlin + references: + - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind + shortlink: https://sg.run/rY2n + semgrep.dev: + rule: + r_id: 15125 + rv_id: 1263258 + rule_id: v8U9Q7 + version_id: WrTqKgJ + url: https://semgrep.dev/playground/r/WrTqKgJ/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind + origin: community + message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication + for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information. + severity: WARNING + pattern: '$ENV.put($CTX.SECURITY_AUTHENTICATION, "none") + + ... + + $DCTX = InitialDirContext($ENV, ...) + + ' + languages: + - kt +- id: kotlin.lang.security.ecb-cipher.ecb-cipher + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE + category: security + technology: + - kotlin + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher + shortlink: https://sg.run/DzLj + semgrep.dev: + rule: + r_id: 14696 + rv_id: 1263263 + rule_id: DbU1Zd + version_id: YDTZexg + url: https://semgrep.dev/playground/r/YDTZexg/kotlin.lang.security.ecb-cipher.ecb-cipher + origin: community + message: Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an + attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY. + severity: WARNING + languages: + - kt + patterns: + - pattern-either: + - pattern: 'val $VAR : Cipher = $CIPHER.getInstance($MODE) + + ' + - pattern: 'var $VAR : Cipher = $CIPHER.getInstance($MODE) + + ' + - pattern: 'val $VAR = $CIPHER.getInstance($MODE) + + ' + - pattern: 'var $VAR = $CIPHER.getInstance($MODE) + + ' + - metavariable-regex: + metavariable: $MODE + regex: .*ECB.* +- id: kotlin.lang.security.no-null-cipher.no-null-cipher + pattern: NullCipher(...) + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + category: security + technology: + - kotlin + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher + shortlink: https://sg.run/0ywb + semgrep.dev: + rule: + r_id: 14698 + rv_id: 1263265 + rule_id: 0oU2Yy + version_id: o5TbDPj + url: https://semgrep.dev/playground/r/o5TbDPj/kotlin.lang.security.no-null-cipher.no-null-cipher + origin: community + message: 'NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use + a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions + for more information.' + severity: WARNING + languages: + - kt + - scala +- id: kotlin.lang.security.use-of-md5.use-of-md5 + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use SHA256 or SHA3 instead. + languages: + - kt + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-328: Use of Weak Hash' + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5 + category: security + technology: + - kotlin + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5 + shortlink: https://sg.run/4eQx + semgrep.dev: + rule: + r_id: 14700 + rv_id: 1263267 + rule_id: qNUXPj + version_id: pZT03Jd + url: https://semgrep.dev/playground/r/pZT03Jd/kotlin.lang.security.use-of-md5.use-of-md5 + origin: community + pattern-either: + - pattern: 'java.security.MessageDigest.getInstance("MD5") + + ' + - pattern: 'org.apache.commons.codec.digest.DigestUtils.getMd5Digest() + + ' +- id: kotlin.lang.security.use-of-sha1.use-of-sha1 + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + languages: + - kt + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1 + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + category: security + technology: + - kotlin + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1 + shortlink: https://sg.run/N1pp + semgrep.dev: + rule: + r_id: 15127 + rv_id: 1263268 + rule_id: ZqUOdd + version_id: 2KTv2XZ + url: https://semgrep.dev/playground/r/2KTv2XZ/kotlin.lang.security.use-of-sha1.use-of-sha1 + origin: community + pattern-either: + - patterns: + - pattern: '$VAR = $MD.getInstance("$ALGO") + + ' + - metavariable-regex: + metavariable: $ALGO + regex: (SHA1|SHA-1) + - pattern: '$DU.getSha1Digest().digest(...) + + ' +- id: kotlin.lang.security.weak-rsa.use-of-weak-rsa-key + message: RSA keys should be at least 2048 bits based on NIST recommendation. + languages: + - kt + severity: WARNING + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_KEY_SIZE + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms + category: security + technology: + - kotlin + subcategory: + - audit + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key + shortlink: https://sg.run/krq7 + semgrep.dev: + rule: + r_id: 15128 + rv_id: 1263269 + rule_id: nJUZNL + version_id: X0TzypE + url: https://semgrep.dev/playground/r/X0TzypE/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key + origin: community + patterns: + - pattern-either: + - pattern: '$KEY = $G.getInstance("RSA") + + ... + + $KEY.initialize($BITS) + + ' + - metavariable-comparison: + metavariable: $BITS + comparison: $BITS < 2048 +- id: package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age + pattern-either: + - patterns: + - pattern-regex: (?ms)\[install\](?P[^\[]*?)(?=\[|\z) + - metavariable-regex: + metavariable: $TARGET + regex: ^(?![\s\S]*minimumReleaseAge) + - focus-metavariable: $TARGET + - patterns: + - pattern-regex: minimumReleaseAge\s*=\s*\d+ + - pattern-regex: =\s*(?P\d+) + - metavariable-comparison: + metavariable: $AGE + comparison: int($AGE) < 604800 + - focus-metavariable: $AGE + - patterns: + - pattern-regex: (?m)minimumReleaseAge[ \t]*=[ \t]*(?P[^\s\d][^\n]*) + - focus-metavariable: $VAL + - patterns: + - pattern-regex: (?m)minimumReleaseAge\s*=\s*$ + message: 'This bunfig.toml does not set a minimum release age or sets it too low. Newly published packages can be malicious + or unstable. Add `minimumReleaseAge = 604800` under the `[install]` section to wait 7 days before resolving newly published + package versions. Added in: v1.3 Reference: https://bun.sh/docs/runtime/bunfig' + languages: + - generic + severity: MEDIUM + paths: + include: + - '**/bunfig.toml' + - '**/.bunfig.toml' + metadata: + category: security + technology: + - bun + - javascript + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://bun.sh/docs/runtime/bunfig + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age + shortlink: https://sg.run/JqPrR + semgrep.dev: + rule: + r_id: 291646 + rv_id: 1423385 + rule_id: oqUyJOb + version_id: BjTyRe5 + url: https://semgrep.dev/playground/r/BjTyRe5/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age + origin: community +- id: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + pattern-either: + - patterns: + - pattern-inside: "updates:\n ...\n" + - pattern: "- package-ecosystem: $ECOSYSTEM\n ...\n" + - pattern-not: "- package-ecosystem: $ECOSYSTEM\n ...\n cooldown:\n ...\n ...\n" + - patterns: + - pattern-inside: "updates:\n ...\n" + - pattern-regex: default-days\s*:\s*(?P\d+) + - metavariable-comparison: + metavariable: $DAYS + comparison: int($DAYS) < 7 + - focus-metavariable: $DAYS + - patterns: + - pattern-inside: "updates:\n ...\n" + - pattern: "cooldown:\n default-days: $DAYS\n" + - metavariable-regex: + metavariable: $DAYS + regex: ^\D + - focus-metavariable: $DAYS + message: 'This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. + Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before + proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown' + languages: + - yaml + severity: MEDIUM + paths: + include: + - '**/.github/dependabot.yml' + - '**/.github/dependabot.yaml' + metadata: + category: security + technology: + - dependabot + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + shortlink: https://sg.run/5WvGK + semgrep.dev: + rule: + r_id: 291647 + rv_id: 1423386 + rule_id: zdUArOL + version_id: DkTwEGl + url: https://semgrep.dev/playground/r/DkTwEGl/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + origin: community +- id: package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + pattern-either: + - patterns: + - pattern-regex: (?:(?:^---\n)(?:[^\n]*\n)|^)(?P(?:(?!\n---)[\s\S])*\S(?:(?!\n---)[\s\S])*) + - pattern-not-regex: min-release-age + - focus-metavariable: $TARGET + - patterns: + - pattern-regex: min-release-age\s*=\s*\d+ + - pattern-regex: =\s*(?P\d+) + - metavariable-comparison: + metavariable: $AGE + comparison: int($AGE) < 7 + - focus-metavariable: $AGE + - patterns: + - pattern-regex: (?m)min-release-age[ \t]*=[ \t]*(?P[^\s\d][^\n]*) + - focus-metavariable: $VAL + - patterns: + - pattern-regex: (?m)min-release-age\s*=\s*$ + message: 'This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or + unstable. Add `min-release-age = 7` to wait 7 days before resolving newly published package versions. Added in: v11.10 + Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/' + languages: + - generic + severity: MEDIUM + paths: + include: + - '**/.npmrc' + metadata: + category: security + technology: + - npm + - javascript + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/ + - https://github.com/npm/cli/pull/8965 + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + shortlink: https://sg.run/GRo1z + semgrep.dev: + rule: + r_id: 291648 + rv_id: 1423387 + rule_id: pKU6A82 + version_id: WrT7LdL + url: https://semgrep.dev/playground/r/WrT7LdL/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + origin: community +- id: package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies + message: 'Missing or incorrect blockExoticSubdeps. Set `blockExoticSubdeps: true` to transitive dependencies from being + installed from untrusted sources. Added in: v10.26.0 Reference: https://pnpm.io/settings#blockexoticsubdeps' + languages: + - yaml + severity: MEDIUM + paths: + include: + - '**/pnpm-workspace.yaml' + pattern-either: + - patterns: + - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^blockExoticSubdeps\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^blockExoticSubdeps\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) + - focus-metavariable: $TARGET + - patterns: + - pattern: 'blockExoticSubdeps: $VAL + + ' + - metavariable-regex: + metavariable: $VAL + regex: ^(?!true$).+ + - focus-metavariable: $VAL + - patterns: + - pattern-regex: (?m)^\s*blockExoticSubdeps\s*:\s*$ + metadata: + category: security + technology: + - pnpm + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://pnpm.io/settings#blockexoticsubdeps + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies + shortlink: https://sg.run/RrWRv + semgrep.dev: + rule: + r_id: 291649 + rv_id: 1423388 + rule_id: 2ZUQEZ5 + version_id: 0bTGnwj + url: https://semgrep.dev/playground/r/0bTGnwj/package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies + origin: community +- id: package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age + message: 'This pnpm workspace configuration does not set a minimum release age. Newly published packages can be malicious + or unstable. Add `minimumReleaseAge: 10080` (minutes) to wait at least seven days before installing newly published package + versions. Added in: v10.16.0 Reference: https://pnpm.io/settings#minimumreleaseage' + languages: + - yaml + severity: MEDIUM + paths: + include: + - '**/pnpm-workspace.yaml' + pattern-either: + - patterns: + - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) + - focus-metavariable: $TARGET + - patterns: + - pattern-regex: ^\s*minimumReleaseAge\s*:\s*(?P\d+) + - metavariable-comparison: + metavariable: $AGE + comparison: int($AGE) < 10080 + - focus-metavariable: $AGE + - patterns: + - pattern: 'minimumReleaseAge: $AGE + + ' + - metavariable-regex: + metavariable: $AGE + regex: ^\D + - focus-metavariable: $AGE + - patterns: + - pattern-regex: (?m)^\s*minimumReleaseAge\s*:\s*$ + metadata: + category: security + technology: + - pnpm + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://pnpm.io/settings#minimumreleaseage + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age + shortlink: https://sg.run/Aj0o0 + semgrep.dev: + rule: + r_id: 291650 + rv_id: 1423389 + rule_id: X5Uwn1n + version_id: K3TgxrW + url: https://semgrep.dev/playground/r/K3TgxrW/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age + origin: community +- id: package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy + message: 'Missing or incorrect trustPolicy. Set `trustPolicy: no-downgrade` to prevent malicious package updates from downgrading + security settings. Added in: v10.21.0 Reference: https://pnpm.io/settings#trustpolicy' + languages: + - yaml + severity: MEDIUM + paths: + include: + - '**/pnpm-workspace.yaml' + pattern-either: + - patterns: + - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^trustPolicy\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^trustPolicy\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) + - focus-metavariable: $TARGET + - patterns: + - pattern: 'trustPolicy: $VAL + + ' + - metavariable-regex: + metavariable: $VAL + regex: ^(?!no-downgrade$).+ + - focus-metavariable: $VAL + - patterns: + - pattern-regex: (?m)^\s*trustPolicy\s*:\s*$ + metadata: + category: security + technology: + - pnpm + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://pnpm.io/settings#minimumreleaseage + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy + shortlink: https://sg.run/B2Kz7 + semgrep.dev: + rule: + r_id: 291651 + rv_id: 1423390 + rule_id: j2U6J8N + version_id: qkTvDQn + url: https://semgrep.dev/playground/r/qkTvDQn/package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy + origin: community +- id: package_managers.poetry.poetry-missing-solver-min-release-age.poetry-missing-solver-min-release-age + message: 'This poetry.toml does not set a dependency cooldown via `solver.min-release-age`. Without a cooldown, Poetry may + resolve newly published package versions that have not yet been vetted by the community. Supply chain attacks frequently + involve publishing a malicious version of a popular package and waiting for it to be pulled in — most are detected and + removed within days. Set `min-release-age = 7` under `[solver]` to require that package versions are at least 7 days old + before they are considered during dependency resolution. Added in: v2.4.0' + languages: + - generic + severity: MEDIUM + paths: + include: + - '**/poetry.toml' + - '**/config.toml' + pattern-either: + - pattern-regex: (?m)^\[solver\]\n(?:^(?!min-release-age|\[|---).*\n)*(?=^\[|^---|\z) + - pattern-regex: (?ms)^\[solver\](?:[^\[]*?)min-release-age\s*=\s*(?P"[^"]*"|[0-6](?:\s|#|$)|false) + metadata: + category: security + technology: + - poetry + - python + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: MEDIUM + likelihood: LOW + impact: MEDIUM + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://python-poetry.org/docs/configuration/#solvermin-release-age + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.poetry.poetry-missing-solver-min-release-age.poetry-missing-solver-min-release-age + shortlink: https://sg.run/JqnYZ + semgrep.dev: + rule: + r_id: 309390 + rv_id: 1443453 + rule_id: kxUjBPy + version_id: X0TYPX6 + url: https://semgrep.dev/playground/r/X0TYPX6/package_managers.poetry.poetry-missing-solver-min-release-age.poetry-missing-solver-min-release-age + origin: community +- id: package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + pattern-either: + - patterns: + - pattern-inside: "\"packageRules\": [\n ...\n]\n" + - pattern-either: + - pattern: '{ ..., "matchPackageNames": [...], ... } + + ' + - pattern: '{ ..., "matchPackagePatterns": [...], ... } + + ' + - pattern: '{ ..., "matchDepTypes": [...], ... } + + ' + - pattern-not: "{\n ...,\n \"minimumReleaseAge\": $AGE,\n ...\n}\n" + - pattern-not: "{\n ...,\n \"minimumReleaseAge\": false,\n ...\n}\n" + - patterns: + - pattern-inside: "\"packageRules\": [\n ...\n]\n" + - pattern-regex: '"minimumReleaseAge":\s*"(?P\d+) days?"' + - metavariable-comparison: + metavariable: $AGE + comparison: int($AGE) < 7 + - focus-metavariable: $AGE + - patterns: + - pattern-inside: "\"packageRules\": [\n ...\n]\n" + - pattern: '"minimumReleaseAge": "$AGE" + + ' + - metavariable-regex: + metavariable: $AGE + regex: ^(?!\d+ days?$) + - focus-metavariable: $AGE + message: 'This Renovate configuration does not set a minimum release age. Newly published packages can be malicious or unstable. + Add `"minimumReleaseAge": "7 days"` within a `packageRules` entry to wait 7 days before proposing updates to newly published + package versions. Set `"minimumReleaseAge": false` to set an exception for minimal release age for the package rule. Added + in: v42' + languages: + - json + severity: MEDIUM + paths: + include: + - '**/renovate.json' + - '**/renovate.json5' + - '**/.renovaterc' + - '**/.renovaterc.json' + - '**/.renovaterc.json5' + metadata: + category: security + technology: + - renovate + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://docs.renovatebot.com/configuration-options/#minimumreleaseage + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + shortlink: https://sg.run/D8l2q + semgrep.dev: + rule: + r_id: 291652 + rv_id: 1443454 + rule_id: 10UbQrX + version_id: jQT1KAX + url: https://semgrep.dev/playground/r/jQT1KAX/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + origin: community +- id: package_managers.ruby.bundler-gemfile-missing-cooldown.bundler-gemfile-missing-cooldown + message: 'A Gemfile `source` declaration without a `cooldown` (or with a cooldown below 7 days) allows Bundler to resolve + newly published gem versions immediately, before the community has had time to detect malicious releases. The May 2026 + RubyGems supply-chain attack demonstrated that threat actors can push compromised gem versions and have them automatically + pulled into builds within minutes. Add `cooldown: 7` to each public source declaration so Bundler ignores gem versions + published within the last 7 days during dependency resolution (e.g. `source "https://rubygems.org", cooldown: 7`). If + you operate an internal or private registry where the supply-chain risk is lower, use `cooldown: 0` as an explicit bypass. + Note: this feature requires Bundler >= 4.0.13. Cooldown only applies during `bundle update` and `bundle add`; `bundle + install` with an existing lockfile is unaffected.' + languages: + - ruby + severity: MEDIUM + paths: + include: + - '**/Gemfile' + - '**/gems.rb' + exclude: + - '**/vendor/**' + - '**/.bundle/**' + pattern-either: + - patterns: + - pattern: source "...", ... + - pattern-not: 'source "...", ..., cooldown: $N, ...' + - patterns: + - pattern: 'source "...", ..., cooldown: $N, ...' + - metavariable-comparison: + metavariable: $N + comparison: $N > 0 and $N < 7 + - focus-metavariable: $N + metadata: + category: security + technology: + - bundler + - ruby + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: MEDIUM + likelihood: LOW + impact: MEDIUM + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.ruby.bundler-gemfile-missing-cooldown.bundler-gemfile-missing-cooldown + shortlink: https://sg.run/5Wlkl + semgrep.dev: + rule: + r_id: 309391 + rv_id: 1443455 + rule_id: wdUzPbP + version_id: 1QTEjAN + url: https://semgrep.dev/playground/r/1QTEjAN/package_managers.ruby.bundler-gemfile-missing-cooldown.bundler-gemfile-missing-cooldown + origin: community +- id: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + pattern-either: + - patterns: + - pattern-regex: (?ms)\[tool\.uv\](?P[^\[]*?)(?=\[|\z) + - metavariable-regex: + metavariable: $TARGET + regex: ^(?![\s\S]*exclude-newer) + - focus-metavariable: $TARGET + - patterns: + - pattern-regex: exclude-newer\s*=\s*"(?P\d+)\s*d(?:ays?)?" + - metavariable-comparison: + metavariable: $DAYS + comparison: int($DAYS) < 7 + - focus-metavariable: $DAYS + - patterns: + - pattern-regex: exclude-newer\s*=\s*"(?P[^"]+)" + - metavariable-regex: + metavariable: $VAL + regex: (?i)^(?!\d+\s*d(?:ays?)?\b)(?!\d+\s*(?:weeks?|wks?|w|months?|mos?|mo|years?|yrs?|y)\b)(?!P[^Tt]*[WMY])(?!P(?:[7-9]|[1-9]\d+)D\b) + - focus-metavariable: $VAL + message: 'This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious + or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package + versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns' + languages: + - generic + severity: MEDIUM + paths: + include: + - '**/pyproject.toml' + - '**/uv.toml' + metadata: + category: security + technology: + - uv + - python + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + shortlink: https://sg.run/WeY0Z + semgrep.dev: + rule: + r_id: 291653 + rv_id: 1501839 + rule_id: 9AUo6vE + version_id: kbT3B1J + url: https://semgrep.dev/playground/r/kbT3B1J/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + origin: community +- id: package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + pattern-either: + - patterns: + - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?P^(?:nodeLinker|yarnPath|enableGlobalCache|npmScopes|npmRegistryServer)\s*:)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) + - focus-metavariable: $TARGET + - patterns: + - pattern-regex: (?m)npmMinimalAgeGate\s*:\s*['"]?(?P\d+)d['"]? + - metavariable-comparison: + metavariable: $DAYS + comparison: int($DAYS) < 7 + - focus-metavariable: $DAYS + - patterns: + - pattern-regex: (?m)npmMinimalAgeGate[ \t]*:[ \t]*(?P\S+) + - metavariable-regex: + metavariable: $VAL + regex: ^(?!['"]?\d+d['"]?$) + - focus-metavariable: $VAL + - patterns: + - pattern-regex: (?m)^npmMinimalAgeGate\s*:\s*$ + message: 'This .yarnrc.yml does not set a minimal age gate or sets it too low. Newly published packages can be malicious + or unstable. Add `npmMinimalAgeGate: "7d"` to wait 7 days before resolving newly published package versions. Added in: + 4.10 Reference: https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate' + languages: + - yaml + severity: MEDIUM + paths: + include: + - '**/.yarnrc.yml' + metadata: + category: security + technology: + - yarn + - javascript + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + shortlink: https://sg.run/0gvNq + semgrep.dev: + rule: + r_id: 291654 + rv_id: 1423393 + rule_id: yyUBeEz + version_id: JdTnXlj + url: https://semgrep.dev/playground/r/JdTnXlj/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + origin: community +- id: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query + languages: + - php + message: '`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could + lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, + use parameterized queries or prepared statements instead.' + metadata: + category: security + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection + - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html + technology: + - doctrine + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query + shortlink: https://sg.run/jwDJ + semgrep.dev: + rule: + r_id: 13965 + rv_id: 1263271 + rule_id: kxUw23 + version_id: 1QTypnG + url: https://semgrep.dev/playground/r/1QTypnG/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query + origin: community + mode: taint + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern-either: + - pattern: $QUERY->add(...,$SINK,...) + - pattern: $QUERY->select(...,$SINK,...) + - pattern: $QUERY->addSelect(...,$SINK,...) + - pattern: $QUERY->delete(...,$SINK,...) + - pattern: $QUERY->update(...,$SINK,...) + - pattern: $QUERY->insert(...,$SINK,...) + - pattern: $QUERY->from(...,$SINK,...) + - pattern: $QUERY->join(...,$SINK,...) + - pattern: $QUERY->innerJoin(...,$SINK,...) + - pattern: $QUERY->leftJoin(...,$SINK,...) + - pattern: $QUERY->rightJoin(...,$SINK,...) + - pattern: $QUERY->where(...,$SINK,...) + - pattern: $QUERY->andWhere(...,$SINK,...) + - pattern: $QUERY->orWhere(...,$SINK,...) + - pattern: $QUERY->groupBy(...,$SINK,...) + - pattern: $QUERY->addGroupBy(...,$SINK,...) + - pattern: $QUERY->having(...,$SINK,...) + - pattern: $QUERY->andHaving(...,$SINK,...) + - pattern: $QUERY->orHaving(...,$SINK,...) + - pattern: $QUERY->orderBy(...,$SINK,...) + - pattern: $QUERY->addOrderBy(...,$SINK,...) + - pattern: $QUERY->set($SINK,...) + - pattern: $QUERY->setValue($SINK,...) + - pattern-either: + - pattern-inside: '$Q = $X->createQueryBuilder(); + + ... + + ' + - pattern-inside: '$Q = new QueryBuilder(...); + + ... + + ' + pattern-sources: + - patterns: + - pattern-either: + - pattern: sprintf(...) + - pattern: '"...".$SMTH + + ' + severity: WARNING +- id: php.lang.security.assert-use.assert-use + mode: taint + pattern-sources: + - pattern-either: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + - pattern: $_SERVER + - patterns: + - pattern: 'Route::$METHOD($ROUTENAME, function(..., $ARG, ...) { ... }) + + ' + - focus-metavariable: $ARG + pattern-sinks: + - patterns: + - pattern: assert($SINK, ...); + - pattern-not: assert("...", ...); + - pattern: $SINK + message: Calling assert with user input is equivalent to eval'ing. + metadata: + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + references: + - https://www.php.net/manual/en/function.assert + - https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php + category: security + technology: + - php + confidence: HIGH + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/php.lang.security.assert-use.assert-use + shortlink: https://sg.run/3xXW + semgrep.dev: + rule: + r_id: 9387 + rv_id: 1263272 + rule_id: DbUpjk + version_id: 9lT4bLx + url: https://semgrep.dev/playground/r/9lT4bLx/php.lang.security.assert-use.assert-use + origin: community + languages: + - php + severity: ERROR +- id: php.lang.security.audit.sha224-hash.sha224-hash + pattern-either: + - pattern: hash('sha224', ...); + - pattern: hash('sha512/224', ...); + - pattern: hash('sha3-224', ...); + - pattern: hash_hmac('sha224', ...); + - pattern: hash_hmac('sha512/224', ...); + - pattern: hash_hmac('sha3-224', ...); + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating + to a stronger hash function such as SHA-384 or higher to ensure compliance and security. + metadata: + cwe: + - 'CWE-328: Use of Weak Hash' + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf + - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography + category: security + technology: + - php + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/php.lang.security.audit.sha224-hash.sha224-hash + shortlink: https://sg.run/BYXqv + semgrep.dev: + rule: + r_id: 151751 + rv_id: 1263275 + rule_id: AbU97EA + version_id: bZT53Jo + url: https://semgrep.dev/playground/r/bZT53Jo/php.lang.security.audit.sha224-hash.sha224-hash + origin: community + languages: + - php + severity: WARNING +- id: php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off + patterns: + - pattern-either: + - pattern: '$ARG = $IS_VERIFIED; + + ... + + curl_setopt(..., CURLOPT_SSL_VERIFYPEER, $ARG); + + ' + - pattern: curl_setopt(..., CURLOPT_SSL_VERIFYPEER, $IS_VERIFIED) + - metavariable-regex: + metavariable: $IS_VERIFIED + regex: 0|false|null + message: SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED) + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + references: + - https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/ + category: security + technology: + - php + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off + shortlink: https://sg.run/PJqv + semgrep.dev: + rule: + r_id: 9389 + rv_id: 1263277 + rule_id: 0oU5Xg + version_id: kbTzG9b + url: https://semgrep.dev/playground/r/kbTzG9b/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off + origin: community + languages: + - php + severity: ERROR +- id: php.lang.security.deserialization.extract-user-data + mode: taint + pattern-sources: + - pattern-either: + - pattern: $_GET[...] + - pattern: $_FILES[...] + - pattern: $_POST[...] + pattern-sinks: + - pattern: extract(...) + pattern-sanitizers: + - pattern: extract($VAR, EXTR_SKIP,...) + message: Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to + prevent overwriting existing variables. + languages: + - php + metadata: + category: security + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + technology: + - php + references: + - https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data + shortlink: https://sg.run/6bv1 + semgrep.dev: + rule: + r_id: 18259 + rv_id: 1263278 + rule_id: nJUykq + version_id: w8TRovw + url: https://semgrep.dev/playground/r/w8TRovw/php.lang.security.deserialization.extract-user-data + origin: community + severity: ERROR +- id: php.lang.security.injection.echoed-request.echoed-request + mode: taint + message: '`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data + to users.' + languages: + - php + severity: ERROR + pattern-sources: + - pattern: $_REQUEST + - pattern: $_GET + - pattern: $_POST + pattern-sinks: + - pattern: echo $...VARS; + pattern-sanitizers: + - pattern: htmlentities(...) + - pattern: htmlspecialchars(...) + - pattern: strip_tags(...) + - pattern: isset(...) + - pattern: empty(...) + - pattern: esc_html(...) + - pattern: esc_attr(...) + - pattern: wp_kses(...) + - pattern: e(...) + - pattern: twig_escape_filter(...) + - pattern: xss_clean(...) + - pattern: html_escape(...) + - pattern: Html::escape(...) + - pattern: Xss::filter(...) + - pattern: escapeHtml(...) + - pattern: escapeHtml(...) + - pattern: escapeHtmlAttr(...) + fix: echo htmlentities($...VARS); + metadata: + technology: + - php + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + references: + - https://www.php.net/manual/en/function.htmlentities.php + - https://www.php.net/manual/en/reserved.variables.request.php + - https://www.php.net/manual/en/reserved.variables.post.php + - https://www.php.net/manual/en/reserved.variables.get.php + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/php.lang.security.injection.echoed-request.echoed-request + shortlink: https://sg.run/Bqqb + semgrep.dev: + rule: + r_id: 31707 + rv_id: 1263283 + rule_id: BYUyyg + version_id: d6TyxE9 + url: https://semgrep.dev/playground/r/d6TyxE9/php.lang.security.injection.echoed-request.echoed-request + origin: community +- id: php.lang.security.injection.printed-request.printed-request + mode: taint + message: '`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data + to users.' + languages: + - php + severity: ERROR + pattern-sources: + - pattern: $_REQUEST + - pattern: $_GET + - pattern: $_POST + pattern-sinks: + - pattern: print($...VARS); + pattern-sanitizers: + - pattern: htmlentities(...) + - pattern: htmlspecialchars(...) + - pattern: strip_tags(...) + - pattern: isset(...) + - pattern: empty(...) + - pattern: esc_html(...) + - pattern: esc_attr(...) + - pattern: wp_kses(...) + - pattern: e(...) + - pattern: twig_escape_filter(...) + - pattern: xss_clean(...) + - pattern: html_escape(...) + - pattern: Html::escape(...) + - pattern: Xss::filter(...) + - pattern: escapeHtml(...) + - pattern: escapeHtml(...) + - pattern: escapeHtmlAttr(...) + fix: print(htmlentities($...VARS)); + metadata: + technology: + - php + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + references: + - https://www.php.net/manual/en/function.htmlentities.php + - https://www.php.net/manual/en/reserved.variables.request.php + - https://www.php.net/manual/en/reserved.variables.post.php + - https://www.php.net/manual/en/reserved.variables.get.php + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request + shortlink: https://sg.run/QrxEJ + semgrep.dev: + rule: + r_id: 128886 + rv_id: 1263284 + rule_id: KxUvRBw + version_id: ZRTKAk4 + url: https://semgrep.dev/playground/r/ZRTKAk4/php.lang.security.injection.printed-request.printed-request + origin: community +- id: php.lang.security.injection.tainted-callable.tainted-callable + severity: WARNING + message: Callable based on user input risks remote code execution. + metadata: + technology: + - php + category: security + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://www.php.net/manual/en/language.types.callable.php + subcategory: + - vuln + impact: HIGH + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable + shortlink: https://sg.run/YGb33 + semgrep.dev: + rule: + r_id: 141958 + rv_id: 1263285 + rule_id: 0oULBKK + version_id: nWT2L5x + url: https://semgrep.dev/playground/r/nWT2L5x/php.lang.security.injection.tainted-callable.tainted-callable + origin: community + languages: + - php + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + - pattern: file_get_contents('php://input') + pattern-sinks: + - patterns: + - pattern: $CALLABLE + - pattern-either: + - pattern-inside: $ARRAYITERATOR->uasort($CALLABLE) + - pattern-inside: $ARRAYITERATOR->uksort($CALLABLE) + - pattern-inside: $EVENTHTTP->setCallback($CALLABLE, ...) + - pattern-inside: $EVENTHTTPCONNECTION->setCloseCallback($CALLABLE, ...) + - pattern-inside: $EVLOOP->fork($CALLABLE, ...) + - pattern-inside: $EVLOOP->idle($CALLABLE, ...) + - pattern-inside: $EVLOOP->prepare($CALLABLE, ...) + - pattern-inside: $EVWATCHER->setCallback($CALLABLE) + - pattern-inside: $GEARMANCLIENT->setClientCallback($CALLABLE) + - pattern-inside: $GEARMANCLIENT->setCompleteCallback($CALLABLE) + - pattern-inside: $GEARMANCLIENT->setCreatedCallback($CALLABLE) + - pattern-inside: $GEARMANCLIENT->setDataCallback($CALLABLE) + - pattern-inside: $GEARMANCLIENT->setExceptionCallback($CALLABLE) + - pattern-inside: $GEARMANCLIENT->setFailCallback($CALLABLE) + - pattern-inside: $GEARMANCLIENT->setStatusCallback($CALLABLE) + - pattern-inside: $GEARMANCLIENT->setWarningCallback($CALLABLE) + - pattern-inside: $GEARMANCLIENT->setWorkloadCallback($CALLABLE) + - pattern-inside: $IMAGICK->setProgressMonitor($CALLABLE) + - pattern-inside: $OAUTHPROVIDER->consumerHandler($CALLABLE) + - pattern-inside: $OAUTHPROVIDER->tokenHandler($CALLABLE) + - pattern-inside: $PDO->sqliteCreateCollation($NAME, $CALLABLE) + - pattern-inside: $PDOSTATEMENT->fetchAll(PDO::FETCH_FUNC, $CALLABLE) + - pattern-inside: $SQLITE3->createCollation($NAME, $CALLABLE) + - pattern-inside: $SQLITE3->setAuthorizer($CALLABLE) + - pattern-inside: $ZIPARCHIVE->registerCancelCallback($CALLABLE) + - pattern-inside: $ZIPARCHIVE->registerProgressCallback($RATE, $CALLABLE) + - pattern-inside: $ZMQDEVICE->setIdleCallback($CALLABLE, ...) + - pattern-inside: $ZMQDEVICE->setTimerCallback($CALLABLE, ...) + - pattern-inside: apcu_entry($KEY, $CALLABLE, ...) + - pattern-inside: array_filter($ARRAY, $CALLABLE, ...) + - pattern-inside: array_map($CALLABLE, ...) + - pattern-inside: array_reduce($ARRAY, $CALLABLE, ...) + - pattern-inside: array_walk_recursive($ARRAY, $CALLABLE, ...) + - pattern-inside: array_walk($ARRAY, $CALLABLE, ...) + - pattern-inside: call_user_func_array($CALLABLE, ...) + - pattern-inside: call_user_func($CALLABLE, ...) + - pattern-inside: Closure::fromCallable($CALLABLE) + - pattern-inside: createCollation($NAME, $CALLABLE) + - pattern-inside: eio_grp($CALLABLE, ...) + - pattern-inside: eio_nop($PRI, $CALLABLE, ...) + - pattern-inside: eio_sync($PRI, $CALLABLE, ...) + - pattern-inside: EvPrepare::createStopped($CALLABLE, ...) + - pattern-inside: fann_set_callback($ANN, $CALLABLE) + - pattern-inside: fdf_enum_values($FDF_DOCUMENT, $CALLABLE, ...) + - pattern-inside: forward_static_call_array($CALLABLE, ...) + - pattern-inside: forward_static_call($CALLABLE, ...) + - pattern-inside: header_register_callback($CALLABLE) + - pattern-inside: ibase_set_event_handler($CALLABLE, ...) + - pattern-inside: IntlChar::enumCharTypes($CALLABLE) + - pattern-inside: iterator_apply($ITERATOR, $CALLABLE) + - pattern-inside: ldap_set_rebind_proc($LDAP, $CALLABLE) + - pattern-inside: libxml_set_external_entity_loader($CALLABLE, ...) + - pattern-inside: new CallbackFilterIterator($ITERATOR, $CALLABLE) + - pattern-inside: new EvCheck($CALLABLE, ...) + - pattern-inside: new EventHttpRequest($CALLABLE, ...) + - pattern-inside: new EvFork($CALLABLE, ...) + - pattern-inside: new EvIdle($CALLABLE, ...) + - pattern-inside: new Fiber($CALLABLE) + - pattern-inside: new Memcached($PERSISTENT_ID, $CALLABLE, ...) + - pattern-inside: new RecursiveCallbackFilterIterator($ITERATOR, $CALLABLE) + - pattern-inside: new Zookeeper($HOST, $CALLABLE, ...) + - pattern-inside: ob_start($CALLABLE, ...) + - pattern-inside: oci_register_taf_callback($CONNECTION, $CALLABLE) + - pattern-inside: readline_callback_handler_install($PROMPT, $CALLABLE) + - pattern-inside: readline_completion_function($CALLABLE) + - pattern-inside: register_shutdown_function($CALLABLE, ...) + - pattern-inside: register_tick_function($CALLABLE, ...) + - pattern-inside: rnp_ffi_set_pass_provider($FFI, $CALLABLE) + - pattern-inside: sapi_windows_set_ctrl_handler($CALLABLE, ...) + - pattern-inside: set_error_handler($CALLABLE, ...) + - pattern-inside: set_exception_handler($CALLABLE) + - pattern-inside: setAuthorizer($CALLABLE) + - pattern-inside: spl_autoload_register($CALLABLE, ...) + - pattern-inside: uasort($ARRAY, $CALLABLE) + - pattern-inside: uksort($ARRAY, $CALLABLE) + - pattern-inside: usort($ARRAY, $CALLABLE) + - pattern-inside: xml_set_character_data_handler($PARSER, $CALLABLE) + - pattern-inside: xml_set_default_handler($PARSER, $CALLABLE) + - pattern-inside: xml_set_element_handler($PARSER, $CALLABLE, $CALLABLE) + - pattern-inside: xml_set_notation_decl_handler($PARSER, $CALLABLE) + - pattern-inside: Yar_Concurrent_Client::loop($CALLABLE, ...) +- id: php.lang.security.injection.tainted-exec.tainted-exec + languages: + - php + severity: WARNING + message: User input is passed to a function that executes a shell command. This can lead to remote code execution. + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + category: security + technology: + - php + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + subcategory: + - vuln + impact: HIGH + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec + shortlink: https://sg.run/kxEEz + semgrep.dev: + rule: + r_id: 146572 + rv_id: 1263286 + rule_id: 10UOGG5 + version_id: ExTExyR + url: https://semgrep.dev/playground/r/ExTExyR/php.lang.security.injection.tainted-exec.tainted-exec + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + - pattern: file_get_contents('php://input') + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern: escapeshellcmd(...) + - pattern: escapeshellarg(...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: exec(...) + - pattern: system(...) + - pattern: passthru(...) + - patterns: + - pattern: proc_open(...) + - pattern-not: proc_open([...], ...) + - pattern: popen(...) + - pattern: expect_popen(...) + - pattern: shell_exec(...) + - pattern: '`...` + + ' +- id: php.lang.security.injection.tainted-filename.tainted-filename + severity: WARNING + message: File name based on user input risks server-side request forgery. + metadata: + technology: + - php + category: security + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29 + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename + shortlink: https://sg.run/Ayqp + semgrep.dev: + rule: + r_id: 16250 + rv_id: 1263287 + rule_id: 5rUpro + version_id: 7ZTE3J1 + url: https://semgrep.dev/playground/r/7ZTE3J1/php.lang.security.injection.tainted-filename.tainted-filename + origin: community + languages: + - php + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + - pattern: $_SERVER + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern-inside: basename($PATH, ...) + - pattern-inside: linkinfo($PATH, ...) + - pattern-inside: readlink($PATH, ...) + - pattern-inside: realpath($PATH, ...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: opcache_compile_file($FILENAME, ...) + - pattern-inside: opcache_invalidate($FILENAME, ...) + - pattern-inside: opcache_is_script_cached($FILENAME, ...) + - pattern-inside: runkit7_import($FILENAME, ...) + - pattern-inside: readline_read_history($FILENAME, ...) + - pattern-inside: readline_write_history($FILENAME, ...) + - pattern-inside: rar_open($FILENAME, ...) + - pattern-inside: zip_open($FILENAME, ...) + - pattern-inside: gzfile($FILENAME, ...) + - pattern-inside: gzopen($FILENAME, ...) + - pattern-inside: readgzfile($FILENAME, ...) + - pattern-inside: hash_file($ALGO, $FILENAME, ...) + - pattern-inside: hash_update_file($CONTEXT, $FILENAME, ...) + - pattern-inside: pg_trace($FILENAME, ...) + - pattern-inside: dio_open($FILENAME, ...) + - pattern-inside: finfo_file($FINFO, $FILENAME, ...) + - pattern-inside: mime_content_type($FILENAME, ...) + - pattern-inside: chgrp($FILENAME, ...) + - pattern-inside: chmod($FILENAME, ...) + - pattern-inside: chown($FILENAME, ...) + - pattern-inside: clearstatcache($CLEAR_REALPATH_CACHE, $FILENAME, ...) + - pattern-inside: file_exists($FILENAME, ...) + - pattern-inside: file_get_contents($FILENAME, ...) + - pattern-inside: file_put_contents($FILENAME, ...) + - pattern-inside: file($FILENAME, ...) + - pattern-inside: fileatime($FILENAME, ...) + - pattern-inside: filectime($FILENAME, ...) + - pattern-inside: filegroup($FILENAME, ...) + - pattern-inside: fileinode($FILENAME, ...) + - pattern-inside: filemtime($FILENAME, ...) + - pattern-inside: fileowner($FILENAME, ...) + - pattern-inside: fileperms($FILENAME, ...) + - pattern-inside: filesize($FILENAME, ...) + - pattern-inside: filetype($FILENAME, ...) + - pattern-inside: fnmatch($PATTERN, $FILENAME, ...) + - pattern-inside: fopen($FILENAME, ...) + - pattern-inside: is_dir($FILENAME, ...) + - pattern-inside: is_executable($FILENAME, ...) + - pattern-inside: is_file($FILENAME, ...) + - pattern-inside: is_link($FILENAME, ...) + - pattern-inside: is_readable($FILENAME, ...) + - pattern-inside: is_uploaded_file($FILENAME, ...) + - pattern-inside: is_writable($FILENAME, ...) + - pattern-inside: lchgrp($FILENAME, ...) + - pattern-inside: lchown($FILENAME, ...) + - pattern-inside: lstat($FILENAME, ...) + - pattern-inside: parse_ini_file($FILENAME, ...) + - pattern-inside: readfile($FILENAME, ...) + - pattern-inside: stat($FILENAME, ...) + - pattern-inside: touch($FILENAME, ...) + - pattern-inside: unlink($FILENAME, ...) + - pattern-inside: xattr_get($FILENAME, ...) + - pattern-inside: xattr_list($FILENAME, ...) + - pattern-inside: xattr_remove($FILENAME, ...) + - pattern-inside: xattr_set($FILENAME, ...) + - pattern-inside: xattr_supported($FILENAME, ...) + - pattern-inside: enchant_broker_request_pwl_dict($BROKER, $FILENAME, ...) + - pattern-inside: pspell_config_personal($CONFIG, $FILENAME, ...) + - pattern-inside: pspell_config_repl($CONFIG, $FILENAME, ...) + - pattern-inside: pspell_new_personal($FILENAME, ...) + - pattern-inside: exif_imagetype($FILENAME, ...) + - pattern-inside: getimagesize($FILENAME, ...) + - pattern-inside: image2wbmp($IMAGE, $FILENAME, ...) + - pattern-inside: imagecreatefromavif($FILENAME, ...) + - pattern-inside: imagecreatefrombmp($FILENAME, ...) + - pattern-inside: imagecreatefromgd2($FILENAME, ...) + - pattern-inside: imagecreatefromgd2part($FILENAME, ...) + - pattern-inside: imagecreatefromgd($FILENAME, ...) + - pattern-inside: imagecreatefromgif($FILENAME, ...) + - pattern-inside: imagecreatefromjpeg($FILENAME, ...) + - pattern-inside: imagecreatefrompng($FILENAME, ...) + - pattern-inside: imagecreatefromtga($FILENAME, ...) + - pattern-inside: imagecreatefromwbmp($FILENAME, ...) + - pattern-inside: imagecreatefromwebp($FILENAME, ...) + - pattern-inside: imagecreatefromxbm($FILENAME, ...) + - pattern-inside: imagecreatefromxpm($FILENAME, ...) + - pattern-inside: imageloadfont($FILENAME, ...) + - pattern-inside: imagexbm($IMAGE, $FILENAME, ...) + - pattern-inside: iptcembed($IPTC_DATA, $FILENAME, ...) + - pattern-inside: mailparse_msg_extract_part_file($MIMEMAIL, $FILENAME, ...) + - pattern-inside: mailparse_msg_extract_whole_part_file($MIMEMAIL, $FILENAME, ...) + - pattern-inside: mailparse_msg_parse_file($FILENAME, ...) + - pattern-inside: fdf_add_template($FDF_DOCUMENT, $NEWPAGE, $FILENAME, ...) + - pattern-inside: fdf_get_ap($FDF_DOCUMENT, $FIELD, $FACE, $FILENAME, ...) + - pattern-inside: fdf_open($FILENAME, ...) + - pattern-inside: fdf_save($FDF_DOCUMENT, $FILENAME, ...) + - pattern-inside: fdf_set_ap($FDF_DOCUMENT, $FIELD_NAME, $FACE, $FILENAME, ...) + - pattern-inside: ps_add_launchlink($PSDOC, $LLX, $LLY, $URX, $URY, $FILENAME, ...) + - pattern-inside: ps_add_pdflink($PSDOC, $LLX, $LLY, $URX, $URY, $FILENAME, ...) + - pattern-inside: ps_open_file($PSDOC, $FILENAME, ...) + - pattern-inside: ps_open_image_file($PSDOC, $TYPE, $FILENAME, ...) + - pattern-inside: posix_access($FILENAME, ...) + - pattern-inside: posix_mkfifo($FILENAME, ...) + - pattern-inside: posix_mknod($FILENAME, ...) + - pattern-inside: ftok($FILENAME, ...) + - pattern-inside: fann_cascadetrain_on_file($ANN, $FILENAME, ...) + - pattern-inside: fann_read_train_from_file($FILENAME, ...) + - pattern-inside: fann_train_on_file($ANN, $FILENAME, ...) + - pattern-inside: highlight_file($FILENAME, ...) + - pattern-inside: php_strip_whitespace($FILENAME, ...) + - pattern-inside: stream_resolve_include_path($FILENAME, ...) + - pattern-inside: swoole_async_read($FILENAME, ...) + - pattern-inside: swoole_async_readfile($FILENAME, ...) + - pattern-inside: swoole_async_write($FILENAME, ...) + - pattern-inside: swoole_async_writefile($FILENAME, ...) + - pattern-inside: swoole_load_module($FILENAME, ...) + - pattern-inside: tidy_parse_file($FILENAME, ...) + - pattern-inside: tidy_repair_file($FILENAME, ...) + - pattern-inside: get_meta_tags($FILENAME, ...) + - pattern-inside: yaml_emit_file($FILENAME, ...) + - pattern-inside: yaml_parse_file($FILENAME, ...) + - pattern-inside: curl_file_create($FILENAME, ...) + - pattern-inside: ftp_chmod($FTP, $PERMISSIONS, $FILENAME, ...) + - pattern-inside: ftp_delete($FTP, $FILENAME, ...) + - pattern-inside: ftp_mdtm($FTP, $FILENAME, ...) + - pattern-inside: ftp_size($FTP, $FILENAME, ...) + - pattern-inside: rrd_create($FILENAME, ...) + - pattern-inside: rrd_fetch($FILENAME, ...) + - pattern-inside: rrd_graph($FILENAME, ...) + - pattern-inside: rrd_info($FILENAME, ...) + - pattern-inside: rrd_last($FILENAME, ...) + - pattern-inside: rrd_lastupdate($FILENAME, ...) + - pattern-inside: rrd_tune($FILENAME, ...) + - pattern-inside: rrd_update($FILENAME, ...) + - pattern-inside: snmp_read_mib($FILENAME, ...) + - pattern-inside: ssh2_sftp_chmod($SFTP, $FILENAME, ...) + - pattern-inside: ssh2_sftp_realpath($SFTP, $FILENAME, ...) + - pattern-inside: ssh2_sftp_unlink($SFTP, $FILENAME, ...) + - pattern-inside: apache_lookup_uri($FILENAME, ...) + - pattern-inside: md5_file($FILENAME, ...) + - pattern-inside: sha1_file($FILENAME, ...) + - pattern-inside: simplexml_load_file($FILENAME, ...) + - pattern: $FILENAME +- id: php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation + languages: + - php + severity: WARNING + message: <- A new object is created where the class name is based on user input. This could lead to remote code execution, + as it allows to instantiate any class in the application. + metadata: + cwe: + - 'CWE-470: Use of Externally-Controlled Input to Select Classes or Code (''Unsafe Reflection'')' + category: security + technology: + - php + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation + shortlink: https://sg.run/7ndw + semgrep.dev: + rule: + r_id: 16438 + rv_id: 1263288 + rule_id: v8U4DA + version_id: LjTkgLy + url: https://semgrep.dev/playground/r/LjTkgLy/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + - pattern: $_SERVER + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: new $SINK(...) + - pattern: $SINK +- id: php.lang.security.injection.tainted-session.tainted-session + severity: WARNING + message: Session key based on user input risks session poisoning. The user can determine the key used for the session, and + thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating + the session can result in access control issues. + metadata: + technology: + - php + category: security + cwe: + - 'CWE-284: Improper Access Control' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://en.wikipedia.org/wiki/Session_poisoning + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session + shortlink: https://sg.run/bxNp + semgrep.dev: + rule: + r_id: 73470 + rv_id: 1263289 + rule_id: 4bUdoP + version_id: 8KT5rPE + url: https://semgrep.dev/playground/r/8KT5rPE/php.lang.security.injection.tainted-session.tainted-session + origin: community + languages: + - php + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern: $A . $B + - pattern: bin2hex(...) + - pattern: crc32(...) + - pattern: crypt(...) + - pattern: filter_input(...) + - pattern: filter_var(...) + - pattern: hash(...) + - pattern: md5(...) + - pattern: preg_filter(...) + - pattern: preg_grep(...) + - pattern: preg_match_all(...) + - pattern: sha1(...) + - pattern: sprintf(...) + - pattern: str_contains(...) + - pattern: str_ends_with(...) + - pattern: str_starts_with(...) + - pattern: strcasecmp(...) + - pattern: strchr(...) + - pattern: stripos(...) + - pattern: stristr(...) + - pattern: strnatcasecmp(...) + - pattern: strnatcmp(...) + - pattern: strncmp(...) + - pattern: strpbrk(...) + - pattern: strpos(...) + - pattern: strripos(...) + - pattern: strrpos(...) + - pattern: strspn(...) + - pattern: strstr(...) + - pattern: strtok(...) + - pattern: substr_compare(...) + - pattern: substr_count(...) + - pattern: vsprintf(...) + pattern-sinks: + - patterns: + - pattern-inside: $_SESSION[$KEY] = $VAL; + - pattern: $KEY +- id: php.lang.security.injection.tainted-sql-string.tainted-sql-string + languages: + - php + severity: ERROR + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using + prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of + SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements + (`$mysqli->prepare("INSERT INTO test(id, label) VALUES (?, ?)");`) or a safe library. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/SQL_Injection + category: security + technology: + - php + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/lZYG + semgrep.dev: + rule: + r_id: 14757 + rv_id: 1263290 + rule_id: qNUXdL + version_id: gETB7vY + url: https://semgrep.dev/playground/r/gETB7vY/php.lang.security.injection.tainted-sql-string.tainted-sql-string + origin: community + mode: taint + pattern-sanitizers: + - pattern-either: + - pattern: mysqli_real_escape_string(...) + - pattern: real_escape_string(...) + - pattern: $MYSQLI->real_escape_string(...) + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + pattern-sinks: + - pattern-either: + - patterns: + - pattern: 'sprintf($SQLSTR, ...) + + ' + - metavariable-regex: + metavariable: $SQLSTR + regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.* + - patterns: + - pattern: '"...$EXPR..." + + ' + - metavariable-regex: + metavariable: $EXPR + regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.* + - patterns: + - pattern: '"$SQLSTR".$EXPR + + ' + - metavariable-regex: + metavariable: $SQLSTR + regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.* +- id: php.lang.security.injection.tainted-url-host.tainted-url-host + languages: + - php + severity: WARNING + message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data + to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. + They could also probe internal servers or other resources that the server running this code can access. (This is called + server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, + or hardcode the correct host. + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html + category: security + technology: + - php + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host + shortlink: https://sg.run/Y8no + semgrep.dev: + rule: + r_id: 14758 + rv_id: 1263291 + rule_id: lBU8K1 + version_id: QkTGqRd + url: https://semgrep.dev/playground/r/QkTGqRd/php.lang.security.injection.tainted-url-host.tainted-url-host + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + pattern-sinks: + - pattern-either: + - patterns: + - pattern: 'sprintf($URLSTR, ...) + + ' + - metavariable-pattern: + metavariable: $URLSTR + language: generic + pattern: $SCHEME://%s + - patterns: + - pattern: '"...{$EXPR}..." + + ' + - pattern-regex: '.*://\{.* + + ' + - patterns: + - pattern: '"...$EXPR..." + + ' + - pattern-regex: '.*://\$.* + + ' + - patterns: + - pattern: '"...".$EXPR + + ' + - pattern-regex: '.*://["''].* + + ' +- id: php.lang.security.md5-used-as-password.md5-used-as-password + severity: WARNING + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked + by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, + PASSWORD_BCRYPT, $OPTIONS);`. + languages: + - php + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://tools.ietf.org/html/rfc6151 + - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision + - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords + - https://github.com/returntocorp/semgrep-rules/issues/1609 + - https://www.php.net/password_hash + category: security + technology: + - md5 + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password + shortlink: https://sg.run/66YL + semgrep.dev: + rule: + r_id: 14759 + rv_id: 1263294 + rule_id: YGUD1O + version_id: PkTR37j + url: https://semgrep.dev/playground/r/PkTR37j/php.lang.security.md5-used-as-password.md5-used-as-password + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: md5(...) + - pattern: hash('md5', ...) + pattern-sinks: + - patterns: + - pattern: $FUNCTION(...) + - metavariable-regex: + metavariable: $FUNCTION + regex: (?i)(.*password.*) +- id: php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv + patterns: + - pattern-either: + - pattern: openssl_encrypt($D, $M, $K, $FLAGS, "...",...); + - pattern: openssl_decrypt($D, $M, $K, $FLAGS, "...",...); + - metavariable-comparison: + metavariable: $M + comparison: re.match(".*-CBC",$M) + message: Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data. + languages: + - php + severity: ERROR + metadata: + cwe: + - 'CWE-329: Generation of Predictable IV with CBC Mode' + references: + - https://csrc.nist.gov/publications/detail/sp/800-38a/final + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + technology: + - php + - openssl + category: security + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv + shortlink: https://sg.run/LgWJ + semgrep.dev: + rule: + r_id: 19039 + rv_id: 1263295 + rule_id: DbUGbE + version_id: JdTzxOD + url: https://semgrep.dev/playground/r/JdTzxOD/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv + origin: community +- id: php.lang.security.phpinfo-use.phpinfo-use + pattern: phpinfo(...); + message: The 'phpinfo' function may reveal sensitive information about your environment. + metadata: + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + references: + - https://www.php.net/manual/en/function.phpinfo + - https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php + category: security + technology: + - php + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use + shortlink: https://sg.run/W82E + semgrep.dev: + rule: + r_id: 9397 + rv_id: 1263298 + rule_id: ReUglY + version_id: RGT0LN0 + url: https://semgrep.dev/playground/r/RGT0LN0/php.lang.security.phpinfo-use.phpinfo-use + origin: community + languages: + - php + severity: ERROR +- id: php.lang.security.redirect-to-request-uri.redirect-to-request-uri + patterns: + - pattern-either: + - pattern: 'header(''$LOCATION'' . $_SERVER[''REQUEST_URI'']); + + ' + - pattern: 'header(''$LOCATION'' . $_SERVER[''REQUEST_URI''] . $MORE); + + ' + - metavariable-regex: + metavariable: $LOCATION + regex: ^(?i)location:\s*$ + message: Redirecting to the current request URL may redirect to another domain, if the current path starts with two slashes. E.g. + in https://www.example.com//attacker.com, the value of REQUEST_URI is //attacker.com, and redirecting to it will redirect + to that domain. + metadata: + references: + - https://www.php.net/manual/en/reserved.variables.server.php + - https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html + category: security + technology: + - php + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + likelihood: MEDIUM + impact: LOW + confidence: MEDIUM + subcategory: + - vuln + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/php.lang.security.redirect-to-request-uri.redirect-to-request-uri + shortlink: https://sg.run/RWl2 + semgrep.dev: + rule: + r_id: 35493 + rv_id: 1263299 + rule_id: 3qUb4n + version_id: A8Tgdvq + url: https://semgrep.dev/playground/r/A8Tgdvq/php.lang.security.redirect-to-request-uri.redirect-to-request-uri + origin: community + languages: + - php + severity: WARNING +- id: php.lang.security.tainted-exec.tainted-exec + mode: taint + pattern-sources: + - pattern: $_REQUEST + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + pattern-sinks: + - pattern: exec(...) + - pattern: system(...) + - pattern: popen(...) + - pattern: passthru(...) + - pattern: shell_exec(...) + - pattern: pcntl_exec(...) + - pattern: proc_open(...) + pattern-sanitizers: + - pattern: escapeshellarg(...) + message: Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using + command. + metadata: + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + references: + - https://www.stackhawk.com/blog/php-command-injection/ + - https://brightsec.com/blog/code-injection-php/ + - https://www.acunetix.com/websitesecurity/php-security-2/ + category: security + technology: + - php + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec + shortlink: https://sg.run/JAkP + semgrep.dev: + rule: + r_id: 73146 + rv_id: 1263300 + rule_id: 9AUw06 + version_id: BjTkZ4y + url: https://semgrep.dev/playground/r/BjTkZ4y/php.lang.security.tainted-exec.tainted-exec + origin: community + languages: + - php + severity: ERROR +- id: php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection + mode: taint + pattern-sources: + - patterns: + - focus-metavariable: $ARG + - pattern-inside: 'Route::$METHOD($ROUTE_NAME, function(...,$ARG,...){...}) + + ' + pattern-sanitizers: + - patterns: + - pattern: 'DB::raw("...",[...]) + + ' + pattern-sinks: + - patterns: + - pattern: 'DB::raw(...) + + ' + message: HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe + interpolation. + languages: + - php + severity: WARNING + metadata: + category: security + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md + technology: + - php + - laravel + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection + shortlink: https://sg.run/x94g + semgrep.dev: + rule: + r_id: 21674 + rv_id: 1263305 + rule_id: zdUln0 + version_id: qkTR7A9 + url: https://semgrep.dev/playground/r/qkTR7A9/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection + origin: community +- id: php.laravel.security.laravel-sql-injection.laravel-sql-injection + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + category: security + technology: + - laravel + references: + - https://laravel.com/docs/8.x/queries + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection + shortlink: https://sg.run/x40p + semgrep.dev: + rule: + r_id: 16830 + rv_id: 1263313 + rule_id: j2UQdp + version_id: BjTkZ45 + url: https://semgrep.dev/playground/r/BjTkZ45/php.laravel.security.laravel-sql-injection.laravel-sql-injection + origin: community + severity: WARNING + message: Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive + data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements. + languages: + - php + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + - pattern: $_SERVER + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: $SQL + - pattern-either: + - pattern-inside: DB::table(...)->whereRaw($SQL, ...) + - pattern-inside: DB::table(...)->orWhereRaw($SQL, ...) + - pattern-inside: DB::table(...)->groupByRaw($SQL, ...) + - pattern-inside: DB::table(...)->havingRaw($SQL, ...) + - pattern-inside: DB::table(...)->orHavingRaw($SQL, ...) + - pattern-inside: DB::table(...)->orderByRaw($SQL, ...) + - patterns: + - pattern: $EXPRESSION + - pattern-either: + - pattern-inside: DB::table(...)->selectRaw($EXPRESSION, ...) + - pattern-inside: DB::table(...)->fromRaw($EXPRESSION, ...) + - patterns: + - pattern: $COLUMNS + - pattern-either: + - pattern-inside: DB::table(...)->whereNull($COLUMNS, ...) + - pattern-inside: DB::table(...)->orWhereNull($COLUMN) + - pattern-inside: DB::table(...)->whereNotNull($COLUMNS, ...) + - pattern-inside: DB::table(...)->whereRowValues($COLUMNS, ...) + - pattern-inside: DB::table(...)->orWhereRowValues($COLUMNS, ...) + - pattern-inside: DB::table(...)->find($ID, $COLUMNS) + - pattern-inside: DB::table(...)->paginate($PERPAGE, $COLUMNS, ...) + - pattern-inside: DB::table(...)->simplePaginate($PERPAGE, $COLUMNS, ...) + - pattern-inside: DB::table(...)->cursorPaginate($PERPAGE, $COLUMNS, ...) + - pattern-inside: DB::table(...)->getCountForPagination($COLUMNS) + - pattern-inside: DB::table(...)->aggregate($FUNCTION, $COLUMNS) + - pattern-inside: DB::table(...)->numericAggregate($FUNCTION, $COLUMNS) + - pattern-inside: DB::table(...)->insertUsing($COLUMNS, ...) + - pattern-inside: DB::table(...)->select($COLUMNS) + - pattern-inside: DB::table(...)->get($COLUMNS) + - pattern-inside: DB::table(...)->count($COLUMNS) + - patterns: + - pattern: $COLUMN + - pattern-either: + - pattern-inside: DB::table(...)->whereIn($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereIn($COLUMN, ...) + - pattern-inside: DB::table(...)->whereNotIn($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereNotIn($COLUMN, ...) + - pattern-inside: DB::table(...)->whereIntegerInRaw($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereIntegerInRaw($COLUMN, ...) + - pattern-inside: DB::table(...)->whereIntegerNotInRaw($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereIntegerNotInRaw($COLUMN, ...) + - pattern-inside: DB::table(...)->whereBetweenColumns($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereBetween($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereBetweenColumns($COLUMN, ...) + - pattern-inside: DB::table(...)->whereNotBetween($COLUMN, ...) + - pattern-inside: DB::table(...)->whereNotBetweenColumns($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereNotBetween($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereNotBetweenColumns($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereNotNull($COLUMN) + - pattern-inside: DB::table(...)->whereDate($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereDate($COLUMN, ...) + - pattern-inside: DB::table(...)->whereTime($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereTime($COLUMN, ...) + - pattern-inside: DB::table(...)->whereDay($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereDay($COLUMN, ...) + - pattern-inside: DB::table(...)->whereMonth($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereMonth($COLUMN, ...) + - pattern-inside: DB::table(...)->whereYear($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereYear($COLUMN, ...) + - pattern-inside: DB::table(...)->whereJsonContains($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereJsonContains($COLUMN, ...) + - pattern-inside: DB::table(...)->whereJsonDoesntContain($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereJsonDoesntContain($COLUMN, ...) + - pattern-inside: DB::table(...)->whereJsonLength($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhereJsonLength($COLUMN, ...) + - pattern-inside: DB::table(...)->having($COLUMN, ...) + - pattern-inside: DB::table(...)->orHaving($COLUMN, ...) + - pattern-inside: DB::table(...)->havingBetween($COLUMN, ...) + - pattern-inside: DB::table(...)->orderBy($COLUMN, ...) + - pattern-inside: DB::table(...)->orderByDesc($COLUMN) + - pattern-inside: DB::table(...)->latest($COLUMN) + - pattern-inside: DB::table(...)->oldest($COLUMN) + - pattern-inside: DB::table(...)->forPageBeforeId($PERPAGE, $LASTID, $COLUMN) + - pattern-inside: DB::table(...)->forPageAfterId($PERPAGE, $LASTID, $COLUMN) + - pattern-inside: DB::table(...)->value($COLUMN) + - pattern-inside: DB::table(...)->pluck($COLUMN, ...) + - pattern-inside: DB::table(...)->implode($COLUMN, ...) + - pattern-inside: DB::table(...)->min($COLUMN) + - pattern-inside: DB::table(...)->max($COLUMN) + - pattern-inside: DB::table(...)->sum($COLUMN) + - pattern-inside: DB::table(...)->avg($COLUMN) + - pattern-inside: DB::table(...)->average($COLUMN) + - pattern-inside: DB::table(...)->increment($COLUMN, ...) + - pattern-inside: DB::table(...)->decrement($COLUMN, ...) + - pattern-inside: DB::table(...)->where($COLUMN, ...) + - pattern-inside: DB::table(...)->orWhere($COLUMN, ...) + - pattern-inside: DB::table(...)->addSelect($COLUMN) + - patterns: + - pattern: $QUERY + - pattern-inside: DB::unprepared($QUERY) +- id: php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator + mode: taint + pattern-sources: + - patterns: + - pattern: 'public function $F(...,Request $R,...){...} + + ' + - focus-metavariable: $R + - patterns: + - pattern-either: + - pattern: '$this->$PROPERTY + + ' + - pattern: '$this->$PROPERTY->$GET + + ' + - metavariable-pattern: + metavariable: $PROPERTY + patterns: + - pattern-either: + - pattern: query + - pattern: request + - pattern: headers + - pattern: cookies + - pattern: cookie + - pattern: files + - pattern: file + - pattern: allFiles + - pattern: input + - pattern: all + - pattern: post + - pattern: json + - pattern-either: + - pattern-inside: 'class $CL extends Illuminate\Http\Request {...} + + ' + - pattern-inside: 'class $CL extends Illuminate\Foundation\Http\FormRequest {...} + + ' + pattern-sinks: + - patterns: + - pattern: 'Illuminate\Validation\Rule::unique(...)->ignore(...,$IGNORE,...) + + ' + - focus-metavariable: $IGNORE + message: Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection. + languages: + - php + severity: ERROR + metadata: + category: security + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + technology: + - php + - laravel + references: + - https://laravel.com/docs/9.x/validation#rule-unique + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator + shortlink: https://sg.run/vkeb + semgrep.dev: + rule: + r_id: 21677 + rv_id: 1263314 + rule_id: X5ULgE + version_id: DkTRbBl + url: https://semgrep.dev/playground/r/DkTRbBl/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator + origin: community +- id: php.wordpress-plugins.security.audit.wp-ssrf-audit.wp-ssrf-audit + languages: + - php + severity: WARNING + message: Detected usage of vulnerable functions with user input, which could lead to SSRF vulnerabilities. + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET[...] + - pattern: $_POST[...] + - pattern: $_REQUEST[...] + - pattern: get_option(...) + - pattern: get_user_meta(...) + - pattern: get_query_var(...) + pattern-sinks: + - patterns: + - focus-metavariable: $URL + - pattern-either: + - pattern: wp_remote_get($URL, ...) + - pattern: wp_safe_remote_get($URL, ...) + - pattern: wp_safe_remote_request($URL, ...) + - pattern: wp_safe_remote_head($URL, ...) + - pattern: wp_oembed_get($URL, ...) + - pattern: vip_safe_wp_remote_get($URL, ...) + - pattern: wp_safe_remote_post($URL, ...) + paths: + include: + - '**/wp-content/plugins/**/*.php' + metadata: + cwe: 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: A10:2021 - Server-Side Request Forgery (SSRF) + category: security + confidence: MEDIUM + likelihood: MEDIUM + impact: HIGH + subcategory: + - audit + technology: + - Wordpress Plugins + references: + - https://developer.wordpress.org/reference/functions/wp_safe_remote_get/ + - https://developer.wordpress.org/reference/functions/wp_remote_get/ + - https://patchstack.com/articles/exploring-the-unpatched-wordpress-ssrf/ + vulnerability_class: + - Server-Side Request Forgery (SSRF) + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/php.wordpress-plugins.security.audit.wp-ssrf-audit.wp-ssrf-audit + shortlink: https://sg.run/K3y06 + semgrep.dev: + rule: + r_id: 191611 + rv_id: 1039233 + rule_id: 6JUZyKX + version_id: JdTp6rq + url: https://semgrep.dev/playground/r/JdTp6rq/php.wordpress-plugins.security.audit.wp-ssrf-audit.wp-ssrf-audit + origin: community +- id: problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request + message: Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent over an insecure + channel. Instead, it is recommended to send requests over HTTPS. + severity: WARNING + metadata: + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + category: security + cwe: 'CWE-319: Cleartext Transmission of Sensitive Information' + owasp: A03:2017 - Sensitive Data Exposure + references: + - https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html + - https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection() + subcategory: + - vuln + technology: + - java + vulnerability: Insecure Transport + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request + shortlink: https://sg.run/QE2q + semgrep.dev: + rule: + r_id: 48942 + rv_id: 946061 + rule_id: 6JUOJ2 + version_id: WrTEo9G + url: https://semgrep.dev/playground/r/WrTEo9G/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request + origin: community + languages: + - java + fix-regex: + regex: '[Hh][Tt][Tt][Pp]://' + replacement: https:// + count: 1 + patterns: + - pattern: '"=~/[Hh][Tt][Tt][Pp]://.*/" + + ' + - pattern-inside: '$R = new HttpGet("=~/[Hh][Tt][Tt][Pp]://.*/"); + + ... + + $CLIENT. ... .execute($R, ...); + + ' +- id: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $CMD + - pattern-either: + - pattern: asyncio.create_subprocess_exec($PROG, $CMD, ...) + - pattern: asyncio.create_subprocess_exec($PROG, [$CMD, ...], ...) + - pattern: asyncio.subprocess.create_subprocess_exec($PROG, $CMD, ...) + - pattern: asyncio.subprocess.create_subprocess_exec($PROG, [$CMD, ...], ...) + - pattern: asyncio.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) + - pattern: asyncio.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) + - pattern: asyncio.subprocess.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) + - pattern: asyncio.subprocess.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) + message: Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled + by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable + by an external resource. You may consider using 'shlex.escape()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec + - https://docs.python.org/3/library/shlex.html + category: security + technology: + - python + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + shortlink: https://sg.run/oyv0 + semgrep.dev: + rule: + r_id: 18260 + rv_id: 1263331 + rule_id: EwUrX8 + version_id: rxTAKgo + url: https://semgrep.dev/playground/r/rxTAKgo/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + origin: community + languages: + - python + severity: ERROR +- id: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $CMD + - pattern-either: + - pattern: $LOOP.subprocess_exec($PROTOCOL, $CMD, ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, [$CMD, ...], ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) + message: Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can + be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it + is not controllable by an external resource. You may consider using 'shlex.escape()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec + - https://docs.python.org/3/library/shlex.html + category: security + technology: + - python + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + shortlink: https://sg.run/z14d + semgrep.dev: + rule: + r_id: 18261 + rv_id: 1263332 + rule_id: 7KUxXg + version_id: bZT53Ww + url: https://semgrep.dev/playground/r/bZT53Ww/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + origin: community + languages: + - python + severity: ERROR +- id: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $CMD + - pattern-either: + - pattern: $LOOP.subprocess_shell($PROTOCOL, $CMD) + - pattern: asyncio.subprocess.create_subprocess_shell($CMD, ...) + - pattern: asyncio.create_subprocess_shell($CMD, ...) + message: Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by + a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable + by an external resource. You may consider using 'shlex.escape()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://docs.python.org/3/library/asyncio-subprocess.html + - https://docs.python.org/3/library/shlex.html + category: security + technology: + - python + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell + shortlink: https://sg.run/p9vZ + semgrep.dev: + rule: + r_id: 18262 + rv_id: 1263333 + rule_id: L1UEl7 + version_id: NdTzyWA + url: https://semgrep.dev/playground/r/NdTzyWA/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell + origin: community + languages: + - python + severity: ERROR +- id: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process + mode: taint + message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this + function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + category: security + technology: + - python + - aws-lambda + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process + shortlink: https://sg.run/2AjL + semgrep.dev: + rule: + r_id: 18263 + rv_id: 1263334 + rule_id: 8GUGBq + version_id: kbTzGv8 + url: https://semgrep.dev/playground/r/kbTzGv8/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process + origin: community + languages: + - python + severity: ERROR + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $CMD + - pattern-either: + - patterns: + - pattern: os.$METHOD($MODE, $CMD, ...) + - metavariable-regex: + metavariable: $METHOD + regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) + - patterns: + - pattern-inside: os.$METHOD($MODE, $BASH, ["-c", $CMD,...],...) + - metavariable-regex: + metavariable: $METHOD + regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + - patterns: + - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) + - metavariable-regex: + metavariable: $METHOD + regex: (spawnl|spawnle|spawnlp|spawnlpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) +- id: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use + mode: taint + message: Detected subprocess function with argument tainted by an `event` object. If this data can be controlled by a malicious + actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. + Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the + command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for + this purpose. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://docs.python.org/3/library/subprocess.html + - https://docs.python.org/3/library/shlex.html + category: security + technology: + - python + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use + shortlink: https://sg.run/XZ7B + semgrep.dev: + rule: + r_id: 18264 + rv_id: 1263335 + rule_id: gxUyn1 + version_id: w8TRogj + url: https://semgrep.dev/playground/r/w8TRogj/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use + origin: community + languages: + - python + severity: ERROR + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - pattern: subprocess.$FUNC(..., shell=True, ...) + pattern-sanitizers: + - pattern: shlex.split(...) + - pattern: pipes.quote(...) + - pattern: shlex.quote(...) +- id: python.aws-lambda.security.dangerous-system-call.dangerous-system-call + mode: taint + message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this + function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier + to use without accidentally exposing a command injection vulnerability. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.2.4 Dyanmic Code Execution Features + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + version: '4' + category: security + technology: + - python + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call + shortlink: https://sg.run/jDvN + semgrep.dev: + rule: + r_id: 18265 + rv_id: 1263336 + rule_id: QrUkg6 + version_id: xyTjzbG + url: https://semgrep.dev/playground/r/xyTjzbG/python.aws-lambda.security.dangerous-system-call.dangerous-system-call + origin: community + languages: + - python + severity: ERROR + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $CMD + - pattern-either: + - pattern: os.system($CMD,...) + - pattern: os.popen($CMD,...) + - pattern: os.popen2($CMD,...) + - pattern: os.popen3($CMD,...) + - pattern: os.popen4($CMD,...) +- id: python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection + mode: taint + metadata: + cwe: + - 'CWE-943: Improper Neutralization of Special Elements in Data Query Logic' + owasp: + - A01:2017 - Injection + category: security + technology: + - python + - boto3 + - aws-lambda + - dynamodb + references: + - https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection + shortlink: https://sg.run/jjrl + semgrep.dev: + rule: + r_id: 21321 + rv_id: 946088 + rule_id: KxUJ2B + version_id: 9lTy1rQ + url: https://semgrep.dev/playground/r/9lTy1rQ/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection + origin: community + message: Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable + is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly + to DynamoDB client. + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sanitizers: + - patterns: + - pattern: '{...} + + ' + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern-either: + - pattern: $TABLE.scan(..., ScanFilter = $SINK, ...) + - pattern: $TABLE.query(..., QueryFilter = $SINK, ...) + - pattern-either: + - patterns: + - pattern-inside: '$TABLE = $DB.Table(...) + + ... + + ' + - pattern-inside: '$DB = boto3.resource(''dynamodb'', ...) + + ... + + ' + - pattern-inside: '$TABLE = boto3.client(''dynamodb'', ...) + + ... + + ' + severity: ERROR + languages: + - python +- id: python.aws-lambda.security.mysql-sqli.mysql-sqli + languages: + - python + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', (''active''))`' + mode: taint + metadata: + references: + - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html + - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - mysql + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli + shortlink: https://sg.run/1RjG + semgrep.dev: + rule: + r_id: 18266 + rv_id: 1263337 + rule_id: 3qU3eE + version_id: O9TpxLJ + url: https://semgrep.dev/playground/r/O9TpxLJ/python.aws-lambda.security.mysql-sqli.mysql-sqli + origin: community + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $CURSOR.execute($QUERY,...) + - pattern: $CURSOR.executemany($QUERY,...) + - pattern-either: + - pattern-inside: 'import mysql + + ... + + ' + - pattern-inside: 'import mysql.cursors + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: WARNING +- id: python.aws-lambda.security.psycopg-sqli.psycopg-sqli + languages: + - python + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', ''active'')`' + mode: taint + metadata: + references: + - https://www.psycopg.org/docs/cursor.html#cursor.execute + - https://www.psycopg.org/docs/cursor.html#cursor.executemany + - https://www.psycopg.org/docs/cursor.html#cursor.mogrify + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - psycopg + - psycopg2 + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli + shortlink: https://sg.run/9L8r + semgrep.dev: + rule: + r_id: 18267 + rv_id: 1263338 + rule_id: 4bUQG1 + version_id: e1TyjPZ + url: https://semgrep.dev/playground/r/e1TyjPZ/python.aws-lambda.security.psycopg-sqli.psycopg-sqli + origin: community + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $CURSOR.execute($QUERY,...) + - pattern: $CURSOR.executemany($QUERY,...) + - pattern: $CURSOR.mogrify($QUERY,...) + - pattern-inside: 'import psycopg2 + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: WARNING +- id: python.aws-lambda.security.pymssql-sqli.pymssql-sqli + languages: + - python + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', ''active'')`' + mode: taint + metadata: + references: + - https://pypi.org/project/pymssql/ + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - pymssql + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli + shortlink: https://sg.run/yXvP + semgrep.dev: + rule: + r_id: 18268 + rv_id: 1263339 + rule_id: PeUxO0 + version_id: vdT06bG + url: https://semgrep.dev/playground/r/vdT06bG/python.aws-lambda.security.pymssql-sqli.pymssql-sqli + origin: community + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern: $CURSOR.execute($QUERY,...) + - pattern-inside: 'import pymssql + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: WARNING +- id: python.aws-lambda.security.pymysql-sqli.pymysql-sqli + languages: + - python + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', (''active''))`' + mode: taint + metadata: + references: + - https://pypi.org/project/PyMySQL/#id4 + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - pymysql + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli + shortlink: https://sg.run/reve + semgrep.dev: + rule: + r_id: 18269 + rv_id: 1263340 + rule_id: JDUlel + version_id: d6TyxNA + url: https://semgrep.dev/playground/r/d6TyxNA/python.aws-lambda.security.pymysql-sqli.pymysql-sqli + origin: community + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern: $CURSOR.execute($QUERY,...) + - pattern-either: + - pattern-inside: 'import pymysql + + ... + + ' + - pattern-inside: 'import pymysql.cursors + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: WARNING +- id: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli + languages: + - python + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = ?'', ''active'')`' + mode: taint + metadata: + references: + - https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - sqlalchemy + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli + shortlink: https://sg.run/b48W + semgrep.dev: + rule: + r_id: 18270 + rv_id: 1263341 + rule_id: 5rUy3N + version_id: ZRTKARp + url: https://semgrep.dev/playground/r/ZRTKARp/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli + origin: community + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern: $CURSOR.execute($QUERY,...) + - pattern-inside: 'import sqlalchemy + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: WARNING +- id: python.aws-lambda.security.tainted-code-exec.tainted-code-exec + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - pattern-either: + - pattern: eval($CODE, ...) + - pattern: exec($CODE, ...) + message: Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can + be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable + by external sources. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.2.4 Dyanmic Code Execution Features + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + version: '4' + category: security + technology: + - python + references: + - https://owasp.org/Top10/A03_2021-Injection + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec + shortlink: https://sg.run/Ng7y + semgrep.dev: + rule: + r_id: 18271 + rv_id: 1263342 + rule_id: GdUDJP + version_id: nWT2LD2 + url: https://semgrep.dev/playground/r/nWT2LD2/python.aws-lambda.security.tainted-code-exec.tainted-code-exec + origin: community + languages: + - python + severity: WARNING +- id: python.aws-lambda.security.tainted-html-response.tainted-html-response + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - pattern: $BODY + - pattern-inside: '{..., "headers": {..., "Content-Type": "text/html", ...}, "body": $BODY, ... } + + ' + message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering + HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers + steal sensitive user data. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - aws-lambda + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response + shortlink: https://sg.run/k9vP + semgrep.dev: + rule: + r_id: 18272 + rv_id: 1263343 + rule_id: ReUKrk + version_id: ExTEx5o + url: https://semgrep.dev/playground/r/ExTEx5o/python.aws-lambda.security.tainted-html-response.tainted-html-response + origin: community + languages: + - python + severity: WARNING +- id: python.aws-lambda.security.tainted-html-string.tainted-html-string + languages: + - python + severity: WARNING + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use + templates which will safely render HTML instead. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - aws-lambda + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string + shortlink: https://sg.run/8zNy + semgrep.dev: + rule: + r_id: 18484 + rv_id: 1263344 + rule_id: JDUlwy + version_id: 7ZTE36K + url: https://semgrep.dev/playground/r/7ZTE36K/python.aws-lambda.security.tainted-html-string.tainted-html-string + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$HTMLSTR" % ...' + - pattern: '"$HTMLSTR".format(...)' + - pattern: '"$HTMLSTR" + ...' + - pattern: f"$HTMLSTR{...}..." + - patterns: + - pattern-inside: '$HTML = "$HTMLSTR" + + ... + + ' + - pattern-either: + - pattern: $HTML % ... + - pattern: $HTML.format(...) + - pattern: $HTML + ... + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... + - pattern-not-inside: 'print(...) + + ' +- id: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern-either: + - pattern: pickle.load($SINK,...) + - pattern: pickle.loads($SINK,...) + - pattern: _pickle.load($SINK,...) + - pattern: _pickle.loads($SINK,...) + - pattern: cPickle.load($SINK,...) + - pattern: cPickle.loads($SINK,...) + - pattern: dill.load($SINK,...) + - pattern: dill.loads($SINK,...) + - pattern: shelve.open($SINK,...) + message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized + data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar + text-based serialization format. + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + references: + - https://docs.python.org/3/library/pickle.html + - https://davidhamann.de/2020/04/05/exploiting-python-pickle/ + category: security + technology: + - python + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization + shortlink: https://sg.run/JbjW + semgrep.dev: + rule: + r_id: 21602 + rv_id: 1263345 + rule_id: JDUDQg + version_id: LjTkgd9 + url: https://semgrep.dev/playground/r/LjTkgd9/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization + origin: community + languages: + - python + severity: WARNING +- id: python.aws-lambda.security.tainted-sql-string.tainted-sql-string + languages: + - python + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction + could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the + database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider + using an object-relational mapper (ORM) such as Sequelize which will protect your queries. + metadata: + references: + - https://owasp.org/www-community/attacks/SQL_Injection + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/wXvA + semgrep.dev: + rule: + r_id: 18273 + rv_id: 1263346 + rule_id: AbU3LX + version_id: 8KT5ron + url: https://semgrep.dev/playground/r/8KT5ron/python.aws-lambda.security.tainted-sql-string.tainted-sql-string + origin: community + mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '"$SQLSTR" + ... + + ' + - pattern: '"$SQLSTR" % ... + + ' + - pattern: '"$SQLSTR".format(...) + + ' + - pattern: 'f"$SQLSTR{...}..." + + ' + - metavariable-regex: + metavariable: $SQLSTR + regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*= + - pattern-not-inside: 'print(...) + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR +- id: python.boto3.security.hardcoded-token.hardcoded-token + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + - https://bento.dev/checks/boto3/hardcoded-access-token/ + - https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/ + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + category: security + technology: + - boto3 + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token + shortlink: https://sg.run/LwQ6 + semgrep.dev: + rule: + r_id: 9439 + rv_id: 1263347 + rule_id: 5rUOwK + version_id: gETB78n + url: https://semgrep.dev/playground/r/gETB78n/python.boto3.security.hardcoded-token.hardcoded-token + origin: community + languages: + - python + severity: WARNING + mode: taint + pattern-sources: + - pattern: '"..." + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $W(...,$TOKEN="$VALUE",...) + - pattern: $BOTO. ... .$W(...,$TOKEN="$VALUE",...) + - metavariable-regex: + metavariable: $TOKEN + regex: (aws_session_token|aws_access_key_id|aws_secret_access_key) + - metavariable-pattern: + language: generic + metavariable: $VALUE + patterns: + - pattern-either: + - pattern-regex: ^AKI + - pattern-regex: ^[A-Za-z0-9/+=]+$ + - metavariable-analysis: + metavariable: $VALUE + analyzer: entropy +- id: python.cryptography.security.empty-aes-key.empty-aes-key + message: Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may + allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption. + patterns: + - pattern: AES.new("",...) + languages: + - python + severity: WARNING + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + - 'CWE-310: Cryptographic Issues' + references: + - https://cwe.mitre.org/data/definitions/327.html + - https://cwe.mitre.org/data/definitions/310.html + category: security + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + owasp: A6:2017 misconfiguration + functional-categories: + - crypto::search::key-length::pycrypto + - crypto::search::key-length::pycryptodome + technology: + - python + - pycrypto + - pycryptodome + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key + shortlink: https://sg.run/zQ9G + semgrep.dev: + rule: + r_id: 44817 + rv_id: 946105 + rule_id: OrUADK + version_id: 8KTKjRg + url: https://semgrep.dev/playground/r/8KTKjRg/python.cryptography.security.empty-aes-key.empty-aes-key + origin: community +- id: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 + message: ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output. Its use is strongly + discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` + package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, + keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers + category: security + technology: + - cryptography + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 + shortlink: https://sg.run/xoZL + semgrep.dev: + rule: + r_id: 33630 + rv_id: 1263348 + rule_id: KxU8gK + version_id: QkTGq3Q + url: https://semgrep.dev/playground/r/QkTGq3Q/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 + origin: community + severity: WARNING + languages: + - python + patterns: + - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$ARC4($KEY) + - pattern-inside: cryptography.hazmat.primitives.ciphers.Cipher(...) + - metavariable-regex: + metavariable: $ARC4 + regex: ^(ARC4)$ + - focus-metavariable: $ARC4 + fix: AES +- id: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish + message: Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak + keys. The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` + package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, + keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers + - https://tools.ietf.org/html/rfc5469 + category: security + technology: + - cryptography + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish + shortlink: https://sg.run/OdzL + semgrep.dev: + rule: + r_id: 33631 + rv_id: 1263349 + rule_id: qNULvO + version_id: 3ZT4XK7 + url: https://semgrep.dev/playground/r/3ZT4XK7/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish + origin: community + severity: WARNING + languages: + - python + patterns: + - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$BLOWFISH($KEY) + - metavariable-regex: + metavariable: $BLOWFISH + regex: ^(Blowfish)$ + - focus-metavariable: $BLOWFISH + fix: AES +- id: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea + message: IDEA (International Data Encryption Algorithm) is a block cipher created in 1991. It is an optional component + of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys. It is recommended that you do not + use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package + it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, + keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://tools.ietf.org/html/rfc5469 + - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA + category: security + technology: + - cryptography + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea + shortlink: https://sg.run/3xyK + semgrep.dev: + rule: + r_id: 9443 + rv_id: 1263350 + rule_id: BYUNPg + version_id: 44TEjNJ + url: https://semgrep.dev/playground/r/44TEjNJ/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea + origin: community + severity: WARNING + languages: + - python + patterns: + - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$IDEA($KEY) + - metavariable-regex: + metavariable: $IDEA + regex: ^(IDEA)$ + - focus-metavariable: $IDEA + fix: AES +- id: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb + message: ECB (Electronic Code Book) is the simplest mode of operation for block ciphers. Each block of data is encrypted + in the same way. This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave + significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L101 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B305 + references: + - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes + - https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption + category: security + technology: + - cryptography + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: MEDIUM + functional-categories: + - crypto::search::mode::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb + shortlink: https://sg.run/4xr5 + semgrep.dev: + rule: + r_id: 9444 + rv_id: 1263351 + rule_id: DbUp5g + version_id: PkTR3w7 + url: https://semgrep.dev/playground/r/PkTR3w7/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb + origin: community + severity: WARNING + languages: + - python + pattern: cryptography.hazmat.primitives.ciphers.modes.ECB($IV) + fix: cryptography.hazmat.primitives.ciphers.modes.GCM($IV) +- id: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use SHA256 or SHA3 instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B303 + references: + - https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5 + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - cryptography + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + shortlink: https://sg.run/eY88 + semgrep.dev: + rule: + r_id: 33632 + rv_id: 1263352 + rule_id: lBUopp + version_id: JdTzxww + url: https://semgrep.dev/playground/r/JdTzxww/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + origin: community + severity: WARNING + languages: + - python + patterns: + - pattern: cryptography.hazmat.primitives.hashes.$MD5() + - metavariable-regex: + metavariable: $MD5 + regex: ^(MD5)$ + - focus-metavariable: $MD5 + fix: SHA256 +- id: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + patterns: + - pattern: cryptography.hazmat.primitives.hashes.$SHA(...) + - metavariable-pattern: + metavariable: $SHA + pattern: 'SHA1 + + ' + - focus-metavariable: $SHA + fix: 'SHA256 + + ' + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B303 + references: + - https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1 + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - cryptography + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + shortlink: https://sg.run/J9Qy + semgrep.dev: + rule: + r_id: 9446 + rv_id: 1263353 + rule_id: 0oU5dN + version_id: 5PTo1l0 + url: https://semgrep.dev/playground/r/5PTo1l0/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + origin: community + severity: WARNING + languages: + - python +- id: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size + patterns: + - pattern-either: + - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(..., key_size=$SIZE, ...) + - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key($SIZE, ...) + - metavariable-comparison: + metavariable: $SIZE + comparison: $SIZE < 2048 + - focus-metavariable: $SIZE + fix: '2048 + + ' + message: Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + references: + - https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf + - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/ + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf + category: security + technology: + - cryptography + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::key-length::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size + shortlink: https://sg.run/5Qb0 + semgrep.dev: + rule: + r_id: 9447 + rv_id: 1263354 + rule_id: KxUb0x + version_id: GxTkeOK + url: https://semgrep.dev/playground/r/GxTkeOK/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size + origin: community + languages: + - python + severity: WARNING +- id: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size + patterns: + - pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...) + - pattern: cryptography.hazmat.primitives.asymmetric.ec.$SIZE + - metavariable-pattern: + metavariable: $SIZE + pattern-either: + - pattern: SECP192R1 + - pattern: SECT163K1 + - pattern: SECT163R2 + - focus-metavariable: $SIZE + fix: 'SECP256R1 + + ' + message: Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf + - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves + category: security + technology: + - cryptography + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::key-length::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size + shortlink: https://sg.run/GeQq + semgrep.dev: + rule: + r_id: 9448 + rv_id: 1263355 + rule_id: qNUjZ3 + version_id: RGT0LW6 + url: https://semgrep.dev/playground/r/RGT0LW6/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size + origin: community + languages: + - python + severity: WARNING +- id: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size + patterns: + - pattern-either: + - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(..., key_size=$SIZE, ...) + - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key($EXP, $SIZE, ...) + - metavariable-comparison: + metavariable: $SIZE + comparison: $SIZE < 2048 + - focus-metavariable: $SIZE + fix: '2048 + + ' + message: Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + references: + - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/ + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf + category: security + technology: + - cryptography + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::key-length::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size + shortlink: https://sg.run/RoQq + semgrep.dev: + rule: + r_id: 9449 + rv_id: 1263356 + rule_id: lBU9jn + version_id: A8TgdPK + url: https://semgrep.dev/playground/r/A8TgdPK/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size + origin: community + languages: + - python + severity: WARNING +- id: python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication + message: 'An encryption mode of operation is being used without proper message authentication. This can potentially result + in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ' + languages: + - python + severity: ERROR + metadata: + category: security + technology: + - cryptography + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication + shortlink: https://sg.run/N9JL + semgrep.dev: + rule: + r_id: 31871 + rv_id: 1263357 + rule_id: lBUpNZ + version_id: BjTkZj5 + url: https://semgrep.dev/playground/r/BjTkZj5/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication + origin: community + patterns: + - pattern-either: + - patterns: + - pattern: 'Cipher(..., $HAZMAT_MODE(...),...) + + ' + - pattern-not-inside: 'Cipher(..., $HAZMAT_MODE(...),...) + + ... + + HMAC(...) + + ' + - pattern-not-inside: 'Cipher(..., $HAZMAT_MODE(...),...) + + ... + + hmac.HMAC(...) + + ' + - metavariable-pattern: + metavariable: $HAZMAT_MODE + patterns: + - pattern-either: + - pattern: modes.CTR + - pattern: modes.CBC + - pattern: modes.CFB + - pattern: modes.OFB +- id: python.distributed.security.require-encryption + patterns: + - pattern: 'distributed.security.Security(..., require_encryption=$VAL, ...) + + ' + - metavariable-pattern: + metavariable: $VAL + pattern: 'False + + ' + - focus-metavariable: $VAL + fix: 'True + + ' + message: Initializing a security context for Dask (`distributed`) without "require_encryption" keyword argument may silently + fail to provide security. + severity: WARNING + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters + category: security + technology: + - distributed + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.distributed.security.require-encryption + shortlink: https://sg.run/AvQ2 + semgrep.dev: + rule: + r_id: 9450 + rv_id: 1263358 + rule_id: YGURy0 + version_id: DkTRbol + url: https://semgrep.dev/playground/r/DkTRbol/python.distributed.security.require-encryption + origin: community + languages: + - python +- id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + references: + - https://docs.python.org/3/library/pickle.html + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization + shortlink: https://sg.run/9oyr + semgrep.dev: + rule: + r_id: 9467 + rv_id: 1409400 + rule_id: OrU3e6 + version_id: GxTlb9e + url: https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization + origin: community + message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, + which are known to lead to remote code execution vulnerabilities. + languages: + - python + severity: ERROR + mode: taint + pattern-sources: + - pattern-either: + - patterns: + - pattern-inside: "def $INSIDE(..., $PARAM, ...):\n ...\n" + - pattern-either: + - pattern: request.$REQFUNC(...) + - pattern: request.$REQFUNC.get(...) + - pattern: request.$REQFUNC[...] + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern: 'pickle.$PICKLEFUNC(...) + + ' + - pattern: '_pickle.$PICKLEFUNC(...) + + ' + - pattern: 'cPickle.$PICKLEFUNC(...) + + ' + - pattern: 'shelve.$PICKLEFUNC(...) + + ' + - metavariable-regex: + metavariable: $PICKLEFUNC + regex: dumps|dump|load|loads + - patterns: + - pattern: dill.$DILLFUNC(...) + - metavariable-regex: + metavariable: $DILLFUNC + regex: dump|dump_session|dumps|load|load_session|loads + - patterns: + - pattern: yaml.$YAMLFUNC(...) + - pattern-not: yaml.$YAMLFUNC(..., Dumper=SafeDumper, ...) + - pattern-not: yaml.$YAMLFUNC(..., Dumper=yaml.SafeDumper, ...) + - pattern-not: yaml.$YAMLFUNC(..., Loader=SafeLoader, ...) + - pattern-not: yaml.$YAMLFUNC(..., Loader=yaml.SafeLoader, ...) + - metavariable-regex: + metavariable: $YAMLFUNC + regex: dump|dump_all|load|load_all +- id: python.django.security.hashids-with-django-secret.hashids-with-django-secret + languages: + - python + message: The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, + the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through + the HashIDs. + metadata: + category: security + subcategory: + - vuln + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A02:2021 – Cryptographic Failures + references: + - https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY + - http://carnage.github.io/2015/08/cryptanalysis-of-hashids + technology: + - django + likelihood: LOW + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret + shortlink: https://sg.run/bxeZ + semgrep.dev: + rule: + r_id: 72426 + rv_id: 946163 + rule_id: 0oUXqy + version_id: 0bT15nn + url: https://semgrep.dev/playground/r/0bT15nn/python.django.security.hashids-with-django-secret.hashids-with-django-secret + origin: community + pattern-either: + - pattern: hashids.Hashids(..., salt=django.conf.settings.SECRET_KEY, ...) + - pattern: hashids.Hashids(django.conf.settings.SECRET_KEY, ...) + severity: ERROR +- id: python.django.security.injection.code.user-eval-format-string.user-eval-format-string + message: Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote + code. See https://owasp.org/www-community/attacks/Code_Injection for more information. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html + category: security + technology: + - django + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string + shortlink: https://sg.run/4x2z + semgrep.dev: + rule: + r_id: 9500 + rv_id: 1263383 + rule_id: BYUNw9 + version_id: vdT06xG + url: https://semgrep.dev/playground/r/vdT06xG/python.django.security.injection.code.user-eval-format-string.user-eval-format-string + origin: community + patterns: + - pattern-inside: "def $F(...):\n ...\n" + - pattern-either: + - pattern: eval(..., $STR % request.$W.get(...), ...) + - pattern: '$V = request.$W.get(...) + + ... + + eval(..., $STR % $V, ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + $S = $STR % $V + + ... + + eval(..., $S, ...) + + ' + - pattern: eval(..., "..." % request.$W(...), ...) + - pattern: '$V = request.$W(...) + + ... + + eval(..., $STR % $V, ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + $S = $STR % $V + + ... + + eval(..., $S, ...) + + ' + - pattern: eval(..., $STR % request.$W[...], ...) + - pattern: '$V = request.$W[...] + + ... + + eval(..., $STR % $V, ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + $S = $STR % $V + + ... + + eval(..., $S, ...) + + ' + - pattern: eval(..., $STR.format(..., request.$W.get(...), ...), ...) + - pattern: '$V = request.$W.get(...) + + ... + + eval(..., $STR.format(..., $V, ...), ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + $S = $STR.format(..., $V, ...) + + ... + + eval(..., $S, ...) + + ' + - pattern: eval(..., $STR.format(..., request.$W(...), ...), ...) + - pattern: '$V = request.$W(...) + + ... + + eval(..., $STR.format(..., $V, ...), ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + $S = $STR.format(..., $V, ...) + + ... + + eval(..., $S, ...) + + ' + - pattern: eval(..., $STR.format(..., request.$W[...], ...), ...) + - pattern: '$V = request.$W[...] + + ... + + eval(..., $STR.format(..., $V, ...), ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + $S = $STR.format(..., $V, ...) + + ... + + eval(..., $S, ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + eval(..., f"...{$V}...", ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + $S = f"...{$V}..." + + ... + + eval(..., $S, ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + eval(..., f"...{$V}...", ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + $S = f"...{$V}..." + + ... + + eval(..., $S, ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + eval(..., f"...{$V}...", ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + $S = f"...{$V}..." + + ... + + eval(..., $S, ...) + + ' + languages: + - python + severity: WARNING +- id: python.django.security.injection.code.user-eval.user-eval + message: Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary + remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific + functionality you need. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html + - https://owasp.org/www-community/attacks/Code_Injection + category: security + technology: + - django + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval + shortlink: https://sg.run/PJDW + semgrep.dev: + rule: + r_id: 9501 + rv_id: 1263384 + rule_id: DbUpDQ + version_id: d6Tyx2A + url: https://semgrep.dev/playground/r/d6Tyx2A/python.django.security.injection.code.user-eval.user-eval + origin: community + patterns: + - pattern-inside: "def $F(...):\n ...\n" + - pattern-either: + - pattern: eval(..., request.$W.get(...), ...) + - pattern: '$V = request.$W.get(...) + + ... + + eval(..., $V, ...) + + ' + - pattern: eval(..., request.$W(...), ...) + - pattern: '$V = request.$W(...) + + ... + + eval(..., $V, ...) + + ' + - pattern: eval(..., request.$W[...], ...) + - pattern: '$V = request.$W[...] + + ... + + eval(..., $V, ...) + + ' + languages: + - python + severity: WARNING +- id: python.django.security.injection.code.user-exec-format-string.user-exec-format-string + message: Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary + remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific + functionality you need. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - django + references: + - https://owasp.org/www-community/attacks/Code_Injection + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string + shortlink: https://sg.run/J9JW + semgrep.dev: + rule: + r_id: 9502 + rv_id: 1263385 + rule_id: WAUovx + version_id: ZRTKA1p + url: https://semgrep.dev/playground/r/ZRTKA1p/python.django.security.injection.code.user-exec-format-string.user-exec-format-string + origin: community + patterns: + - pattern-inside: "def $F(...):\n ...\n" + - pattern-either: + - pattern: exec(..., $STR % request.$W.get(...), ...) + - pattern: '$V = request.$W.get(...) + + ... + + exec(..., $STR % $V, ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + $S = $STR % $V + + ... + + exec(..., $S, ...) + + ' + - pattern: exec(..., "..." % request.$W(...), ...) + - pattern: '$V = request.$W(...) + + ... + + exec(..., $STR % $V, ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + $S = $STR % $V + + ... + + exec(..., $S, ...) + + ' + - pattern: exec(..., $STR % request.$W[...], ...) + - pattern: '$V = request.$W[...] + + ... + + exec(..., $STR % $V, ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + $S = $STR % $V + + ... + + exec(..., $S, ...) + + ' + - pattern: exec(..., $STR.format(..., request.$W.get(...), ...), ...) + - pattern: '$V = request.$W.get(...) + + ... + + exec(..., $STR.format(..., $V, ...), ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + $S = $STR.format(..., $V, ...) + + ... + + exec(..., $S, ...) + + ' + - pattern: exec(..., $STR.format(..., request.$W(...), ...), ...) + - pattern: '$V = request.$W(...) + + ... + + exec(..., $STR.format(..., $V, ...), ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + $S = $STR.format(..., $V, ...) + + ... + + exec(..., $S, ...) + + ' + - pattern: exec(..., $STR.format(..., request.$W[...], ...), ...) + - pattern: '$V = request.$W[...] + + ... + + exec(..., $STR.format(..., $V, ...), ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + $S = $STR.format(..., $V, ...) + + ... + + exec(..., $S, ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + exec(..., f"...{$V}...", ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + $S = f"...{$V}..." + + ... + + exec(..., $S, ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + exec(..., f"...{$V}...", ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + $S = f"...{$V}..." + + ... + + exec(..., $S, ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + exec(..., f"...{$V}...", ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + $S = f"...{$V}..." + + ... + + exec(..., $S, ...) + + ' + - pattern: exec(..., base64.decodestring($S.format(..., request.$W.get(...), ...), ...), ...) + - pattern: exec(..., base64.decodestring($S % request.$W.get(...), ...), ...) + - pattern: exec(..., base64.decodestring(f"...{request.$W.get(...)}...", ...), ...) + - pattern: exec(..., base64.decodestring(request.$W.get(...), ...), ...) + - pattern: exec(..., base64.decodestring(bytes($S.format(..., request.$W.get(...), ...), ...), ...), ...) + - pattern: exec(..., base64.decodestring(bytes($S % request.$W.get(...), ...), ...), ...) + - pattern: exec(..., base64.decodestring(bytes(f"...{request.$W.get(...)}...", ...), ...), ...) + - pattern: exec(..., base64.decodestring(bytes(request.$W.get(...), ...), ...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + exec(..., base64.decodestring($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = base64.decodestring($DATA, ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = base64.decodestring(bytes($DATA, ...), ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + exec(..., base64.decodestring($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = base64.decodestring($DATA, ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = base64.decodestring(bytes($DATA, ...), ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + exec(..., base64.decodestring($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = base64.decodestring($DATA, ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = base64.decodestring(bytes($DATA, ...), ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + exec(..., base64.decodestring($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = base64.decodestring($DATA, ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = base64.decodestring(bytes($DATA, ...), ...) + + ... + + exec(..., $INTERM, ...) + + ' + languages: + - python + severity: WARNING +- id: python.django.security.injection.code.user-exec.user-exec + message: Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary + remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific + functionality you need. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - django + references: + - https://owasp.org/www-community/attacks/Code_Injection + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec + shortlink: https://sg.run/5Q3X + semgrep.dev: + rule: + r_id: 9503 + rv_id: 1263386 + rule_id: 0oU5AW + version_id: nWT2LA2 + url: https://semgrep.dev/playground/r/nWT2LA2/python.django.security.injection.code.user-exec.user-exec + origin: community + patterns: + - pattern-inside: "def $F(...):\n ...\n" + - pattern-either: + - pattern: exec(..., request.$W.get(...), ...) + - pattern: '$V = request.$W.get(...) + + ... + + exec(..., $V, ...) + + ' + - pattern: exec(..., request.$W(...), ...) + - pattern: '$V = request.$W(...) + + ... + + exec(..., $V, ...) + + ' + - pattern: exec(..., request.$W[...], ...) + - pattern: '$V = request.$W[...] + + ... + + exec(..., $V, ...) + + ' + - pattern: 'loop = asyncio.get_running_loop() + + ... + + await loop.run_in_executor(None, exec, request.$W[...]) + + ' + - pattern: '$V = request.$W[...] + + ... + + loop = asyncio.get_running_loop() + + ... + + await loop.run_in_executor(None, exec, $V) + + ' + - pattern: 'loop = asyncio.get_running_loop() + + ... + + await loop.run_in_executor(None, exec, request.$W.get(...)) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + loop = asyncio.get_running_loop() + + ... + + await loop.run_in_executor(None, exec, $V) + + ' + languages: + - python + severity: WARNING +- id: python.django.security.injection.command.command-injection-os-system.command-injection-os-system + message: Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this + must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection + for more information. + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/Command_Injection + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system + shortlink: https://sg.run/Gen2 + semgrep.dev: + rule: + r_id: 9504 + rv_id: 1263387 + rule_id: KxUbp2 + version_id: ExTExPo + url: https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system + origin: community + languages: + - python + severity: ERROR + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: os.system(..., request.$W.get(...), ...) + - pattern: os.system(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: os.system(..., $S % request.$W.get(...), ...) + - pattern: os.system(..., f"...{request.$W.get(...)}...", ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + os.system(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + os.system(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + os.system(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + os.system(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + os.system(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: $A = os.system(..., request.$W.get(...), ...) + - pattern: $A = os.system(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: $A = os.system(..., $S % request.$W.get(...), ...) + - pattern: $A = os.system(..., f"...{request.$W.get(...)}...", ...) + - pattern: return os.system(..., request.$W.get(...), ...) + - pattern: return os.system(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: return os.system(..., $S % request.$W.get(...), ...) + - pattern: return os.system(..., f"...{request.$W.get(...)}...", ...) + - pattern: os.system(..., request.$W(...), ...) + - pattern: os.system(..., $S.format(..., request.$W(...), ...), ...) + - pattern: os.system(..., $S % request.$W(...), ...) + - pattern: os.system(..., f"...{request.$W(...)}...", ...) + - pattern: '$DATA = request.$W(...) + + ... + + os.system(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + os.system(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + os.system(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + os.system(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + os.system(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: $A = os.system(..., request.$W(...), ...) + - pattern: $A = os.system(..., $S.format(..., request.$W(...), ...), ...) + - pattern: $A = os.system(..., $S % request.$W(...), ...) + - pattern: $A = os.system(..., f"...{request.$W(...)}...", ...) + - pattern: return os.system(..., request.$W(...), ...) + - pattern: return os.system(..., $S.format(..., request.$W(...), ...), ...) + - pattern: return os.system(..., $S % request.$W(...), ...) + - pattern: return os.system(..., f"...{request.$W(...)}...", ...) + - pattern: os.system(..., request.$W[...], ...) + - pattern: os.system(..., $S.format(..., request.$W[...], ...), ...) + - pattern: os.system(..., $S % request.$W[...], ...) + - pattern: os.system(..., f"...{request.$W[...]}...", ...) + - pattern: '$DATA = request.$W[...] + + ... + + os.system(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + os.system(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + os.system(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + os.system(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + os.system(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: $A = os.system(..., request.$W[...], ...) + - pattern: $A = os.system(..., $S.format(..., request.$W[...], ...), ...) + - pattern: $A = os.system(..., $S % request.$W[...], ...) + - pattern: $A = os.system(..., f"...{request.$W[...]}...", ...) + - pattern: return os.system(..., request.$W[...], ...) + - pattern: return os.system(..., $S.format(..., request.$W[...], ...), ...) + - pattern: return os.system(..., $S % request.$W[...], ...) + - pattern: return os.system(..., f"...{request.$W[...]}...", ...) + - pattern: os.system(..., request.$W, ...) + - pattern: os.system(..., $S.format(..., request.$W, ...), ...) + - pattern: os.system(..., $S % request.$W, ...) + - pattern: os.system(..., f"...{request.$W}...", ...) + - pattern: '$DATA = request.$W + + ... + + os.system(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + os.system(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + os.system(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + os.system(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + os.system(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: $A = os.system(..., request.$W, ...) + - pattern: $A = os.system(..., $S.format(..., request.$W, ...), ...) + - pattern: $A = os.system(..., $S % request.$W, ...) + - pattern: $A = os.system(..., f"...{request.$W}...", ...) + - pattern: return os.system(..., request.$W, ...) + - pattern: return os.system(..., $S.format(..., request.$W, ...), ...) + - pattern: return os.system(..., $S % request.$W, ...) + - pattern: return os.system(..., f"...{request.$W}...", ...) +- id: python.django.security.injection.command.subprocess-injection.subprocess-injection + languages: + - python + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-inside: "def $FUNC(..., $REQUEST, ...):\n ...\n" + - focus-metavariable: $REQUEST + - metavariable-pattern: + metavariable: $REQUEST + patterns: + - pattern: request + - pattern-not-inside: request.build_absolute_uri + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: subprocess.$FUNC(...) + - pattern-not: subprocess.$FUNC("...", ...) + - pattern-not: subprocess.$FUNC(["...", ...], ...) + - pattern-not-inside: '$CMD = ["...", ...] + + ... + + subprocess.$FUNC($CMD, ...) + + ' + - patterns: + - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...) + - metavariable-regex: + metavariable: $SHELL + regex: ^(sh|bash|ksh|csh|tcsh|zsh)$ + - patterns: + - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...) + - metavariable-regex: + metavariable: $INTERPRETER + regex: ^(python|python\d)$ + pattern-sanitizers: + - patterns: + - pattern: $DICT[$KEY] + - focus-metavariable: $KEY + severity: ERROR + message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. + An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, + scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, + prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set + of commands. + metadata: + category: security + technology: + - flask + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection + shortlink: https://sg.run/49BE + semgrep.dev: + rule: + r_id: 31144 + rv_id: 1263388 + rule_id: EwUepx + version_id: 7ZTE3qK + url: https://semgrep.dev/playground/r/7ZTE3qK/python.django.security.injection.command.subprocess-injection.subprocess-injection + origin: community +- id: python.django.security.injection.csv-writer-injection.csv-writer-injection + languages: + - python + message: Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate + the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet + application that runs an attacker script, which could steal data from the importing user or, at worst, install malware + on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula + injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs. + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-1236: Improper Neutralization of Formula Elements in a CSV File' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://github.com/raphaelm/defusedcsv + - https://owasp.org/www-community/attacks/CSV_Injection + - https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities + technology: + - django + - python + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.django.security.injection.csv-writer-injection.csv-writer-injection + shortlink: https://sg.run/Pw9q + semgrep.dev: + rule: + r_id: 31145 + rv_id: 1263389 + rule_id: 7KUK1y + version_id: LjTkgD9 + url: https://semgrep.dev/playground/r/LjTkgD9/python.django.security.injection.csv-writer-injection.csv-writer-injection + origin: community + mode: taint + pattern-sinks: + - patterns: + - pattern-inside: '$WRITER = csv.writer(...) + + + ... + + + $WRITER.$WRITE(...) + + ' + - pattern: $WRITER.$WRITE(...) + - metavariable-regex: + metavariable: $WRITE + regex: ^(writerow|writerows|writeheader)$ + pattern-sources: + - patterns: + - pattern-inside: "def $FUNC(..., $REQUEST, ...):\n ...\n" + - focus-metavariable: $REQUEST + - metavariable-pattern: + metavariable: $REQUEST + patterns: + - pattern: request + - pattern-not-inside: request.build_absolute_uri + severity: ERROR +- id: python.django.security.injection.email.xss-html-email-body.xss-html-email-body + message: Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible + to XSS. An attacker could inject data into this HTML email, causing XSS. + metadata: + cwe: + - 'CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (''Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://www.damonkohler.com/2008/12/email-injection.html + category: security + technology: + - django + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body + shortlink: https://sg.run/RoBe + semgrep.dev: + rule: + r_id: 9505 + rv_id: 1263390 + rule_id: qNUj02 + version_id: 8KT5rOn + url: https://semgrep.dev/playground/r/8KT5rOn/python.django.security.injection.email.xss-html-email-body.xss-html-email-body + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n $EMAIL.content_subtype = \"html\"\n ...\n" + - pattern-either: + - pattern: django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.EmailMessage($SUBJ, $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...) + - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...) + - pattern: django.core.mail.EmailMessage($SUBJ, request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.EmailMessage($SUBJ, $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W(...), ...) + - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W(...), ...) + - pattern: django.core.mail.EmailMessage($SUBJ, request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.EmailMessage($SUBJ, $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W[...], ...) + - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W[...], ...) + - pattern: django.core.mail.EmailMessage($SUBJ, request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + django.core.mail.EmailMessage($SUBJ, $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W, ...) + - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W, ...) +- id: python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message + message: Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible + to XSS. An attacker could inject data into this HTML email, causing XSS. + metadata: + cwe: + - 'CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (''Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://www.damonkohler.com/2008/12/email-injection.html + category: security + technology: + - django + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message + shortlink: https://sg.run/Avx8 + semgrep.dev: + rule: + r_id: 9506 + rv_id: 1263391 + rule_id: lBU9Ll + version_id: gETB7Gn + url: https://semgrep.dev/playground/r/gETB7Gn/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: django.core.mail.send_mail(..., html_message=request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.send_mail(..., html_message=$DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W.get(...), ...) + - pattern: return django.core.mail.send_mail(..., html_message=request.$W.get(...), ...) + - pattern: django.core.mail.send_mail(..., html_message=request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.send_mail(..., html_message=$DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W(...), ...) + - pattern: return django.core.mail.send_mail(..., html_message=request.$W(...), ...) + - pattern: django.core.mail.send_mail(..., html_message=request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.send_mail(..., html_message=$DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W[...], ...) + - pattern: return django.core.mail.send_mail(..., html_message=request.$W[...], ...) + - pattern: django.core.mail.send_mail(..., html_message=request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + django.core.mail.send_mail(..., html_message=$DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W, ...) + - pattern: return django.core.mail.send_mail(..., html_message=request.$W, ...) +- id: python.django.security.injection.open-redirect.open-redirect + message: Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you + are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html + for more information. + metadata: + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/ + - https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231 + category: security + technology: + - django + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect + shortlink: https://sg.run/Ave2 + semgrep.dev: + rule: + r_id: 9494 + rv_id: 1263393 + rule_id: PeUZgr + version_id: 3ZT4XD7 + url: https://semgrep.dev/playground/r/3ZT4XD7/python.django.security.injection.open-redirect.open-redirect + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-not-inside: "def $FUNC(...):\n ...\n django.utils.http.is_safe_url(...)\n ...\n" + - pattern-not-inside: "def $FUNC(...):\n ...\n if <... django.utils.http.is_safe_url(...) ...>:\n ...\n" + - pattern-not-inside: "def $FUNC(...):\n ...\n django.utils.http.url_has_allowed_host_and_scheme(...)\n ...\n" + - pattern-not-inside: "def $FUNC(...):\n ...\n if <... django.utils.http.url_has_allowed_host_and_scheme(...) ...>:\n\ + \ ...\n" + - pattern-either: + - pattern: django.shortcuts.redirect(..., request.$W.get(...), ...) + - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: django.shortcuts.redirect(..., $S % request.$W.get(...), ...) + - pattern: django.shortcuts.redirect(..., f"...{request.$W.get(...)}...", ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.shortcuts.redirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.shortcuts.redirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.shortcuts.redirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.shortcuts.redirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: $A = django.shortcuts.redirect(..., request.$W.get(...), ...) + - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: $A = django.shortcuts.redirect(..., $S % request.$W.get(...), ...) + - pattern: $A = django.shortcuts.redirect(..., f"...{request.$W.get(...)}...", ...) + - pattern: return django.shortcuts.redirect(..., request.$W.get(...), ...) + - pattern: return django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: return django.shortcuts.redirect(..., $S % request.$W.get(...), ...) + - pattern: return django.shortcuts.redirect(..., f"...{request.$W.get(...)}...", ...) + - pattern: django.shortcuts.redirect(..., request.$W(...), ...) + - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...) + - pattern: django.shortcuts.redirect(..., $S % request.$W(...), ...) + - pattern: django.shortcuts.redirect(..., f"...{request.$W(...)}...", ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.shortcuts.redirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.shortcuts.redirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.shortcuts.redirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.shortcuts.redirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: $A = django.shortcuts.redirect(..., request.$W(...), ...) + - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...) + - pattern: $A = django.shortcuts.redirect(..., $S % request.$W(...), ...) + - pattern: $A = django.shortcuts.redirect(..., f"...{request.$W(...)}...", ...) + - pattern: return django.shortcuts.redirect(..., request.$W(...), ...) + - pattern: return django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...) + - pattern: return django.shortcuts.redirect(..., $S % request.$W(...), ...) + - pattern: return django.shortcuts.redirect(..., f"...{request.$W(...)}...", ...) + - pattern: django.shortcuts.redirect(..., request.$W[...], ...) + - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...) + - pattern: django.shortcuts.redirect(..., $S % request.$W[...], ...) + - pattern: django.shortcuts.redirect(..., f"...{request.$W[...]}...", ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.shortcuts.redirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.shortcuts.redirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.shortcuts.redirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.shortcuts.redirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: $A = django.shortcuts.redirect(..., request.$W[...], ...) + - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...) + - pattern: $A = django.shortcuts.redirect(..., $S % request.$W[...], ...) + - pattern: $A = django.shortcuts.redirect(..., f"...{request.$W[...]}...", ...) + - pattern: return django.shortcuts.redirect(..., request.$W[...], ...) + - pattern: return django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...) + - pattern: return django.shortcuts.redirect(..., $S % request.$W[...], ...) + - pattern: return django.shortcuts.redirect(..., f"...{request.$W[...]}...", ...) + - pattern: django.shortcuts.redirect(..., request.$W, ...) + - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...) + - pattern: django.shortcuts.redirect(..., $S % request.$W, ...) + - pattern: django.shortcuts.redirect(..., f"...{request.$W}...", ...) + - pattern: '$DATA = request.$W + + ... + + django.shortcuts.redirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.shortcuts.redirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.shortcuts.redirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.shortcuts.redirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: $A = django.shortcuts.redirect(..., request.$W, ...) + - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...) + - pattern: $A = django.shortcuts.redirect(..., $S % request.$W, ...) + - pattern: $A = django.shortcuts.redirect(..., f"...{request.$W}...", ...) + - pattern: return django.shortcuts.redirect(..., request.$W, ...) + - pattern: return django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...) + - pattern: return django.shortcuts.redirect(..., $S % request.$W, ...) + - pattern: return django.shortcuts.redirect(..., f"...{request.$W}...", ...) + - pattern: django.http.HttpResponseRedirect(..., request.$W.get(...), ...) + - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...) + - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W.get(...)}...", ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseRedirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseRedirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseRedirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseRedirect(..., request.$W.get(...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., f"...{request.$W.get(...)}...", ...) + - pattern: return django.http.HttpResponseRedirect(..., request.$W.get(...), ...) + - pattern: return django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: return django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...) + - pattern: return django.http.HttpResponseRedirect(..., f"...{request.$W.get(...)}...", ...) + - pattern: django.http.HttpResponseRedirect(..., request.$W(...), ...) + - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...) + - pattern: django.http.HttpResponseRedirect(..., $S % request.$W(...), ...) + - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W(...)}...", ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseRedirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseRedirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseRedirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseRedirect(..., request.$W(...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W(...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., f"...{request.$W(...)}...", ...) + - pattern: return django.http.HttpResponseRedirect(..., request.$W(...), ...) + - pattern: return django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...) + - pattern: return django.http.HttpResponseRedirect(..., $S % request.$W(...), ...) + - pattern: return django.http.HttpResponseRedirect(..., f"...{request.$W(...)}...", ...) + - pattern: django.http.HttpResponseRedirect(..., request.$W[...], ...) + - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...) + - pattern: django.http.HttpResponseRedirect(..., $S % request.$W[...], ...) + - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W[...]}...", ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseRedirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseRedirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseRedirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseRedirect(..., request.$W[...], ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W[...], ...) + - pattern: $A = django.http.HttpResponseRedirect(..., f"...{request.$W[...]}...", ...) + - pattern: return django.http.HttpResponseRedirect(..., request.$W[...], ...) + - pattern: return django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...) + - pattern: return django.http.HttpResponseRedirect(..., $S % request.$W[...], ...) + - pattern: return django.http.HttpResponseRedirect(..., f"...{request.$W[...]}...", ...) + - pattern: django.http.HttpResponseRedirect(..., request.$W, ...) + - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...) + - pattern: django.http.HttpResponseRedirect(..., $S % request.$W, ...) + - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W}...", ...) + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseRedirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseRedirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseRedirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseRedirect(..., request.$W, ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W, ...) + - pattern: $A = django.http.HttpResponseRedirect(..., f"...{request.$W}...", ...) + - pattern: return django.http.HttpResponseRedirect(..., request.$W, ...) + - pattern: return django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...) + - pattern: return django.http.HttpResponseRedirect(..., $S % request.$W, ...) + - pattern: return django.http.HttpResponseRedirect(..., f"...{request.$W}...", ...) + - metavariable-regex: + metavariable: $W + regex: (?!get_full_path) +- id: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open + message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result + in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath + or the pathlib library. + metadata: + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/www-community/attacks/Path_Traversal + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open + shortlink: https://sg.run/W8qg + semgrep.dev: + rule: + r_id: 9509 + rv_id: 1263396 + rule_id: oqUe7z + version_id: JdTzxAw + url: https://semgrep.dev/playground/r/JdTzxAw/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: open(..., request.$W.get(...), ...) + - pattern: open(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: open(..., $S % request.$W.get(...), ...) + - pattern: open(..., f"...{request.$W.get(...)}...", ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + open(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W.get(...) + + ... + + open(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...)\ + \ as $FD:\n ...\n" + - pattern: '$DATA = request.$W.get(...) + + ... + + open(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W.get(...) + + ... + + open(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n\ + \ ...\n" + - pattern: '$DATA = request.$W.get(...) + + ... + + open(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: $A = open(..., request.$W.get(...), ...) + - pattern: $A = open(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: $A = open(..., $S % request.$W.get(...), ...) + - pattern: $A = open(..., f"...{request.$W.get(...)}...", ...) + - pattern: return open(..., request.$W.get(...), ...) + - pattern: return open(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: return open(..., $S % request.$W.get(...), ...) + - pattern: return open(..., f"...{request.$W.get(...)}...", ...) + - pattern: "$DATA = request.$W.get(...)\n...\nwith open(..., $DATA, ...) as $FD:\n ...\n" + - pattern: open(..., request.$W(...), ...) + - pattern: open(..., $S.format(..., request.$W(...), ...), ...) + - pattern: open(..., $S % request.$W(...), ...) + - pattern: open(..., f"...{request.$W(...)}...", ...) + - pattern: '$DATA = request.$W(...) + + ... + + open(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W(...) + + ... + + open(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as\ + \ $FD:\n ...\n" + - pattern: '$DATA = request.$W(...) + + ... + + open(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W(...) + + ... + + open(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W(...) + + ... + + open(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: $A = open(..., request.$W(...), ...) + - pattern: $A = open(..., $S.format(..., request.$W(...), ...), ...) + - pattern: $A = open(..., $S % request.$W(...), ...) + - pattern: $A = open(..., f"...{request.$W(...)}...", ...) + - pattern: return open(..., request.$W(...), ...) + - pattern: return open(..., $S.format(..., request.$W(...), ...), ...) + - pattern: return open(..., $S % request.$W(...), ...) + - pattern: return open(..., f"...{request.$W(...)}...", ...) + - pattern: "$DATA = request.$W(...)\n...\nwith open(..., $DATA, ...) as $FD:\n ...\n" + - pattern: open(..., request.$W[...], ...) + - pattern: open(..., $S.format(..., request.$W[...], ...), ...) + - pattern: open(..., $S % request.$W[...], ...) + - pattern: open(..., f"...{request.$W[...]}...", ...) + - pattern: '$DATA = request.$W[...] + + ... + + open(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W[...] + + ... + + open(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as\ + \ $FD:\n ...\n" + - pattern: '$DATA = request.$W[...] + + ... + + open(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W[...] + + ... + + open(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W[...] + + ... + + open(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: $A = open(..., request.$W[...], ...) + - pattern: $A = open(..., $S.format(..., request.$W[...], ...), ...) + - pattern: $A = open(..., $S % request.$W[...], ...) + - pattern: $A = open(..., f"...{request.$W[...]}...", ...) + - pattern: return open(..., request.$W[...], ...) + - pattern: return open(..., $S.format(..., request.$W[...], ...), ...) + - pattern: return open(..., $S % request.$W[...], ...) + - pattern: return open(..., f"...{request.$W[...]}...", ...) + - pattern: "$DATA = request.$W[...]\n...\nwith open(..., $DATA, ...) as $FD:\n ...\n" + - pattern: open(..., request.$W, ...) + - pattern: open(..., $S.format(..., request.$W, ...), ...) + - pattern: open(..., $S % request.$W, ...) + - pattern: open(..., f"...{request.$W}...", ...) + - pattern: '$DATA = request.$W + + ... + + open(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W + + ... + + open(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as $FD:\n\ + \ ...\n" + - pattern: '$DATA = request.$W + + ... + + open(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W + + ... + + open(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W + + ... + + open(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: $A = open(..., request.$W, ...) + - pattern: $A = open(..., $S.format(..., request.$W, ...), ...) + - pattern: $A = open(..., $S % request.$W, ...) + - pattern: $A = open(..., f"...{request.$W}...", ...) + - pattern: return open(..., request.$W, ...) + - pattern: return open(..., $S.format(..., request.$W, ...), ...) + - pattern: return open(..., $S % request.$W, ...) + - pattern: return open(..., f"...{request.$W}...", ...) + - pattern: "$DATA = request.$W\n...\nwith open(..., $DATA, ...) as $FD:\n ...\n" +- id: python.django.security.injection.raw-html-format.raw-html-format + languages: + - python + severity: WARNING + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use + templates (`django.shortcuts.render`) which will safely render HTML instead. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - django + references: + - https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render + - https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format + shortlink: https://sg.run/oYj1 + semgrep.dev: + rule: + r_id: 14360 + rv_id: 1263397 + rule_id: 2ZUPER + version_id: 5PTo100 + url: https://semgrep.dev/playground/r/5PTo100/python.django.security.injection.raw-html-format.raw-html-format + origin: community + mode: taint + pattern-sanitizers: + - pattern: django.utils.html.escape(...) + pattern-sources: + - patterns: + - pattern: request.$ANYTHING + - pattern-not: request.build_absolute_uri + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$HTMLSTR" % ...' + - pattern: '"$HTMLSTR".format(...)' + - pattern: '"$HTMLSTR" + ...' + - pattern: f"$HTMLSTR{...}..." + - patterns: + - pattern-inside: '$HTML = "$HTMLSTR" + + ... + + ' + - pattern-either: + - pattern: $HTML % ... + - pattern: $HTML.format(...) + - pattern: $HTML + ... + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... +- id: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse + message: Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers + gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse + shortlink: https://sg.run/BkvA + semgrep.dev: + rule: + r_id: 9495 + rv_id: 1263398 + rule_id: JDUydR + version_id: GxTke5K + url: https://semgrep.dev/playground/r/GxTke5K/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: django.http.HttpResponse(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: django.http.HttpResponse(..., $S % request.$W.get(...), ...) + - pattern: django.http.HttpResponse(..., f"...{request.$W.get(...)}...", ...) + - pattern: django.http.HttpResponse(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponse(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponse(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponse(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponse(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponse(..., request.$W.get(...), ...) + - pattern: return django.http.HttpResponse(..., request.$W.get(...), ...) + - pattern: django.http.HttpResponse(..., $S.format(..., request.$W(...), ...), ...) + - pattern: django.http.HttpResponse(..., $S % request.$W(...), ...) + - pattern: django.http.HttpResponse(..., f"...{request.$W(...)}...", ...) + - pattern: django.http.HttpResponse(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponse(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponse(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponse(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponse(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponse(..., request.$W(...), ...) + - pattern: return django.http.HttpResponse(..., request.$W(...), ...) + - pattern: django.http.HttpResponse(..., $S.format(..., request.$W[...], ...), ...) + - pattern: django.http.HttpResponse(..., $S % request.$W[...], ...) + - pattern: django.http.HttpResponse(..., f"...{request.$W[...]}...", ...) + - pattern: django.http.HttpResponse(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponse(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponse(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponse(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponse(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponse(..., request.$W[...], ...) + - pattern: return django.http.HttpResponse(..., request.$W[...], ...) + - pattern: django.http.HttpResponse(..., $S.format(..., request.$W, ...), ...) + - pattern: django.http.HttpResponse(..., $S % request.$W, ...) + - pattern: django.http.HttpResponse(..., f"...{request.$W}...", ...) + - pattern: django.http.HttpResponse(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponse(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponse(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponse(..., f"...{$DATA}...", ...) + + ' + - pattern: $A = django.http.HttpResponse(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + $A = django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: return django.http.HttpResponse(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponse(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' +- id: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest + message: Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading + to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped + or sanitzed. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest + shortlink: https://sg.run/DoZP + semgrep.dev: + rule: + r_id: 9496 + rv_id: 1263399 + rule_id: 5rUOX1 + version_id: RGT0LY6 + url: https://semgrep.dev/playground/r/RGT0LY6/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W.get(...), ...) + - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W.get(...)}...", ...) + - pattern: django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseBadRequest(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) + - pattern: return django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) + - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W(...), ...), ...) + - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W(...), ...) + - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W(...)}...", ...) + - pattern: django.http.HttpResponseBadRequest(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseBadRequest(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W(...), ...) + - pattern: return django.http.HttpResponseBadRequest(..., request.$W(...), ...) + - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W[...], ...), ...) + - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W[...], ...) + - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W[...]}...", ...) + - pattern: django.http.HttpResponseBadRequest(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseBadRequest(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W[...], ...) + - pattern: return django.http.HttpResponseBadRequest(..., request.$W[...], ...) + - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W, ...), ...) + - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W, ...) + - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W}...", ...) + - pattern: django.http.HttpResponseBadRequest(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseBadRequest(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W, ...) + - pattern: return django.http.HttpResponseBadRequest(..., request.$W, ...) +- id: python.django.security.injection.request-data-fileresponse.request-data-fileresponse + message: Found user-controlled request data being passed into a file open, which is them passed as an argument into the + FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking + important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse. + metadata: + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse + shortlink: https://sg.run/W862 + semgrep.dev: + rule: + r_id: 9497 + rv_id: 1263400 + rule_id: GdU7QR + version_id: A8Tgd1K + url: https://semgrep.dev/playground/r/A8Tgd1K/python.django.security.injection.request-data-fileresponse.request-data-fileresponse + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: django.http.FileResponse(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.FileResponse(..., open($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = open($DATA, ...) + + ... + + django.http.FileResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.FileResponse(..., request.$W.get(...), ...) + - pattern: return django.http.FileResponse(..., request.$W.get(...), ...) + - pattern: django.http.FileResponse(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.http.FileResponse(..., open($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = open($DATA, ...) + + ... + + django.http.FileResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.FileResponse(..., request.$W(...), ...) + - pattern: return django.http.FileResponse(..., request.$W(...), ...) + - pattern: django.http.FileResponse(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.http.FileResponse(..., open($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = open($DATA, ...) + + ... + + django.http.FileResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.FileResponse(..., request.$W[...], ...) + - pattern: return django.http.FileResponse(..., request.$W[...], ...) + - pattern: django.http.FileResponse(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + django.http.FileResponse(..., open($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = open($DATA, ...) + + ... + + django.http.FileResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.FileResponse(..., request.$W, ...) + - pattern: return django.http.FileResponse(..., request.$W, ...) +- id: python.django.security.injection.request-data-write.request-data-write + message: Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able + to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause + a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized. + metadata: + cwe: + - 'CWE-93: Improper Neutralization of CRLF Sequences (''CRLF Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - django + references: + - https://owasp.org/Top10/A03_2021-Injection + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write + shortlink: https://sg.run/0Q6j + semgrep.dev: + rule: + r_id: 9498 + rv_id: 1263401 + rule_id: ReUg5z + version_id: BjTkZO5 + url: https://semgrep.dev/playground/r/BjTkZO5/python.django.security.injection.request-data-write.request-data-write + origin: community + languages: + - python + severity: WARNING + pattern-either: + - pattern: $F.write(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $F.write(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $F.write(..., $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $F.write(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $F.write(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: $A = $F.write(..., request.$W.get(...), ...) + - pattern: return $F.write(..., request.$W.get(...), ...) + - pattern: $F.write(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + $F.write(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $F.write(..., $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $F.write(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $F.write(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: $A = $F.write(..., request.$W(...), ...) + - pattern: return $F.write(..., request.$W(...), ...) + - pattern: $F.write(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + $F.write(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $F.write(..., $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $F.write(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $F.write(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: $A = $F.write(..., request.$W[...], ...) + - pattern: return $F.write(..., request.$W[...], ...) + - pattern: $F.write(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + $F.write(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $F.write(..., $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $F.write(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $F.write(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: $A = $F.write(..., request.$W, ...) + - pattern: return $F.write(..., request.$W, ...) +- id: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where + message: User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected + information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and + not using quote placeholders in the SQL string. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where + shortlink: https://sg.run/0Ql5 + semgrep.dev: + rule: + r_id: 9510 + rv_id: 1263402 + rule_id: zdUkx1 + version_id: DkTRb4l + url: https://semgrep.dev/playground/r/DkTRb4l/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W.get(...), ...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W.get(...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W.get(...)}...", ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) + - pattern: return $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W(...), ...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W(...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W(...)}...", ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) + - pattern: return $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W[...], ...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W[...], ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W[...]}...", ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) + - pattern: return $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W, ...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W, ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W}...", ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) + - pattern: return $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' +- id: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql + message: User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected + information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and + not using quote placeholders in the SQL string. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql + shortlink: https://sg.run/Kl4X + semgrep.dev: + rule: + r_id: 9511 + rv_id: 1263403 + rule_id: pKUOBp + version_id: WrTqK2L + url: https://semgrep.dev/playground/r/WrTqK2L/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W.get(...), ...) + - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W.get(...)}...", ...) + - pattern: django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.db.models.expressions.RawSQL(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) + - pattern: return django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) + - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W(...), ...), ...) + - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W(...), ...) + - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W(...)}...", ...) + - pattern: django.db.models.expressions.RawSQL(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.db.models.expressions.RawSQL(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W(...), ...) + - pattern: return django.db.models.expressions.RawSQL(..., request.$W(...), ...) + - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W[...], ...), ...) + - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W[...], ...) + - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W[...]}...", ...) + - pattern: django.db.models.expressions.RawSQL(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.db.models.expressions.RawSQL(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W[...], ...) + - pattern: return django.db.models.expressions.RawSQL(..., request.$W[...], ...) + - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W, ...), ...) + - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W, ...) + - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W}...", ...) + - pattern: django.db.models.expressions.RawSQL(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + django.db.models.expressions.RawSQL(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W, ...) + - pattern: return django.db.models.expressions.RawSQL(..., request.$W, ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL($INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL($INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL($INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL($INTERM, ...) + + ' +- id: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute + message: User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore + protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and + therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute + shortlink: https://sg.run/qx7y + semgrep.dev: + rule: + r_id: 9512 + rv_id: 1263404 + rule_id: 2ZUbDL + version_id: 0bTKzRj + url: https://semgrep.dev/playground/r/0bTKzRj/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: $CURSOR.execute(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: $CURSOR.execute(..., $S % request.$W.get(...), ...) + - pattern: $CURSOR.execute(..., f"...{request.$W.get(...)}...", ...) + - pattern: $CURSOR.execute(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $CURSOR.execute(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $CURSOR.execute(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $CURSOR.execute(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $CURSOR.execute(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: $A = $CURSOR.execute(..., request.$W.get(...), ...) + - pattern: return $CURSOR.execute(..., request.$W.get(...), ...) + - pattern: $CURSOR.execute(..., $S.format(..., request.$W(...), ...), ...) + - pattern: $CURSOR.execute(..., $S % request.$W(...), ...) + - pattern: $CURSOR.execute(..., f"...{request.$W(...)}...", ...) + - pattern: $CURSOR.execute(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + $CURSOR.execute(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $CURSOR.execute(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $CURSOR.execute(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $CURSOR.execute(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: $A = $CURSOR.execute(..., request.$W(...), ...) + - pattern: return $CURSOR.execute(..., request.$W(...), ...) + - pattern: $CURSOR.execute(..., $S.format(..., request.$W[...], ...), ...) + - pattern: $CURSOR.execute(..., $S % request.$W[...], ...) + - pattern: $CURSOR.execute(..., f"...{request.$W[...]}...", ...) + - pattern: $CURSOR.execute(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + $CURSOR.execute(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $CURSOR.execute(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $CURSOR.execute(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $CURSOR.execute(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: $A = $CURSOR.execute(..., request.$W[...], ...) + - pattern: return $CURSOR.execute(..., request.$W[...], ...) + - pattern: $CURSOR.execute(..., $S.format(..., request.$W, ...), ...) + - pattern: $CURSOR.execute(..., $S % request.$W, ...) + - pattern: $CURSOR.execute(..., f"...{request.$W}...", ...) + - pattern: $CURSOR.execute(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + $CURSOR.execute(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $CURSOR.execute(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $CURSOR.execute(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $CURSOR.execute(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: $A = $CURSOR.execute(..., request.$W, ...) + - pattern: return $CURSOR.execute(..., request.$W, ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $CURSOR.execute($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $CURSOR.execute($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $CURSOR.execute($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $CURSOR.execute($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $CURSOR.execute($INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $CURSOR.execute($INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $CURSOR.execute($INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $CURSOR.execute($INTERM, ...)' +- id: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw + message: Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection + and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization + and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw + shortlink: https://sg.run/l2v9 + semgrep.dev: + rule: + r_id: 9513 + rv_id: 1263405 + rule_id: X5U8v5 + version_id: K3TKkBW + url: https://semgrep.dev/playground/r/K3TKkBW/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: $MODEL.objects.raw(..., $S % request.$W.get(...), ...) + - pattern: $MODEL.objects.raw(..., f"...{request.$W.get(...)}...", ...) + - pattern: $MODEL.objects.raw(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.raw(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.raw(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.raw(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.raw(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: $A = $MODEL.objects.raw(..., request.$W.get(...), ...) + - pattern: return $MODEL.objects.raw(..., request.$W.get(...), ...) + - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W(...), ...), ...) + - pattern: $MODEL.objects.raw(..., $S % request.$W(...), ...) + - pattern: $MODEL.objects.raw(..., f"...{request.$W(...)}...", ...) + - pattern: $MODEL.objects.raw(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.raw(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.raw(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.raw(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.raw(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: $A = $MODEL.objects.raw(..., request.$W(...), ...) + - pattern: return $MODEL.objects.raw(..., request.$W(...), ...) + - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W[...], ...), ...) + - pattern: $MODEL.objects.raw(..., $S % request.$W[...], ...) + - pattern: $MODEL.objects.raw(..., f"...{request.$W[...]}...", ...) + - pattern: $MODEL.objects.raw(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.raw(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.raw(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.raw(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.raw(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: $A = $MODEL.objects.raw(..., request.$W[...], ...) + - pattern: return $MODEL.objects.raw(..., request.$W[...], ...) + - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W, ...), ...) + - pattern: $MODEL.objects.raw(..., $S % request.$W, ...) + - pattern: $MODEL.objects.raw(..., f"...{request.$W}...", ...) + - pattern: $MODEL.objects.raw(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.raw(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.raw(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.raw(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.raw(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: $A = $MODEL.objects.raw(..., request.$W, ...) + - pattern: return $MODEL.objects.raw(..., request.$W, ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.raw($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.raw($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.raw($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.raw($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.raw($INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.raw($INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.raw($INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.raw($INTERM, ...) + + ' +- id: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests + message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery + (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to + the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery + to learn more about SSRF vulnerabilities. + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests + shortlink: https://sg.run/YvY4 + semgrep.dev: + rule: + r_id: 9514 + rv_id: 1263406 + rule_id: j2UvEw + version_id: qkTR7zn + url: https://semgrep.dev/playground/r/qkTR7zn/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests + origin: community + languages: + - python + severity: ERROR + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: requests.$METHOD(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: requests.$METHOD(..., $S % request.$W.get(...), ...) + - pattern: requests.$METHOD(..., f"...{request.$W.get(...)}...", ...) + - pattern: requests.$METHOD(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + requests.$METHOD(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + requests.$METHOD(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + requests.$METHOD(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + requests.$METHOD(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: $A = requests.$METHOD(..., request.$W.get(...), ...) + - pattern: return requests.$METHOD(..., request.$W.get(...), ...) + - pattern: requests.$METHOD(..., $S.format(..., request.$W(...), ...), ...) + - pattern: requests.$METHOD(..., $S % request.$W(...), ...) + - pattern: requests.$METHOD(..., f"...{request.$W(...)}...", ...) + - pattern: requests.$METHOD(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + requests.$METHOD(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + requests.$METHOD(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + requests.$METHOD(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + requests.$METHOD(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: $A = requests.$METHOD(..., request.$W(...), ...) + - pattern: return requests.$METHOD(..., request.$W(...), ...) + - pattern: requests.$METHOD(..., $S.format(..., request.$W[...], ...), ...) + - pattern: requests.$METHOD(..., $S % request.$W[...], ...) + - pattern: requests.$METHOD(..., f"...{request.$W[...]}...", ...) + - pattern: requests.$METHOD(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + requests.$METHOD(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + requests.$METHOD(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + requests.$METHOD(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + requests.$METHOD(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: $A = requests.$METHOD(..., request.$W[...], ...) + - pattern: return requests.$METHOD(..., request.$W[...], ...) + - pattern: requests.$METHOD(..., $S.format(..., request.$W, ...), ...) + - pattern: requests.$METHOD(..., $S % request.$W, ...) + - pattern: requests.$METHOD(..., f"...{request.$W}...", ...) + - pattern: requests.$METHOD(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + requests.$METHOD(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + requests.$METHOD(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + requests.$METHOD(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + requests.$METHOD(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: $A = requests.$METHOD(..., request.$W, ...) + - pattern: return requests.$METHOD(..., request.$W, ...) +- id: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib + message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery + (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes + and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication + and transport-layer security in the proxied request. + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib + shortlink: https://sg.run/6n2B + semgrep.dev: + rule: + r_id: 9515 + rv_id: 1263407 + rule_id: 10UKDo + version_id: l4TJRwD + url: https://semgrep.dev/playground/r/l4TJRwD/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib + origin: community + languages: + - python + severity: ERROR + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: urllib.request.urlopen(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: urllib.request.urlopen(..., $S % request.$W.get(...), ...) + - pattern: urllib.request.urlopen(..., f"...{request.$W.get(...)}...", ...) + - pattern: urllib.request.urlopen(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + urllib.request.urlopen(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + urllib.request.urlopen(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + urllib.request.urlopen(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + urllib.request.urlopen(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: $A = urllib.request.urlopen(..., request.$W.get(...), ...) + - pattern: return urllib.request.urlopen(..., request.$W.get(...), ...) + - pattern: urllib.request.urlopen(..., $S.format(..., request.$W(...), ...), ...) + - pattern: urllib.request.urlopen(..., $S % request.$W(...), ...) + - pattern: urllib.request.urlopen(..., f"...{request.$W(...)}...", ...) + - pattern: urllib.request.urlopen(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + urllib.request.urlopen(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + urllib.request.urlopen(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + urllib.request.urlopen(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + urllib.request.urlopen(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: $A = urllib.request.urlopen(..., request.$W(...), ...) + - pattern: return urllib.request.urlopen(..., request.$W(...), ...) + - pattern: urllib.request.urlopen(..., $S.format(..., request.$W[...], ...), ...) + - pattern: urllib.request.urlopen(..., $S % request.$W[...], ...) + - pattern: urllib.request.urlopen(..., f"...{request.$W[...]}...", ...) + - pattern: urllib.request.urlopen(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + urllib.request.urlopen(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + urllib.request.urlopen(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + urllib.request.urlopen(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + urllib.request.urlopen(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: $A = urllib.request.urlopen(..., request.$W[...], ...) + - pattern: return urllib.request.urlopen(..., request.$W[...], ...) + - pattern: urllib.request.urlopen(..., $S.format(..., request.$W, ...), ...) + - pattern: urllib.request.urlopen(..., $S % request.$W, ...) + - pattern: urllib.request.urlopen(..., f"...{request.$W}...", ...) + - pattern: urllib.request.urlopen(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + urllib.request.urlopen(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + urllib.request.urlopen(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + urllib.request.urlopen(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + urllib.request.urlopen(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: $A = urllib.request.urlopen(..., request.$W, ...) + - pattern: return urllib.request.urlopen(..., request.$W, ...) +- id: python.django.security.passwords.password-empty-string.password-empty-string + message: '''$VAR'' is the empty string and is being used to set the password on ''$MODEL''. If you meant to set an unusable + password, set the password to None or call ''set_unusable_password()''.' + metadata: + cwe: + - 'CWE-521: Weak Password Requirements' + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password + category: security + technology: + - django + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string + shortlink: https://sg.run/oxnR + semgrep.dev: + rule: + r_id: 9516 + rv_id: 1263411 + rule_id: 9AU1jW + version_id: GxTke5Q + url: https://semgrep.dev/playground/r/GxTke5Q/python.django.security.passwords.password-empty-string.password-empty-string + origin: community + patterns: + - pattern-either: + - pattern: '$MODEL.set_password($EMPTY) + + ... + + $MODEL.save() + + ' + - pattern: '$VAR = $EMPTY + + ... + + $MODEL.set_password($VAR) + + ... + + $MODEL.save() + + ' + - metavariable-regex: + metavariable: $EMPTY + regex: (\'\'|\"\") + languages: + - python + severity: ERROR +- id: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default + message: '''$VAR'' is using the empty string as its default and is being used to set the password on ''$MODEL''. If you + meant to set an unusable password, set the default value to ''None'' or call ''set_unusable_password()''.' + metadata: + cwe: + - 'CWE-521: Weak Password Requirements' + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password + category: security + technology: + - django + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default + shortlink: https://sg.run/zvBW + semgrep.dev: + rule: + r_id: 9517 + rv_id: 1263412 + rule_id: yyUn6Z + version_id: RGT0LYX + url: https://semgrep.dev/playground/r/RGT0LYX/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default + origin: community + languages: + - python + severity: ERROR + patterns: + - pattern-either: + - pattern: '$VAR = request.$W.get($X, $EMPTY) + + ... + + $MODEL.set_password($VAR) + + ... + + $MODEL.save(...) + + ' + - pattern: "def $F(..., $VAR=$EMPTY, ...):\n ...\n $MODEL.set_password($VAR)\n" + - metavariable-pattern: + metavariable: $EMPTY + pattern: '""' + - focus-metavariable: $EMPTY + fix: 'None + + ' +- id: python.fastapi.security.wildcard-cors.wildcard-cors + languages: + - python + message: CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided. + mode: taint + pattern-sources: + - pattern: '[..., "*", ...]' + pattern-sinks: + - patterns: + - pattern: "$APP.add_middleware(\n CORSMiddleware,\n allow_origins=$ORIGIN,\n ...);\n" + - focus-metavariable: $ORIGIN + severity: WARNING + metadata: + cwe: + - 'CWE-942: Permissive Cross-domain Policy with Untrusted Domains' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - python + - fastapi + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + - https://cwe.mitre.org/data/definitions/942.html + likelihood: HIGH + impact: LOW + confidence: MEDIUM + vulnerability_class: + - Configuration + subcategory: + - vuln + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors + shortlink: https://sg.run/KxApY + semgrep.dev: + rule: + r_id: 112311 + rv_id: 1263413 + rule_id: lBU4JQ3 + version_id: A8Tgd1R + url: https://semgrep.dev/playground/r/A8Tgd1R/python.fastapi.security.wildcard-cors.wildcard-cors + origin: community +- id: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host + message: Running flask app with host 0.0.0.0 could expose the server publicly. + metadata: + cwe: + - 'CWE-668: Exposure of Resource to Wrong Sphere' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - flask + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host + shortlink: https://sg.run/eLby + semgrep.dev: + rule: + r_id: 9532 + rv_id: 1263414 + rule_id: L1Uy1n + version_id: BjTkZOY + url: https://semgrep.dev/playground/r/BjTkZOY/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host + origin: community + languages: + - python + severity: WARNING + pattern-either: + - pattern: app.run(..., host="0.0.0.0", ...) + - pattern: app.run(..., "0.0.0.0", ...) +- id: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly + patterns: + - pattern-not-inside: "if __name__ == '__main__':\n ...\n" + - pattern-not-inside: "def $X(...):\n ...\n" + - pattern: app.run(...) + message: top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function + metadata: + cwe: + - 'CWE-668: Exposure of Resource to Wrong Sphere' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - flask + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly + shortlink: https://sg.run/vz5b + semgrep.dev: + rule: + r_id: 9533 + rv_id: 1263415 + rule_id: 8GUjdX + version_id: DkTRb4z + url: https://semgrep.dev/playground/r/DkTRb4z/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly + origin: community + languages: + - python + severity: WARNING +- id: python.flask.security.audit.debug-enabled.debug-enabled + patterns: + - pattern-inside: 'import flask + + ... + + ' + - pattern: $APP.run(..., debug=True, ...) + message: Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive + information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables. + metadata: + cwe: + - 'CWE-489: Active Debug Code' + owasp: A06:2017 - Security Misconfiguration + references: + - https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/ + category: security + technology: + - flask + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Active Debug Code + source: https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled + shortlink: https://sg.run/dKrd + semgrep.dev: + rule: + r_id: 9534 + rv_id: 946206 + rule_id: gxU1bd + version_id: 8KTKjwR + url: https://semgrep.dev/playground/r/8KTKjwR/python.flask.security.audit.debug-enabled.debug-enabled + origin: community + severity: WARNING + languages: + - python +- id: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string + message: Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input + can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - flask + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string + shortlink: https://sg.run/Zv6o + semgrep.dev: + rule: + r_id: 9535 + rv_id: 1263416 + rule_id: QrUz49 + version_id: WrTqKAz + url: https://semgrep.dev/playground/r/WrTqKAz/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string + origin: community + languages: + - python + severity: WARNING + mode: taint + pattern-sources: + - pattern-either: + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $PARAM, ...):\n ...\n" + - pattern: $PARAM + - pattern: 'request.$FUNC.get(...) + + ' + - pattern: 'request.$FUNC(...) + + ' + - pattern: request.$FUNC[...] + pattern-sinks: + - patterns: + - pattern-not-inside: return "..." + - pattern-either: + - pattern: return "...".format(...) + - pattern: return "..." % ... + - pattern: return "..." + ... + - pattern: return ... + "..." + - pattern: return f"...{...}..." + - patterns: + - pattern: return $X + - pattern-either: + - pattern-inside: '$X = "...".format(...) + + ... + + ' + - pattern-inside: '$X = "..." % ... + + ... + + ' + - pattern-inside: '$X = "..." + ... + + ... + + ' + - pattern-inside: '$X = ... + "..." + + ... + + ' + - pattern-inside: '$X = f"...{...}..." + + ... + + ' + - pattern-not-inside: '$X = "..." + + ... + + ' +- id: python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true + message: Function `flask.url_for` with `_external=True` argument will generate URLs using the `Host` header of the HTTP + request, which may lead to security risks such as Host header injection + metadata: + cwe: + - 'CWE-673: External Influence of Sphere Definition' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - flask + references: + - https://flask.palletsprojects.com/en/latest/api/#flask.url_for + - https://portswigger.net/kb/issues/00500300_host-header-injection + subcategory: + - audit + likelihood: MEDIUM + impact: LOW + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true + shortlink: https://sg.run/gEGeR + semgrep.dev: + rule: + r_id: 191541 + rv_id: 1263418 + rule_id: JDU5oql + version_id: K3TKk6n + url: https://semgrep.dev/playground/r/K3TKk6n/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-not: flask.url_for(..., _external=False, ...) + - pattern-not: url_for(..., _external=False, ...) + - pattern-either: + - pattern: flask.url_for(..., _external=$VAR, ...) + - pattern: url_for(..., _external=$VAR, ...) +- id: python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret + languages: + - python + message: The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, + the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through + the HashIDs. + metadata: + category: security + subcategory: + - vuln + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A02:2021 – Cryptographic Failures + references: + - https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY + - http://carnage.github.io/2015/08/cryptanalysis-of-hashids + technology: + - flask + likelihood: LOW + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret + shortlink: https://sg.run/N0Rx + semgrep.dev: + rule: + r_id: 72427 + rv_id: 946220 + rule_id: KxUX3z + version_id: 0bT15Px + url: https://semgrep.dev/playground/r/0bT15Px/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret + origin: community + pattern-either: + - pattern: hashids.Hashids(..., salt=flask.current_app.config['SECRET_KEY'], ...) + - pattern: hashids.Hashids(flask.current_app.config['SECRET_KEY'], ...) + - patterns: + - pattern-inside: '$APP = flask.Flask(...) + + ... + + ' + - pattern-either: + - pattern: hashids.Hashids(..., salt=$APP.config['SECRET_KEY'], ...) + - pattern: hashids.Hashids($APP.config['SECRET_KEY'], ...) + severity: ERROR +- id: python.flask.security.injection.csv-writer-injection.csv-writer-injection + languages: + - python + message: Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate + the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet + application that runs an attacker script, which could steal data from the importing user or, at worst, install malware + on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula + injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs. + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-1236: Improper Neutralization of Formula Elements in a CSV File' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://github.com/raphaelm/defusedcsv + - https://owasp.org/www-community/attacks/CSV_Injection + - https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities + technology: + - python + - flask + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.flask.security.injection.csv-writer-injection.csv-writer-injection + shortlink: https://sg.run/JzqQ + semgrep.dev: + rule: + r_id: 31146 + rv_id: 1263428 + rule_id: L1UR2K + version_id: jQTn50Y + url: https://semgrep.dev/playground/r/jQTn50Y/python.flask.security.injection.csv-writer-injection.csv-writer-injection + origin: community + mode: taint + pattern-sinks: + - patterns: + - pattern-inside: '$WRITER = csv.writer(...) + + + ... + + + $WRITER.$WRITE(...) + + ' + - pattern: $WRITER.$WRITE(...) + - metavariable-regex: + metavariable: $WRITE + regex: ^(writerow|writerows|writeheader)$ + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + severity: ERROR +- id: python.flask.security.injection.os-system-injection.os-system-injection + languages: + - python + severity: ERROR + message: User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this + must be done, use the 'subprocess' module instead and pass the arguments as a list. + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/Command_Injection + category: security + technology: + - flask + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection + shortlink: https://sg.run/4xzz + semgrep.dev: + rule: + r_id: 9544 + rv_id: 1263429 + rule_id: BYUN99 + version_id: 1QTypw7 + url: https://semgrep.dev/playground/r/1QTypw7/python.flask.security.injection.os-system-injection.os-system-injection + origin: community + pattern-either: + - patterns: + - pattern: os.system(...) + - pattern-either: + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n os.system(..., <... $ROUTEVAR\ + \ ...>, ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ + \ ...\n os.system(..., <... $INTERM ...>, ...)\n" + - pattern: os.system(..., <... flask.request.$W.get(...) ...>, ...) + - pattern: os.system(..., <... flask.request.$W[...] ...>, ...) + - pattern: os.system(..., <... flask.request.$W(...) ...>, ...) + - pattern: os.system(..., <... flask.request.$W ...>, ...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> + + ... + + os.system(<... $INTERM ...>) + + ' + - pattern: os.system(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> + + ... + + os.system(<... $INTERM ...>) + + ' + - pattern: os.system(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> + + ... + + os.system(<... $INTERM ...>) + + ' + - pattern: os.system(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W ...> + + ... + + os.system(<... $INTERM ...>) + + ' + - pattern: os.system(...) +- id: python.flask.security.injection.path-traversal-open.path-traversal-open + languages: + - python + severity: ERROR + message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result + in path traversal attacks. + metadata: + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/www-community/attacks/Path_Traversal + category: security + technology: + - flask + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open + shortlink: https://sg.run/PJRW + semgrep.dev: + rule: + r_id: 9545 + rv_id: 1263430 + rule_id: DbUpOQ + version_id: 9lT4b94 + url: https://semgrep.dev/playground/r/9lT4b94/python.flask.security.injection.path-traversal-open.path-traversal-open + origin: community + pattern-either: + - patterns: + - pattern: open(...) + - pattern-either: + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n open(..., <... $ROUTEVAR ...>,\ + \ ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n with open(..., <... $ROUTEVAR\ + \ ...>, ...) as $FD:\n ...\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ + \ ...\n open(..., <... $INTERM ...>, ...)\n" + - pattern: open(..., <... flask.request.$W.get(...) ...>, ...) + - pattern: open(..., <... flask.request.$W[...] ...>, ...) + - pattern: open(..., <... flask.request.$W(...) ...>, ...) + - pattern: open(..., <... flask.request.$W ...>, ...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> + + ... + + open(<... $INTERM ...>, ...) + + ' + - pattern: open(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> + + ... + + open(<... $INTERM ...>, ...) + + ' + - pattern: open(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> + + ... + + open(<... $INTERM ...>, ...) + + ' + - pattern: open(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W ...> + + ... + + open(<... $INTERM ...>, ...) + + ' + - pattern: open(...) + - patterns: + - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n ...\n" + - pattern: open(...) + - patterns: + - pattern-inside: "$INTERM = <... flask.request.$W[...] ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n ...\n" + - pattern: open(...) + - patterns: + - pattern-inside: "$INTERM = <... flask.request.$W(...) ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n ...\n" + - pattern: open(...) + - patterns: + - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n ...\n" + - pattern: open(...) +- id: python.flask.security.injection.raw-html-concat.raw-html-format + languages: + - python + severity: WARNING + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use + templates (`flask.render_template`) which will safely render HTML instead. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - flask + references: + - https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format + shortlink: https://sg.run/Pb7e + semgrep.dev: + rule: + r_id: 14389 + rv_id: 1409401 + rule_id: GdUrJv + version_id: RGTEN1l + url: https://semgrep.dev/playground/r/RGTEN1l/python.flask.security.injection.raw-html-concat.raw-html-format + origin: community + mode: taint + pattern-sanitizers: + - pattern: jinja2.escape(...) + - pattern: flask.escape(...) + - patterns: + - pattern: flask.render_template($TPL, ...) + - metavariable-regex: + metavariable: $TPL + regex: .*\.html + pattern-sources: + - patterns: + - pattern-either: + - pattern: flask.request.$ANYTHING + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - pattern: $ROUTEVAR + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$HTMLSTR" % ...' + - pattern: '"$HTMLSTR".format(...)' + - pattern: '"$HTMLSTR" + ...' + - pattern: f"$HTMLSTR{...}..." + - patterns: + - pattern-inside: '$HTML = "$HTMLSTR" + + ... + + ' + - pattern-either: + - pattern: $HTML % ... + - pattern: $HTML.format(...) + - pattern: $HTML + ... + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... +- id: python.flask.security.injection.ssrf-requests.ssrf-requests + languages: + - python + severity: ERROR + message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery + (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to + the user, and ensure proper authentication and transport-layer security in the proxied request. + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery + category: security + technology: + - flask + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests + shortlink: https://sg.run/J9LW + semgrep.dev: + rule: + r_id: 9546 + rv_id: 1263432 + rule_id: WAUoRx + version_id: rxTAKJn + url: https://semgrep.dev/playground/r/rxTAKJn/python.flask.security.injection.ssrf-requests.ssrf-requests + origin: community + pattern-either: + - patterns: + - pattern: requests.$FUNC(...) + - pattern-either: + - pattern-inside: "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n ...\n requests.$FUNC(...,\ + \ <... $ROUTEVAR ...>, ...)\n" + - pattern-inside: "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <...\ + \ $ROUTEVAR ...>\n ...\n requests.$FUNC(..., <... $INTERM ...>, ...)\n" + - metavariable-regex: + metavariable: $ROUTE_METHOD + regex: ^(route|get|post|put|delete|patch)$ + - pattern: requests.$FUNC(..., <... flask.request.$W.get(...) ...>, ...) + - pattern: requests.$FUNC(..., <... flask.request.$W[...] ...>, ...) + - pattern: requests.$FUNC(..., <... flask.request.$W(...) ...>, ...) + - pattern: requests.$FUNC(..., <... flask.request.$W ...>, ...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> + + ... + + requests.$FUNC(<... $INTERM ...>, ...) + + ' + - pattern: requests.$FUNC(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> + + ... + + requests.$FUNC(<... $INTERM ...>, ...) + + ' + - pattern: requests.$FUNC(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> + + ... + + requests.$FUNC(<... $INTERM ...>, ...) + + ' + - pattern: requests.$FUNC(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W ...> + + ... + + requests.$FUNC(<... $INTERM ...>, ...) + + ' + - pattern: requests.$FUNC(...) +- id: python.flask.security.injection.subprocess-injection.subprocess-injection + languages: + - python + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: subprocess.$FUNC(...) + - pattern-not: subprocess.$FUNC("...", ...) + - pattern-not: subprocess.$FUNC(["...", ...], ...) + - pattern-not-inside: '$CMD = ["...", ...] + + ... + + subprocess.$FUNC($CMD, ...) + + ' + - patterns: + - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...) + - metavariable-regex: + metavariable: $SHELL + regex: ^(sh|bash|ksh|csh|tcsh|zsh)$ + - patterns: + - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...) + - metavariable-regex: + metavariable: $INTERPRETER + regex: ^(python|python\d)$ + pattern-sanitizers: + - patterns: + - pattern: $DICT[$KEY] + - focus-metavariable: $KEY + severity: ERROR + message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. + An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, + scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, + prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set + of commands. + metadata: + category: security + technology: + - flask + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection + shortlink: https://sg.run/5gW3 + semgrep.dev: + rule: + r_id: 31147 + rv_id: 1263433 + rule_id: 8GU3qp + version_id: bZT53gQ + url: https://semgrep.dev/playground/r/bZT53gQ/python.flask.security.injection.subprocess-injection.subprocess-injection + origin: community +- id: python.flask.security.injection.tainted-sql-string.tainted-sql-string + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction + could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the + database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider + using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries. + metadata: + cwe: + - 'CWE-704: Incorrect Type Conversion or Cast' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql + - https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm + - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column + category: security + technology: + - sqlalchemy + - flask + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/JxZj + semgrep.dev: + rule: + r_id: 14702 + rv_id: 1409402 + rule_id: YGUDKQ + version_id: A8TEvb4 + url: https://semgrep.dev/playground/r/A8TEvb4/python.flask.security.injection.tainted-sql-string.tainted-sql-string + origin: community + severity: ERROR + languages: + - python + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: flask.request.$ANYTHING + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - pattern: $ROUTEVAR + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '"$SQLSTR" + ... + + ' + - pattern: '"$SQLSTR" % ... + + ' + - pattern: '"$SQLSTR".format(...) + + ' + - pattern: 'f"$SQLSTR{...}..." + + ' + - metavariable-regex: + metavariable: $SQLSTR + regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.* +- id: python.flask.security.injection.tainted-url-host.tainted-url-host + languages: + - python + message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data + to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. + They could also probe internal servers or other resources that the server running this code can access. (This is called + server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, + or hardcode the correct host. + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html + category: security + technology: + - flask + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host + shortlink: https://sg.run/RXpK + semgrep.dev: + rule: + r_id: 14649 + rv_id: 1409403 + rule_id: ReU3Wb + version_id: BjTy42w + url: https://semgrep.dev/playground/r/BjTy42w/python.flask.security.injection.tainted-url-host.tainted-url-host + origin: community + mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: '"$URLSTR" % ...' + - metavariable-pattern: + metavariable: $URLSTR + language: generic + patterns: + - pattern-either: + - pattern: $SCHEME://%s + - pattern: $SCHEME://%r + - patterns: + - pattern: '"$URLSTR".format(...)' + - metavariable-pattern: + metavariable: $URLSTR + language: generic + pattern: $SCHEME:// { ... } + - patterns: + - pattern: '"$URLSTR" + ...' + - metavariable-regex: + metavariable: $URLSTR + regex: .*://$ + - patterns: + - pattern: f"$URLSTR{...}..." + - metavariable-regex: + metavariable: $URLSTR + regex: .*://$ + - patterns: + - pattern-inside: '$URL = "$URLSTR" + + ... + + ' + - pattern: $URL += ... + - metavariable-regex: + metavariable: $URLSTR + regex: .*://$ + pattern-sources: + - patterns: + - pattern-either: + - pattern: flask.request.$ANYTHING + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - pattern: $ROUTEVAR + severity: WARNING +- id: python.flask.security.injection.user-eval.eval-injection + languages: + - python + severity: ERROR + message: Detected user data flowing into eval. This is code injection and should be avoided. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html + category: security + technology: + - flask + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection + shortlink: https://sg.run/5QpX + semgrep.dev: + rule: + r_id: 9547 + rv_id: 1263436 + rule_id: 0oU54W + version_id: w8TRoB0 + url: https://semgrep.dev/playground/r/w8TRoB0/python.flask.security.injection.user-eval.eval-injection + origin: community + pattern-either: + - patterns: + - pattern: eval(...) + - pattern-either: + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n eval(..., <... $ROUTEVAR ...>,\ + \ ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ + \ ...\n eval(..., <... $INTERM ...>, ...)\n" + - pattern: eval(..., <... flask.request.$W.get(...) ...>, ...) + - pattern: eval(..., <... flask.request.$W[...] ...>, ...) + - pattern: eval(..., <... flask.request.$W(...) ...>, ...) + - pattern: eval(..., <... flask.request.$W ...>, ...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> + + ... + + eval(..., <... $INTERM ...>, ...) + + ' + - pattern: eval(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> + + ... + + eval(..., <... $INTERM ...>, ...) + + ' + - pattern: eval(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> + + ... + + eval(..., <... $INTERM ...>, ...) + + ' + - pattern: eval(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W ...> + + ... + + eval(..., <... $INTERM ...>, ...) + + ' + - pattern: eval(...) +- id: python.flask.security.injection.user-exec.exec-injection + languages: + - python + severity: ERROR + message: Detected user data flowing into exec. This is code injection and should be avoided. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html + category: security + technology: + - flask + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection + shortlink: https://sg.run/Ge42 + semgrep.dev: + rule: + r_id: 9548 + rv_id: 1263437 + rule_id: KxUbl2 + version_id: xyTjzD9 + url: https://semgrep.dev/playground/r/xyTjzD9/python.flask.security.injection.user-exec.exec-injection + origin: community + pattern-either: + - patterns: + - pattern: exec(...) + - pattern-either: + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n exec(..., <... $ROUTEVAR ...>,\ + \ ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ + \ ...\n exec(..., <... $INTERM ...>, ...)\n" + - pattern: exec(..., <... flask.request.$W.get(...) ...>, ...) + - pattern: exec(..., <... flask.request.$W[...] ...>, ...) + - pattern: exec(..., <... flask.request.$W(...) ...>, ...) + - pattern: exec(..., <... flask.request.$W ...>, ...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> + + ... + + exec(..., <... $INTERM ...>, ...) + + ' + - pattern: exec(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> + + ... + + exec(..., <... $INTERM ...>, ...) + + ' + - pattern: exec(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> + + ... + + exec(..., <... $INTERM ...>, ...) + + ' + - pattern: exec(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W ...> + + ... + + exec(..., <... $INTERM ...>, ...) + + ' + - pattern: exec(...) +- id: python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled + patterns: + - pattern: jinja2.Environment(... , autoescape=$VAL, ...) + - pattern-not: jinja2.Environment(... , autoescape=True, ...) + - pattern-not: jinja2.Environment(... , autoescape=jinja2.select_autoescape(...), ...) + - focus-metavariable: $VAL + fix: 'True + + ' + message: Detected a Jinja2 environment with 'autoescaping' disabled. This is dangerous if you are rendering to a browser + because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable 'autoescaping' by setting + 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain + file extensions. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html + cwe: + - 'CWE-116: Improper Encoding or Escaping of Output' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://jinja.palletsprojects.com/en/2.11.x/api/#basics + category: security + technology: + - jinja2 + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Encoding + source: https://semgrep.dev/r/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled + shortlink: https://sg.run/L2L7 + semgrep.dev: + rule: + r_id: 20039 + rv_id: 1263448 + rule_id: QrU1Xg + version_id: gETB7oN + url: https://semgrep.dev/playground/r/gETB7oN/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled + origin: community + languages: + - python + severity: WARNING +- id: python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled + patterns: + - pattern-not: jinja2.Environment(..., autoescape=$VAL, ...) + - pattern: jinja2.Environment(...) + fix-regex: + regex: (.*)\) + replacement: \1, autoescape=True) + message: Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous if + you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, + enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable + automatic escaping for certain file extensions. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html + cwe: + - 'CWE-116: Improper Encoding or Escaping of Output' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://jinja.palletsprojects.com/en/2.11.x/api/#basics + category: security + technology: + - jinja2 + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Encoding + source: https://semgrep.dev/r/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled + shortlink: https://sg.run/8kY4 + semgrep.dev: + rule: + r_id: 20040 + rv_id: 1263449 + rule_id: 3qULRx + version_id: QkTGqje + url: https://semgrep.dev/playground/r/QkTGqje/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled + origin: community + languages: + - python + severity: WARNING +- id: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret + message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html + Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + references: + - https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + category: security + technology: + - jwt + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret + shortlink: https://sg.run/l2E9 + semgrep.dev: + rule: + r_id: 9557 + rv_id: 1263452 + rule_id: X5U8P5 + version_id: PkTR3X3 + url: https://semgrep.dev/playground/r/PkTR3X3/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret + origin: community + patterns: + - pattern: 'jwt.encode($_, "...", ...) + + ' + languages: + - python + severity: ERROR +- id: python.jwt.security.jwt-none-alg.jwt-python-none-alg + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has + already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do + not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + category: security + technology: + - jwt + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg + shortlink: https://sg.run/Yvp4 + semgrep.dev: + rule: + r_id: 9558 + rv_id: 1263453 + rule_id: j2UvKw + version_id: JdTzxYj + url: https://semgrep.dev/playground/r/JdTzxYj/python.jwt.security.jwt-none-alg.jwt-python-none-alg + origin: community + languages: + - python + severity: ERROR + pattern-either: + - pattern: 'jwt.encode(...,algorithm="none",...) + + ' + - pattern: jwt.decode(...,algorithms=[...,"none",...],...) +- id: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode + patterns: + - pattern-either: + - patterns: + - pattern: 'jwt.decode(..., options={..., "verify_signature": $BOOL, ...}, ...) + + ' + - metavariable-pattern: + metavariable: $BOOL + pattern: 'False + + ' + - focus-metavariable: $BOOL + - patterns: + - pattern: '$OPTS = {..., "verify_signature": $BOOL, ...} + + ... + + jwt.decode(..., options=$OPTS, ...) + + ' + - metavariable-pattern: + metavariable: $BOOL + pattern: 'False + + ' + - focus-metavariable: $BOOL + message: Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the + token could be tampered with by malicious actors. Ensure that the JWT token is verified. + metadata: + owasp: + - A02:2017 - Broken Authentication + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe: + - 'CWE-287: Improper Authentication' + references: + - https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96 + category: security + technology: + - jwt + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode + shortlink: https://sg.run/6nyB + semgrep.dev: + rule: + r_id: 9559 + rv_id: 1263454 + rule_id: 10UKjo + version_id: 5PTo12w + url: https://semgrep.dev/playground/r/5PTo12w/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode + origin: community + fix: 'True + + ' + severity: ERROR + languages: + - python +- id: python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - pattern-either: + - patterns: + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "...", ...) + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["...",...], ...) + - pattern: $LOOP.subprocess_exec(...) + - patterns: + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c",...) + - patterns: + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...], ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", ...], ...) + message: Detected subprocess function '$LOOP.subprocess_exec' with user controlled data. You may consider using 'shlex.escape()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args + shortlink: https://sg.run/Apjp + semgrep.dev: + rule: + r_id: 27250 + rv_id: 1263460 + rule_id: 7KUE1E + version_id: WrTqKXz + url: https://semgrep.dev/playground/r/WrTqKXz/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: $LOOP.subprocess_shell($PROTOCOL, $CMD) + - pattern-inside: asyncio.subprocess.create_subprocess_shell($CMD, ...) + - pattern-inside: asyncio.create_subprocess_shell($CMD, ...) + - focus-metavariable: $CMD + - pattern-not-inside: '$CMD = "..." + + ... + + ' + - pattern-not: $LOOP.subprocess_shell($PROTOCOL, "...") + - pattern-not: asyncio.subprocess.create_subprocess_shell("...", ...) + - pattern-not: asyncio.create_subprocess_shell("...", ...) + message: Detected asyncio subprocess function with user controlled data. You may consider using 'shlex.escape()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://docs.python.org/3/library/asyncio-subprocess.html + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + shortlink: https://sg.run/Dx8Y + semgrep.dev: + rule: + r_id: 27252 + rv_id: 1263462 + rule_id: 8GU5q3 + version_id: K3TKkDn + url: https://semgrep.dev/playground/r/K3TKkDn/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$X = code.InteractiveConsole(...) + + ... + + ' + - pattern-inside: '$X = code.InteractiveInterpreter(...) + + ... + + ' + - pattern-either: + - pattern-inside: '$X.push($PAYLOAD,...) + + ' + - pattern-inside: '$X.runsource($PAYLOAD,...) + + ' + - pattern-inside: '$X.runcode(code.compile_command($PAYLOAD),...) + + ' + - pattern-inside: '$PL = code.compile_command($PAYLOAD,...) + + ... + + $X.runcode($PL,...) + + ' + - pattern: $PAYLOAD + - pattern-not: '$X.push("...",...) + + ' + - pattern-not: '$X.runsource("...",...) + + ' + - pattern-not: '$X.runcode(code.compile_command("..."),...) + + ' + - pattern-not: '$PL = code.compile_command("...",...) + + ... + + $X.runcode($PL,...) + + ' + message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external + data can reach this function call because it allows a malicious actor to run arbitrary Python code. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args + shortlink: https://sg.run/0Bgv + semgrep.dev: + rule: + r_id: 27254 + rv_id: 1263464 + rule_id: QrUG72 + version_id: l4TJRK9 + url: https://semgrep.dev/playground/r/l4TJRK9/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: os.$METHOD("...", ...) + - pattern: os.$METHOD(...) + - metavariable-regex: + metavariable: $METHOD + regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe) + - patterns: + - pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...) + - pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (execv|execve|execvp|execvpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + - patterns: + - pattern-not: os.$METHOD("...", $PATH, "...", "...",...) + - pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (execl|execle|execlp|execlpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to + execute commands. + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + confidence: MEDIUM + category: security + technology: + - python + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + shortlink: https://sg.run/qL6z + semgrep.dev: + rule: + r_id: 27256 + rv_id: 1263466 + rule_id: 4bUEAY + version_id: 6xT29l6 + url: https://semgrep.dev/playground/r/6xT29l6/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: os.$METHOD($MODE, "...", ...) + - pattern-inside: os.$METHOD($MODE, $CMD, ...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) + - patterns: + - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...) + - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + - patterns: + - pattern-not: os.$METHOD($MODE, "...", "...", "...", ...) + - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (spawnl|spawnle|spawnlp|spawnlpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to + execute commands. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args + shortlink: https://sg.run/Y3Ke + semgrep.dev: + rule: + r_id: 27258 + rv_id: 1263468 + rule_id: JDUz34 + version_id: zyTb2wn + url: https://semgrep.dev/playground/r/zyTb2wn/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-inside: '_xxsubinterpreters.run_string($ID, $PAYLOAD, ...) + + ' + - pattern-not: '_xxsubinterpreters.run_string($ID, "...", ...) + + ' + - pattern: $PAYLOAD + message: Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary + Python code. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://bugs.python.org/issue43472 + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args + shortlink: https://sg.run/oLl9 + semgrep.dev: + rule: + r_id: 27260 + rv_id: 1409404 + rule_id: GdUkxO + version_id: DkTwBzO + url: https://semgrep.dev/playground/r/DkTwBzO/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sanitizers: + - pattern: shlex.quote(...) + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: subprocess.$FUNC("...", ...) + - pattern-not: subprocess.$FUNC(["...",...], ...) + - pattern-not: subprocess.$FUNC(("...",...), ...) + - pattern-not: subprocess.CalledProcessError(...) + - pattern-not: subprocess.SubprocessError(...) + - pattern: subprocess.$FUNC($CMD, ...) + - patterns: + - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...) + - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD) + - patterns: + - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...) + - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...) + - pattern-either: + - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD], ...) + - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD), ...) + - patterns: + - pattern-not: subprocess.$FUNC("=~/(python)/","...",...) + - pattern: subprocess.$FUNC("=~/(python)/", $CMD) + - patterns: + - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...) + - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...) + - pattern-either: + - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...) + - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...) + - focus-metavariable: $CMD + message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform + command injection. You may consider using 'shlex.quote()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess + - https://docs.python.org/3/library/subprocess.html + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + shortlink: https://sg.run/pLGg + semgrep.dev: + rule: + r_id: 27262 + rv_id: 1263472 + rule_id: AbUgrZ + version_id: jQTn54Y + url: https://semgrep.dev/playground/r/jQTn54Y/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-not: os.$W("...", ...) + - pattern-either: + - pattern: os.system(...) + - pattern: '$X = __import__("os") + + ... + + $X.system(...) + + ' + - pattern: '$X = __import__("os") + + ... + + getattr($X, "system")(...) + + ' + - pattern: '$X = getattr(os, "system") + + ... + + $X(...) + + ' + - pattern: '$X = __import__("os") + + ... + + $Y = getattr($X, "system") + + ... + + $Y(...) + + ' + - pattern: os.popen(...) + - pattern: os.popen2(...) + - pattern: os.popen3(...) + - pattern: os.popen4(...) + message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the + 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.2.4 Dyanmic Code Execution Features + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + version: '4' + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args + shortlink: https://sg.run/XR2K + semgrep.dev: + rule: + r_id: 27264 + rv_id: 1263474 + rule_id: DbUR9g + version_id: 9lT4bG4 + url: https://semgrep.dev/playground/r/9lT4bG4/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '_testcapi.run_in_subinterp($PAYLOAD, ...) + + ' + - pattern-inside: 'test.support.run_in_subinterp($PAYLOAD, ...) + + ' + - pattern: $PAYLOAD + - pattern-not: '_testcapi.run_in_subinterp("...", ...) + + ' + - pattern-not: 'test.support.run_in_subinterp("...", ...) + + ' + message: Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run + arbitrary Python code. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args + shortlink: https://sg.run/1DLw + semgrep.dev: + rule: + r_id: 27266 + rv_id: 1263476 + rule_id: 0oUK7N + version_id: rxTAKpn + url: https://semgrep.dev/playground/r/rxTAKpn/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions + languages: + - python + severity: WARNING + metadata: + category: security + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-276: Incorrect Default Permissions' + technology: + - python + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions + shortlink: https://sg.run/AXY4 + semgrep.dev: + rule: + r_id: 13594 + rv_id: 1263482 + rule_id: zdUYqR + version_id: O9Tpxqr + url: https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions + origin: community + message: These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default + is `0o644` which gives read and write access to yourself and read access to everyone else. + patterns: + - pattern-inside: os.$METHOD(...) + - metavariable-pattern: + metavariable: $METHOD + patterns: + - pattern-either: + - pattern: chmod + - pattern: lchmod + - pattern: fchmod + - pattern-either: + - patterns: + - pattern: os.$METHOD($FILE, $BITS, ...) + - metavariable-comparison: + metavariable: $BITS + comparison: $BITS >= 0o650 and $BITS < 0o100000 + - patterns: + - pattern: os.$METHOD($FILE, $BITS) + - metavariable-comparison: + metavariable: $BITS + comparison: $BITS >= 0o100650 + - patterns: + - pattern: os.$METHOD($FILE, $BITS, ...) + - metavariable-pattern: + metavariable: $BITS + patterns: + - pattern-either: + - pattern: <... stat.S_IWGRP ...> + - pattern: <... stat.S_IXGRP ...> + - pattern: <... stat.S_IWOTH ...> + - pattern: <... stat.S_IXOTH ...> + - pattern: <... stat.S_IRWXO ...> + - pattern: <... stat.S_IRWXG ...> + - patterns: + - pattern: os.$METHOD($FILE, $EXPR | $MOD, ...) + - metavariable-comparison: + metavariable: $MOD + comparison: $MOD == 0o111 +- id: python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + options: + symbolic_propagation: true + mode: taint + pattern-sources: + - patterns: + - pattern: '"$URL" + + ' + - metavariable-pattern: + metavariable: $URL + language: regex + patterns: + - pattern-regex: http:// + - pattern-not-regex: .*://localhost + - pattern-not-regex: .*://127\.0\.0\.1 + pattern-sinks: + - patterns: + - pattern-inside: "with requests.Session(...) as $SESSION:\n ...\n" + - pattern-either: + - pattern: $SESSION.$W($SINK, ...) + - pattern: $SESSION.request($METHOD, $SINK, ...) + - focus-metavariable: $SINK + fix-regex: + regex: '[Hh][Tt][Tt][Pp]://' + replacement: https:// + count: 1 + message: Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead. + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + asvs: + section: V9 Communications Verification Requirements + control_id: 9.2.1 Weak TLS + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements + version: '4' + category: security + technology: + - requests + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + shortlink: https://sg.run/Bk5W + semgrep.dev: + rule: + r_id: 9651 + rv_id: 1263484 + rule_id: lBU9BZ + version_id: vdT06wb + url: https://semgrep.dev/playground/r/vdT06wb/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + origin: community + languages: + - python + severity: INFO +- id: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http + options: + symbolic_propagation: true + mode: taint + pattern-sources: + - patterns: + - pattern: '"$URL" + + ' + - metavariable-pattern: + metavariable: $URL + language: regex + patterns: + - pattern-regex: http:// + - pattern-not-regex: .*://localhost + - pattern-not-regex: .*://127\.0\.0\.1 + pattern-sinks: + - patterns: + - pattern-either: + - pattern: requests.Session(...).$W($SINK, ...) + - pattern: requests.Session(...).request($METHOD, $SINK, ...) + - focus-metavariable: $SINK + fix-regex: + regex: '[Hh][Tt][Tt][Pp]://' + replacement: https:// + count: 1 + message: Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead. + languages: + - python + severity: INFO + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + asvs: + section: V9 Communications Verification Requirements + control_id: 9.1.1 Weak TLS + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements + version: '4' + category: security + technology: + - requests + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http + shortlink: https://sg.run/DoBY + semgrep.dev: + rule: + r_id: 9652 + rv_id: 1263485 + rule_id: YGURXw + version_id: d6Tyx02 + url: https://semgrep.dev/playground/r/d6Tyx02/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http + origin: community +- id: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http + fix-regex: + regex: '[Hh][Tt][Tt][Pp]://' + replacement: https:// + count: 1 + message: Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on + the network and be able to obtain sensitive information. Use 'https://' instead. + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + asvs: + section: V9 Communications Verification Requirements + control_id: 9.1.1 Weak TLS + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements + version: '4' + category: security + technology: + - requests + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http + shortlink: https://sg.run/W8J4 + semgrep.dev: + rule: + r_id: 9653 + rv_id: 1263486 + rule_id: 6JUjpG + version_id: ZRTKA9v + url: https://semgrep.dev/playground/r/ZRTKA9v/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http + origin: community + languages: + - python + severity: INFO + options: + symbolic_propagation: true + mode: taint + pattern-sources: + - patterns: + - pattern: '"$URL" + + ' + - metavariable-pattern: + metavariable: $URL + language: regex + patterns: + - pattern-regex: http:// + - pattern-not-regex: .*://localhost + - pattern-not-regex: .*://127\.0\.0\.1 + pattern-sinks: + - patterns: + - pattern-either: + - pattern: requests.$W($SINK, ...) + - pattern: requests.request($METHOD, $SINK, ...) + - pattern: requests.Request($METHOD, $SINK, ...) + - focus-metavariable: $SINK +- id: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure + patterns: + - pattern: '$LOGGER_OBJ.$LOGGER_CALL($FORMAT_STRING,...) + + ' + - metavariable-regex: + metavariable: $LOGGER_OBJ + regex: (?i)(_logger|logger|self.logger|log) + - metavariable-regex: + metavariable: $LOGGER_CALL + regex: (debug|info|warn|warning|error|exception|critical) + - metavariable-regex: + metavariable: $FORMAT_STRING + regex: (?i).*(api.key|secret|credential|token|password).*\%s.* + message: Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret + credentials being exposed. Make sure that the logger is not logging sensitive information. + severity: WARNING + languages: + - python + metadata: + cwe: + - 'CWE-532: Insertion of Sensitive Information into Log File' + category: security + technology: + - python + owasp: + - A09:2021 - Security Logging and Monitoring Failures + - A09:2025 - Security Logging & Alerting Failures + references: + - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure + shortlink: https://sg.run/ydNx + semgrep.dev: + rule: + r_id: 9668 + rv_id: 1263501 + rule_id: x8UnJk + version_id: A8TgdOR + url: https://semgrep.dev/playground/r/A8TgdOR/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure + origin: community +- id: python.lang.security.audit.md5-used-as-password.md5-used-as-password + severity: WARNING + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked + by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`. + languages: + - python + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://tools.ietf.org/html/rfc6151 + - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords + - https://github.com/returntocorp/semgrep-rules/issues/1609 + - https://docs.python.org/3/library/hashlib.html#hashlib.scrypt + category: security + technology: + - pycryptodome + - hashlib + - md5 + subcategory: + - vuln + likelihood: HIGH + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password + shortlink: https://sg.run/5DwD + semgrep.dev: + rule: + r_id: 14703 + rv_id: 1263504 + rule_id: 6JU1w1 + version_id: WrTqKDz + url: https://semgrep.dev/playground/r/WrTqKDz/python.lang.security.audit.md5-used-as-password.md5-used-as-password + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: hashlib.md5 + - pattern: hashlib.new(..., name="MD5", ...) + - pattern: Cryptodome.Hash.MD5 + - pattern: Crypto.Hash.MD5 + - pattern: cryptography.hazmat.primitives.hashes.MD5 + pattern-sinks: + - patterns: + - pattern: $FUNCTION(...) + - metavariable-regex: + metavariable: $FUNCTION + regex: (?i)(.*password.*) +- id: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces + message: Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to + all available interfaces. Consider instead getting correct address from an environment variable or configuration file. + metadata: + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - python + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces + shortlink: https://sg.run/rdln + semgrep.dev: + rule: + r_id: 9669 + rv_id: 1263505 + rule_id: OrU3og + version_id: 0bTKzDL + url: https://semgrep.dev/playground/r/0bTKzDL/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces + origin: community + languages: + - python + severity: INFO + pattern-either: + - pattern: '$S = socket.socket(...) + + ... + + $S.bind(("0.0.0.0", ...)) + + ' + - pattern: '$S = socket.socket(...) + + ... + + $S.bind(("::", ...)) + + ' + - pattern: '$S = socket.socket(...) + + ... + + $S.bind(("", ...)) + + ' +- id: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation + patterns: + - pattern-either: + - pattern: urllib3.PoolManager(..., cert_reqs=$REQS, ...) + - pattern: urllib3.ProxyManager(..., cert_reqs=$REQS, ...) + - pattern: urllib3.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) + - pattern: urllib3.connectionpool.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) + - pattern: urllib3.connection_from_url(..., cert_reqs=$REQS, ...) + - pattern: urllib3.proxy_from_url(..., cert_reqs=$REQS, ...) + - pattern: $CONTEXT.wrap_socket(..., cert_reqs=$REQS, ...) + - pattern: ssl.wrap_socket(..., cert_reqs=$REQS, ...) + - metavariable-regex: + metavariable: $REQS + regex: (NONE|CERT_NONE|CERT_OPTIONAL|ssl\.CERT_NONE|ssl\.CERT_OPTIONAL|\'NONE\'|\"NONE\"|\'OPTIONAL\'|\"OPTIONAL\") + message: certificate verification explicitly disabled, insecure connections possible + metadata: + cwe: + - 'CWE-295: Improper Certificate Validation' + owasp: + - A03:2017 - Sensitive Data Exposure + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + category: security + technology: + - python + references: + - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation + shortlink: https://sg.run/b7yp + semgrep.dev: + rule: + r_id: 9670 + rv_id: 1263506 + rule_id: eqU87k + version_id: K3TKkZn + url: https://semgrep.dev/playground/r/K3TKkZn/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection + message: Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool + instead for to encrypt communications. + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool + category: security + technology: + - python + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection + shortlink: https://sg.run/N4Np + semgrep.dev: + rule: + r_id: 9671 + rv_id: 1263507 + rule_id: v8UnWQ + version_id: qkTR7E1 + url: https://semgrep.dev/playground/r/qkTR7E1/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection + origin: community + languages: + - python + severity: ERROR + pattern-either: + - pattern: urllib3.HTTPConnectionPool(...) + - pattern: urllib3.connectionpool.HTTPConnectionPool(...) +- id: python.lang.security.audit.sha224-hash.sha224-hash + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating + to a stronger hash function such as SHA-384 or higher to ensure compliance and security. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf + - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography + category: security + technology: + - python + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.audit.sha224-hash.sha224-hash + shortlink: https://sg.run/Db1Yv + semgrep.dev: + rule: + r_id: 151752 + rv_id: 1263511 + rule_id: BYUX0y9 + version_id: 5PTo1QL + url: https://semgrep.dev/playground/r/5PTo1QL/python.lang.security.audit.sha224-hash.sha224-hash + origin: community + severity: WARNING + languages: + - python + pattern-either: + - pattern: hashlib.sha224(...) + - pattern: hashlib.sha3_224(...) +- id: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated + pattern: ssl.wrap_socket(...) + message: '''ssl.wrap_socket()'' is deprecated. This function creates an insecure socket without server name indication or + hostname matching. Instead, create an SSL context using ''ssl.SSLContext()'' and use that to wrap a socket.' + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://docs.python.org/3/library/ssl.html#ssl.wrap_socket + - https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket + category: security + technology: + - python + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated + shortlink: https://sg.run/PJOY + semgrep.dev: + rule: + r_id: 9645 + rv_id: 1263516 + rule_id: BYUN2e + version_id: DkTRbgn + url: https://semgrep.dev/playground/r/DkTRbgn/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated + origin: community + languages: + - python + severity: WARNING +- id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true + patterns: + - pattern: subprocess.$FUNC(..., shell=$TRUE, ...) + - metavariable-pattern: + metavariable: $TRUE + pattern: "True \n" + - pattern-not: subprocess.$FUNC("...", shell=True, ...) + - focus-metavariable: $TRUE + message: Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command + using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious + actor to execute commands. Use 'shell=False' instead. + fix: 'False + + ' + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + references: + - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess + - https://docs.python.org/3/library/subprocess.html + category: security + technology: + - python + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - secure default + likelihood: HIGH + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true + shortlink: https://sg.run/J92w + semgrep.dev: + rule: + r_id: 9646 + rv_id: 1263518 + rule_id: DbUpz2 + version_id: 0bTKzDK + url: https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.weak-ssl-version.weak-ssl-version + message: An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption + and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/insecure_ssl_tls.py#L30 + asvs: + section: V9 Communications Verification Requirements + control_id: 9.1.3 Weak TLS + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements + version: '4' + references: + - https://tools.ietf.org/html/rfc7568 + - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html + - https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2 + category: security + technology: + - python + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version + shortlink: https://sg.run/RoZO + semgrep.dev: + rule: + r_id: 9649 + rv_id: 1263520 + rule_id: KxUbNG + version_id: qkTR7Ev + url: https://semgrep.dev/playground/r/qkTR7Ev/python.lang.security.audit.weak-ssl-version.weak-ssl-version + origin: community + languages: + - python + severity: WARNING + pattern-either: + - pattern: ssl.PROTOCOL_SSLv2 + - pattern: ssl.PROTOCOL_SSLv3 + - pattern: ssl.PROTOCOL_TLSv1 + - pattern: ssl.PROTOCOL_TLSv1_1 + - pattern: pyOpenSSL.SSL.SSLv2_METHOD + - pattern: pyOpenSSL.SSL.SSLv23_METHOD + - pattern: pyOpenSSL.SSL.SSLv3_METHOD + - pattern: pyOpenSSL.SSL.TLSv1_METHOD + - pattern: pyOpenSSL.SSL.TLSv1_1_METHOD +- id: python.lang.security.dangerous-code-run.dangerous-interactive-code-run + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$X = code.InteractiveConsole(...) + + ... + + ' + - pattern-inside: '$X = code.InteractiveInterpreter(...) + + ... + + ' + - pattern-either: + - pattern: '$X.push($PAYLOAD,...) + + ' + - pattern: '$X.runsource($PAYLOAD,...) + + ' + - pattern: '$X.runcode(code.compile_command($PAYLOAD),...) + + ' + - pattern: '$PL = code.compile_command($PAYLOAD,...) + + ... + + $X.runcode($PL,...) + + ' + - focus-metavariable: $PAYLOAD + - pattern-not: '$X.push("...",...) + + ' + - pattern-not: '$X.runsource("...",...) + + ' + - pattern-not: '$X.runcode(code.compile_command("..."),...) + + ' + - pattern-not: '$PL = code.compile_command("...",...) + + ... + + $X.runcode($PL,...) + + ' + message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external + data can reach this function call because it allows a malicious actor to run arbitrary Python code. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run + shortlink: https://sg.run/9pRY + semgrep.dev: + rule: + r_id: 27267 + rv_id: 1263521 + rule_id: KxUKzx + version_id: l4TJRgo + url: https://semgrep.dev/playground/r/l4TJRgo/python.lang.security.dangerous-code-run.dangerous-interactive-code-run + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.dangerous-os-exec.dangerous-os-exec + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: os.$METHOD("...", ...) + - pattern: os.$METHOD(...) + - metavariable-regex: + metavariable: $METHOD + regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe) + - patterns: + - pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...) + - pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (execv|execve|execvp|execvpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + - patterns: + - pattern-not: os.$METHOD("...", $PATH, "...", "...",...) + - pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (execl|execle|execlp|execlpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to + execute commands. + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + confidence: MEDIUM + category: security + technology: + - python + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec + shortlink: https://sg.run/yL9x + semgrep.dev: + rule: + r_id: 27268 + rv_id: 1263523 + rule_id: qNUR13 + version_id: 6xT29rz + url: https://semgrep.dev/playground/r/6xT29rz/python.lang.security.dangerous-os-exec.dangerous-os-exec + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.dangerous-spawn-process.dangerous-spawn-process + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - pattern: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + - patterns: + - pattern-either: + - pattern: os.environ['$ANYTHING'] + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb['$ANYTHING'] + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv[...] + - pattern: sys.orig_argv[...] + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: os.$METHOD($MODE, "...", ...) + - pattern-inside: os.$METHOD($MODE, $CMD, ...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) + - patterns: + - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...) + - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + - patterns: + - pattern-not: os.$METHOD($MODE, "...", "...", "...", ...) + - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (spawnl|spawnle|spawnlp|spawnlpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to + execute commands. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process + shortlink: https://sg.run/r8Zn + semgrep.dev: + rule: + r_id: 27269 + rv_id: 1263524 + rule_id: lBUJrn + version_id: o5TbDO5 + url: https://semgrep.dev/playground/r/o5TbDO5/python.lang.security.dangerous-spawn-process.dangerous-spawn-process + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern: '_xxsubinterpreters.run_string($ID, $PAYLOAD, ...) + + ' + - pattern-not: '_xxsubinterpreters.run_string($ID, "...", ...) + + ' + - focus-metavariable: $PAYLOAD + message: Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary + Python code. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://bugs.python.org/issue43472 + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + shortlink: https://sg.run/bPop + semgrep.dev: + rule: + r_id: 27270 + rv_id: 1263525 + rule_id: PeURWr + version_id: zyTb2OX + url: https://semgrep.dev/playground/r/zyTb2OX/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: subprocess.$FUNC("...", ...) + - pattern-not: subprocess.$FUNC(["...",...], ...) + - pattern-not: subprocess.$FUNC(("...",...), ...) + - pattern-not: subprocess.CalledProcessError(...) + - pattern-not: subprocess.SubprocessError(...) + - pattern: subprocess.$FUNC($CMD, ...) + - patterns: + - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...) + - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD) + - patterns: + - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...) + - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...) + - pattern-either: + - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD], ...) + - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD), ...) + - patterns: + - pattern-not: subprocess.$FUNC("=~/(python)/","...",...) + - pattern: subprocess.$FUNC("=~/(python)/", $CMD) + - patterns: + - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...) + - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...) + - pattern-either: + - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...) + - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...) + - focus-metavariable: $CMD + message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform + command injection. You may consider using 'shlex.escape()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess + - https://docs.python.org/3/library/subprocess.html + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + shortlink: https://sg.run/NWxp + semgrep.dev: + rule: + r_id: 27271 + rv_id: 1263526 + rule_id: JDUz3R + version_id: pZT038J + url: https://semgrep.dev/playground/r/pZT038J/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.dangerous-system-call.dangerous-system-call + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-not: os.$W("...", ...) + - pattern-either: + - pattern: os.system(...) + - pattern: getattr(os, "system")(...) + - pattern: __import__("os").system(...) + - pattern: getattr(__import__("os"), "system")(...) + - pattern: '$X = __import__("os") + + ... + + $X.system(...) + + ' + - pattern: '$X = __import__("os") + + ... + + getattr($X, "system")(...) + + ' + - pattern: '$X = getattr(os, "system") + + ... + + $X(...) + + ' + - pattern: '$X = __import__("os") + + ... + + $Y = getattr($X, "system") + + ... + + $Y(...) + + ' + - pattern: os.popen(...) + - pattern: os.popen2(...) + - pattern: os.popen3(...) + - pattern: os.popen4(...) + message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the + 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.2.4 Dyanmic Code Execution Features + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + version: '4' + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call + shortlink: https://sg.run/k0W7 + semgrep.dev: + rule: + r_id: 27272 + rv_id: 1263527 + rule_id: 5rUoP1 + version_id: 2KTv2Zn + url: https://semgrep.dev/playground/r/2KTv2Zn/python.lang.security.dangerous-system-call.dangerous-system-call + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '_testcapi.run_in_subinterp($PAYLOAD, ...) + + ' + - pattern: 'test.support.run_in_subinterp($PAYLOAD, ...) + + ' + - focus-metavariable: $PAYLOAD + - pattern-not: '_testcapi.run_in_subinterp("...", ...) + + ' + - pattern-not: 'test.support.run_in_subinterp("...", ...) + + ' + message: Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run + arbitrary Python code. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + shortlink: https://sg.run/wLpY + semgrep.dev: + rule: + r_id: 27273 + rv_id: 1263528 + rule_id: GdUkxR + version_id: X0Tzy1e + url: https://semgrep.dev/playground/r/X0Tzy1e/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + references: + - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation + - https://nvd.nist.gov/vuln/detail/CVE-2017-18342 + category: security + technology: + - pyyaml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load + shortlink: https://sg.run/we9Y + semgrep.dev: + rule: + r_id: 9673 + rv_id: 1263530 + rule_id: ZqU5jZ + version_id: 1QTyprw + url: https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load + origin: community + languages: + - python + message: Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and + `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input + could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to + steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` + instead. + fix-regex: + regex: unsafe_load + replacement: safe_load + count: 1 + severity: ERROR + patterns: + - pattern-inside: 'import yaml + + ... + + ' + - pattern-not-inside: '$YAML = ruamel.yaml.YAML(...) + + ... + + ' + - pattern-either: + - pattern: yaml.unsafe_load(...) + - pattern: yaml.load(..., Loader=yaml.Loader, ...) + - pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...) + - pattern: yaml.load(..., Loader=yaml.CLoader, ...) + - pattern: yaml.load_all(..., Loader=yaml.Loader, ...) + - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...) + - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...) +- id: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + references: + - https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ + category: security + technology: + - ruamel.yaml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel + shortlink: https://sg.run/x1rz + semgrep.dev: + rule: + r_id: 9674 + rv_id: 1263531 + rule_id: nJUzqK + version_id: 9lT4bvG + url: https://semgrep.dev/playground/r/9lT4bvG/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel + origin: community + languages: + - python + message: Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor + could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead. + severity: ERROR + pattern-either: + - pattern: ruamel.yaml.YAML(..., typ='unsafe', ...) + - pattern: ruamel.yaml.YAML(..., typ='base', ...) +- id: python.lang.security.deserialization.pickle.avoid-shelve + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + references: + - https://docs.python.org/3/library/pickle.html + category: security + technology: + - python + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve + shortlink: https://sg.run/dKkZ + semgrep.dev: + rule: + r_id: 9678 + rv_id: 1263535 + rule_id: 8GUje2 + version_id: NdTzyb4 + url: https://semgrep.dev/playground/r/NdTzyb4/python.lang.security.deserialization.pickle.avoid-shelve + origin: community + languages: + - python + message: Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, + the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON + or a similar text-based serialization format. + severity: WARNING + pattern: shelve.$FUNC(...) +- id: python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + patterns: + - pattern: hashlib.md5(...) + - pattern-not: hashlib.md5(..., usedforsecurity=False, ...) + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use SHA256 or SHA3 instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B303 + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.2 Insecure Custom Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + references: + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - python + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + shortlink: https://sg.run/vYrY + semgrep.dev: + rule: + r_id: 33633 + rv_id: 1263536 + rule_id: PeU2e2 + version_id: kbTzGE1 + url: https://semgrep.dev/playground/r/kbTzGE1/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + pattern: hashlib.sha1(...) + fix-regex: + regex: sha1 + replacement: sha256 + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B303 + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.2 Insecure Custom Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + references: + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - python + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + shortlink: https://sg.run/ydYx + semgrep.dev: + rule: + r_id: 9624 + rv_id: 1263537 + rule_id: x8UnBk + version_id: w8TRoE7 + url: https://semgrep.dev/playground/r/w8TRoE7/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.insecure-hash-function.insecure-hash-function + message: Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered + deprecated. Consider using 'SHA256' or a similar function instead. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/hashlib_new_insecure_functions.py + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.2 Insecure Custom Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + references: + - https://tools.ietf.org/html/rfc6151 + - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - python + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function + shortlink: https://sg.run/rdBn + semgrep.dev: + rule: + r_id: 9625 + rv_id: 1501841 + rule_id: OrU30g + version_id: xyT0gk7 + url: https://semgrep.dev/playground/r/xyT0gk7/python.lang.security.insecure-hash-function.insecure-hash-function + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-either: + - pattern: hashlib.new("=~/[M|m][D|d][4|5]/", ...) + - pattern: hashlib.new(..., name="=~/[M|m][D|d][4|5]/", ...) + - pattern-not: hashlib.new(..., usedforsecurity=False, ...) +- id: python.lang.security.insecure-uuid-version.insecure-uuid-version + patterns: + - pattern: uuid.uuid1(...) + message: Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, + timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better + randomness and security. + metadata: + references: + - https://www.landh.tech/blog/20230811-sandwich-attack/ + cwe: + - 'CWE-330: Use of Insufficiently Random Values' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.3.2 Insecure UUID Generation + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v63-random-values + version: '4' + category: security + technology: + - python + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version + shortlink: https://sg.run/BYBgW + semgrep.dev: + rule: + r_id: 148295 + rv_id: 1263539 + rule_id: kxUd1yD + version_id: O9Tpx97 + url: https://semgrep.dev/playground/r/O9Tpx97/python.lang.security.insecure-uuid-version.insecure-uuid-version + origin: community + languages: + - python + severity: WARNING + fix-regex: + regex: uuid1 + replacement: uuid4 +- id: python.lang.security.unverified-ssl-context.unverified-ssl-context + patterns: + - pattern-either: + - pattern: ssl._create_unverified_context(...) + - pattern: ssl._create_default_https_context = ssl._create_unverified_context + fix-regex: + regex: _create_unverified_context + replacement: create_default_context + message: Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use + 'ssl.create_default_context' instead. + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe: + - 'CWE-295: Improper Certificate Validation' + references: + - https://docs.python.org/3/library/ssl.html#ssl-security + - https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection + category: security + technology: + - python + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context + shortlink: https://sg.run/N4lp + semgrep.dev: + rule: + r_id: 9627 + rv_id: 1263540 + rule_id: v8UnkQ + version_id: e1Tyjlj + url: https://semgrep.dev/playground/r/e1Tyjlj/python.lang.security.unverified-ssl-context.unverified-ssl-context + origin: community + severity: ERROR + languages: + - python +- id: python.lang.security.use-defused-xml-parse.use-defused-xml-parse + metadata: + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + references: + - https://docs.python.org/3/library/xml.html + - https://github.com/tiran/defusedxml + - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing + category: security + technology: + - python + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse + shortlink: https://sg.run/n3jG + semgrep.dev: + rule: + r_id: 72436 + rv_id: 1263541 + rule_id: X5Uqnx + version_id: vdT06ER + url: https://semgrep.dev/playground/r/vdT06ER/python.lang.security.use-defused-xml-parse.use-defused-xml-parse + origin: community + message: The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential + data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python + documentation recommends using `defusedxml`. + languages: + - python + severity: ERROR + patterns: + - pattern: xml.etree.ElementTree.parse($...ARGS) + - pattern-not: xml.etree.ElementTree.parse("...") + fix: defusedxml.etree.ElementTree.parse($...ARGS) +- id: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish + message: Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure + and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such + as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, + such as GCM. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption + - https://www.pycryptodome.org/src/cipher/cipher + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish + shortlink: https://sg.run/dlOE + semgrep.dev: + rule: + r_id: 33634 + rv_id: 1263545 + rule_id: JDUGnK + version_id: ExTExln + url: https://semgrep.dev/playground/r/ExTExln/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish + origin: community + options: + symbolic_propagation: true + severity: WARNING + languages: + - python + pattern-either: + - pattern: Cryptodome.Cipher.Blowfish.new(...) + - pattern: Crypto.Cipher.Blowfish.new(...) +- id: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des + message: Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically + secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream + ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using + a block cipher, use a modern mode of operation that also provides authentication, such as GCM. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://cwe.mitre.org/data/definitions/326.html + - https://www.pycryptodome.org/src/cipher/cipher + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des + shortlink: https://sg.run/Z5bw + semgrep.dev: + rule: + r_id: 33635 + rv_id: 1263546 + rule_id: 5rUr73 + version_id: 7ZTE3G7 + url: https://semgrep.dev/playground/r/7ZTE3G7/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des + origin: community + options: + symbolic_propagation: true + severity: WARNING + languages: + - python + pattern-either: + - pattern: Cryptodome.Cipher.DES.new(...) + - pattern: Crypto.Cipher.DES.new(...) + - pattern: Cryptodome.Cipher.DES3.new(...) + - pattern: Crypto.Cipher.DES3.new(...) +- id: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 + message: Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and + can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES + with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, + such as GCM. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://cwe.mitre.org/data/definitions/326.html + - https://www.pycryptodome.org/src/cipher/cipher + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 + shortlink: https://sg.run/nAbY + semgrep.dev: + rule: + r_id: 33636 + rv_id: 1263547 + rule_id: GdUYlW + version_id: LjTkgn6 + url: https://semgrep.dev/playground/r/LjTkgn6/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 + origin: community + options: + symbolic_propagation: true + severity: WARNING + languages: + - python + pattern-either: + - pattern: Cryptodome.Cipher.ARC2.new(...) + - pattern: Crypto.Cipher.ARC2.new(...) +- id: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 + message: Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and + can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES + with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, + such as GCM. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://cwe.mitre.org/data/definitions/326.html + - https://www.pycryptodome.org/src/cipher/cipher + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 + shortlink: https://sg.run/Eo6N + semgrep.dev: + rule: + r_id: 33637 + rv_id: 1263548 + rule_id: ReUnEB + version_id: 8KT5rXY + url: https://semgrep.dev/playground/r/8KT5rXY/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 + origin: community + severity: WARNING + languages: + - python + pattern-either: + - pattern: Cryptodome.Cipher.ARC4.new(...) + - pattern: Crypto.Cipher.ARC4.new(...) +- id: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor + message: Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and + can be reversed easily. Use AES instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor + shortlink: https://sg.run/L0yr + semgrep.dev: + rule: + r_id: 9683 + rv_id: 1263549 + rule_id: PeUk5W + version_id: gETB7j3 + url: https://semgrep.dev/playground/r/gETB7j3/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor + origin: community + severity: WARNING + languages: + - python + pattern-either: + - pattern: Cryptodome.Cipher.XOR.new(...) + - pattern: Crypto.Cipher.XOR.new(...) +- id: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 + message: Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::hash-algorithm::pycryptodome + - crypto::search::hash-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 + shortlink: https://sg.run/7JP2 + semgrep.dev: + rule: + r_id: 33638 + rv_id: 1263550 + rule_id: AbU0Ex + version_id: QkTGqD8 + url: https://semgrep.dev/playground/r/QkTGqD8/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 + origin: community + options: + symbolic_propagation: true + severity: WARNING + languages: + - python + pattern-either: + - pattern: Crypto.Hash.MD2.new(...) + - pattern: Cryptodome.Hash.MD2.new (...) +- id: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 + message: Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::hash-algorithm::pycryptodome + - crypto::search::hash-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 + shortlink: https://sg.run/Lve6 + semgrep.dev: + rule: + r_id: 33639 + rv_id: 1263551 + rule_id: BYUJy4 + version_id: 3ZT4Xnp + url: https://semgrep.dev/playground/r/3ZT4Xnp/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 + origin: community + options: + symbolic_propagation: true + severity: WARNING + languages: + - python + pattern-either: + - pattern: Crypto.Hash.MD4.new(...) + - pattern: Cryptodome.Hash.MD4.new (...) +- id: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::hash-algorithm::pycryptodome + - crypto::search::hash-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 + shortlink: https://sg.run/85JN + semgrep.dev: + rule: + r_id: 33640 + rv_id: 1263552 + rule_id: DbUXwo + version_id: 44TEjpk + url: https://semgrep.dev/playground/r/44TEjpk/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 + origin: community + options: + symbolic_propagation: true + severity: WARNING + languages: + - python + pattern-either: + - pattern: Crypto.Hash.MD5.new(...) + - pattern: Cryptodome.Hash.MD5.new (...) +- id: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 + shortlink: https://sg.run/3ALr + semgrep.dev: + rule: + r_id: 9687 + rv_id: 1263553 + rule_id: ReUPO3 + version_id: PkTR3vk + url: https://semgrep.dev/playground/r/PkTR3vk/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 + origin: community + severity: WARNING + languages: + - python + pattern-either: + - pattern: Crypto.Hash.SHA.new(...) + - pattern: Cryptodome.Hash.SHA.new (...) +- id: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size + message: Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + references: + - https://www.pycryptodome.org/src/public_key/dsa + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::key-length::pycryptodome + - crypto::search::key-length::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size + shortlink: https://sg.run/4y8l + semgrep.dev: + rule: + r_id: 9688 + rv_id: 1263554 + rule_id: AbUWje + version_id: JdTzxbQ + url: https://semgrep.dev/playground/r/JdTzxbQ/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size + origin: community + options: + symbolic_propagation: true + languages: + - python + severity: WARNING + patterns: + - pattern-either: + - pattern: Crypto.PublicKey.DSA.generate(..., bits=$SIZE, ...) + - pattern: Crypto.PublicKey.DSA.generate($SIZE, ...) + - pattern: Cryptodome.PublicKey.DSA.generate(..., bits=$SIZE, ...) + - pattern: Cryptodome.PublicKey.DSA.generate($SIZE, ...) + - metavariable-comparison: + metavariable: $SIZE + comparison: $SIZE < 2048 +- id: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size + message: Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + references: + - https://www.pycryptodome.org/src/public_key/rsa#rsa + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::key-length::pycryptodome + - crypto::search::key-length::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size + shortlink: https://sg.run/PprY + semgrep.dev: + rule: + r_id: 9689 + rv_id: 1263555 + rule_id: BYUBWe + version_id: 5PTo1jL + url: https://semgrep.dev/playground/r/5PTo1jL/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size + origin: community + options: + symbolic_propagation: true + languages: + - python + severity: WARNING + patterns: + - pattern-either: + - pattern: Crypto.PublicKey.RSA.generate(..., bits=$SIZE, ...) + - pattern: Crypto.PublicKey.RSA.generate($SIZE, ...) + - pattern: Cryptodome.PublicKey.RSA.generate(..., bits=$SIZE, ...) + - pattern: Cryptodome.PublicKey.RSA.generate($SIZE, ...) + - metavariable-comparison: + metavariable: $SIZE + comparison: $SIZE < 3072 +- id: python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication + message: 'An encryption mode of operation is being used without proper message authentication. This can potentially result + in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ' + languages: + - python + severity: ERROR + metadata: + category: security + technology: + - cryptography + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication + shortlink: https://sg.run/k1K1 + semgrep.dev: + rule: + r_id: 31872 + rv_id: 1263556 + rule_id: YGUw8w + version_id: GxTkeyz + url: https://semgrep.dev/playground/r/GxTkeyz/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication + origin: community + patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: 'AES.new(..., $PYCRYPTODOME_MODE) + + ' + - pattern-not-inside: 'AES.new(..., $PYCRYPTODOME_MODE) + + ... + + HMAC.new + + ' + - metavariable-pattern: + metavariable: $PYCRYPTODOME_MODE + patterns: + - pattern-either: + - pattern: AES.MODE_CBC + - pattern: AES.MODE_CTR + - pattern: AES.MODE_CFB + - pattern: AES.MODE_OFB +- id: python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + patterns: + - pattern: pyramid.authentication.$FUNC($...PARAMS) + - metavariable-pattern: + metavariable: $FUNC + pattern-either: + - pattern: AuthTktCookieHelper + - pattern: AuthTktAuthenticationPolicy + - pattern-not: pyramid.authentication.$FUNC(..., httponly=$HTTPONLY, ...) + - pattern-not: pyramid.authentication.$FUNC(..., **$PARAMS, ...) + - focus-metavariable: $...PARAMS + fix: '$...PARAMS, httponly=True + + ' + message: Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should + be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected + and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + shortlink: https://sg.run/EprB + semgrep.dev: + rule: + r_id: 21437 + rv_id: 1263557 + rule_id: bwUXKB + version_id: RGT0L7K + url: https://semgrep.dev/playground/r/RGT0L7K/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value + patterns: + - pattern-either: + - patterns: + - pattern-not: pyramid.authentication.AuthTktCookieHelper(..., **$PARAMS) + - pattern: pyramid.authentication.AuthTktCookieHelper(..., httponly=$HTTPONLY, ...) + - patterns: + - pattern-not: pyramid.authentication.AuthTktAuthenticationPolicy(..., **$PARAMS) + - pattern: pyramid.authentication.AuthTktAuthenticationPolicy(..., httponly=$HTTPONLY, ...) + - pattern: $HTTPONLY + - metavariable-pattern: + metavariable: $HTTPONLY + pattern: 'False + + ' + fix: 'True + + ' + message: Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should + be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected + and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value + shortlink: https://sg.run/7DgQ + semgrep.dev: + rule: + r_id: 21438 + rv_id: 1263558 + rule_id: NbUq9e + version_id: A8Tgd8N + url: https://semgrep.dev/playground/r/A8Tgd8N/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite + patterns: + - pattern-either: + - pattern: pyramid.authentication.AuthTktCookieHelper(..., samesite=$SAMESITE, ...) + - pattern: pyramid.authentication.AuthTktAuthenticationPolicy(..., samesite=$SAMESITE, ...) + - pattern: $SAMESITE + - metavariable-regex: + metavariable: $SAMESITE + regex: (?!'Lax') + fix: '''Lax'' + + ' + message: Found a Pyramid Authentication Ticket without the samesite option correctly set. Pyramid cookies should be handled + securely by setting samesite='Lax'. If this parameter is not properly set, your cookies are not properly protected and + are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite + shortlink: https://sg.run/LYrY + semgrep.dev: + rule: + r_id: 21439 + rv_id: 1263559 + rule_id: kxUYjY + version_id: BjTkZ51 + url: https://semgrep.dev/playground/r/BjTkZ51/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default + patterns: + - pattern-either: + - patterns: + - pattern-not: pyramid.authentication.AuthTktCookieHelper(..., secure=$SECURE, ...) + - pattern-not: pyramid.authentication.AuthTktCookieHelper(..., **$PARAMS) + - pattern: pyramid.authentication.AuthTktCookieHelper(...) + - patterns: + - pattern-not: pyramid.authentication.AuthTktAuthenticationPolicy(..., secure=$SECURE, ...) + - pattern-not: pyramid.authentication.AuthTktAuthenticationPolicy(..., **$PARAMS) + - pattern: pyramid.authentication.AuthTktAuthenticationPolicy(...) + fix-regex: + regex: (.*)\) + replacement: \1, secure=True) + message: Found a Pyramid Authentication Ticket cookie using an unsafe default for the secure option. Pyramid cookies should + be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected + and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default + shortlink: https://sg.run/8WxQ + semgrep.dev: + rule: + r_id: 21440 + rv_id: 1263560 + rule_id: wdUKzn + version_id: DkTRbJn + url: https://semgrep.dev/playground/r/DkTRbJn/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value + patterns: + - pattern-either: + - patterns: + - pattern-not: pyramid.authentication.AuthTktCookieHelper(..., **$PARAMS) + - pattern: pyramid.authentication.AuthTktCookieHelper(..., secure=$SECURE, ...) + - patterns: + - pattern-not: pyramid.authentication.AuthTktAuthenticationPolicy(..., **$PARAMS) + - pattern: pyramid.authentication.AuthTktAuthenticationPolicy(..., secure=$SECURE, ...) + - pattern: $SECURE + - metavariable-pattern: + metavariable: $SECURE + pattern: 'False + + ' + fix: 'True + + ' + message: Found a Pyramid Authentication Ticket cookie without the secure option correctly set. Pyramid cookies should be + handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected + and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value + shortlink: https://sg.run/gjp5 + semgrep.dev: + rule: + r_id: 21441 + rv_id: 1263561 + rule_id: x8UqAp + version_id: WrTqK93 + url: https://semgrep.dev/playground/r/WrTqK93/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally + patterns: + - pattern-inside: '$CONFIG.set_default_csrf_options(..., check_origin=$CHECK_ORIGIN, ...) + + ' + - pattern: $CHECK_ORIGIN + - metavariable-comparison: + metavariable: $CHECK_ORIGIN + comparison: $CHECK_ORIGIN == False + message: Automatic check of the referrer for cross-site request forgery tokens has been explicitly disabled globally, which + might leave views unprotected when an unsafe CSRF storage policy is used. Use 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)' + to turn the automatic check for all unsafe methods (per RFC2616). + languages: + - python + severity: ERROR + fix: 'True + + ' + metadata: + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally + shortlink: https://sg.run/3GeW + semgrep.dev: + rule: + r_id: 21443 + rv_id: 1263563 + rule_id: eqU9Le + version_id: K3TKkeo + url: https://semgrep.dev/playground/r/K3TKkeo/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally + origin: community +- id: python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled + message: Origin check for the CSRF token is disabled for this view. This might represent a security risk if the CSRF storage + policy is not known to be secure. + metadata: + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + asvs: + section: V4 Access Control + control_id: 4.2.2 CSRF + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control + version: '4' + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled + shortlink: https://sg.run/4RB9 + semgrep.dev: + rule: + r_id: 21444 + rv_id: 1263564 + rule_id: v8UGpL + version_id: qkTR7Gv + url: https://semgrep.dev/playground/r/qkTR7Gv/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled + origin: community + severity: WARNING + languages: + - python + patterns: + - pattern-inside: "from pyramid.view import view_config\n...\n@view_config(..., check_origin=$CHECK_ORIGIN, ...)\ndef $VIEW(...):\n\ + \ ...\n" + - pattern: $CHECK_ORIGIN + - metavariable-comparison: + metavariable: $CHECK_ORIGIN + comparison: $CHECK_ORIGIN == False + fix: 'True + + ' +- id: python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default + patterns: + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...) + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(...) + fix-regex: + regex: (.*)\) + replacement: \1, httponly=True) + message: Found a Pyramid cookie using an unsafe default for the httponly option. Pyramid cookies should be handled securely + by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default + shortlink: https://sg.run/P19v + semgrep.dev: + rule: + r_id: 21445 + rv_id: 1263565 + rule_id: d8UPQ7 + version_id: l4TJRbo + url: https://semgrep.dev/playground/r/l4TJRbo/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value + patterns: + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...) + - pattern: $HTTPONLY + - metavariable-pattern: + metavariable: $HTTPONLY + pattern: 'False + + ' + fix: 'True + + ' + message: Found a Pyramid cookie without the httponly option correctly set. Pyramid cookies should be handled securely by + setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://owasp.org/www-community/controls/SecureCookieAttribute + - https://owasp.org/www-community/HttpOnly + - https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#httponly-attribute + category: security + technology: + - pyramid + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value + shortlink: https://sg.run/JbqP + semgrep.dev: + rule: + r_id: 21446 + rv_id: 1263566 + rule_id: ZqU37W + version_id: YDTZe54 + url: https://semgrep.dev/playground/r/YDTZe54/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default + patterns: + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., samesite=$SAMESITE, ...) + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(...) + fix-regex: + regex: (.*)\) + replacement: \1, samesite='Lax') + message: Found a Pyramid cookie using an unsafe value for the samesite option. Pyramid cookies should be handled securely + by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default + shortlink: https://sg.run/5AWj + semgrep.dev: + rule: + r_id: 21447 + rv_id: 1263567 + rule_id: nJUp80 + version_id: 6xT293z + url: https://semgrep.dev/playground/r/6xT293z/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value + patterns: + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(..., samesite=$SAMESITE, ...) + - pattern: $SAMESITE + - metavariable-regex: + metavariable: $SAMESITE + regex: (?!'Lax') + fix: '''Lax'' + + ' + message: Found a Pyramid cookie without the samesite option correctly set. Pyramid cookies should be handled securely by + setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value + shortlink: https://sg.run/GXR6 + semgrep.dev: + rule: + r_id: 21448 + rv_id: 1263568 + rule_id: EwUgpY + version_id: o5TbDv5 + url: https://semgrep.dev/playground/r/o5TbDv5/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default + patterns: + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., secure=$SECURE, ...) + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(...) + fix-regex: + regex: (.*)\) + replacement: \1, secure=True) + message: Found a Pyramid cookie using an unsafe default for the secure option. Pyramid cookies should be handled securely + by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default + shortlink: https://sg.run/RbrN + semgrep.dev: + rule: + r_id: 21449 + rv_id: 1263569 + rule_id: 7KUr15 + version_id: zyTb2dX + url: https://semgrep.dev/playground/r/zyTb2dX/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value + patterns: + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(..., secure=$SECURE, ...) + - pattern: $SECURE + - metavariable-pattern: + metavariable: $SECURE + pattern: 'False + + ' + fix: 'True + + ' + message: Found a Pyramid cookie without the secure option correctly set. Pyramid cookies should be handled securely by setting + secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected + and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value + shortlink: https://sg.run/AzjB + semgrep.dev: + rule: + r_id: 21450 + rv_id: 1263570 + rule_id: L1UX2J + version_id: pZT03oJ + url: https://semgrep.dev/playground/r/pZT03oJ/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally + patterns: + - pattern-inside: '$CONFIG.set_default_csrf_options(..., require_csrf=$REQUIRE_CSRF, ...) + + ' + - pattern: $REQUIRE_CSRF + - metavariable-comparison: + metavariable: $REQUIRE_CSRF + comparison: $REQUIRE_CSRF == False + message: Automatic check of cross-site request forgery tokens has been explicitly disabled globally, which might leave views + unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)' to turn the automatic check + for all unsafe methods (per RFC2616). + languages: + - python + severity: ERROR + fix: 'True + + ' + metadata: + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + source: https://semgrep.dev/r/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally + shortlink: https://sg.run/Bx2R + semgrep.dev: + rule: + r_id: 21451 + rv_id: 1263571 + rule_id: 8GUKqP + version_id: 2KTv2en + url: https://semgrep.dev/playground/r/2KTv2en/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally + origin: community +- id: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response + message: Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting + (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response + shortlink: https://sg.run/DX8G + semgrep.dev: + rule: + r_id: 21452 + rv_id: 1263572 + rule_id: gxUeA8 + version_id: X0TzyEe + url: https://semgrep.dev/playground/r/X0TzyEe/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response + origin: community + languages: + - python + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-either: + - pattern: 'pyramid.request.Response.text($SINK) + + ' + - pattern: 'pyramid.request.Response($SINK) + + ' + - pattern: '$REQ.response.body = $SINK + + ' + - pattern: '$REQ.response.text = $SINK + + ' + - pattern: '$REQ.response.ubody = $SINK + + ' + - pattern: '$REQ.response.unicode_body = $SINK + + ' + - pattern: $SINK +- id: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection + message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs + raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL + into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function + besides "bindparams". Use bindParams to securely bind user-input to SQL statements. + languages: + - python + severity: ERROR + metadata: + category: security + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data + technology: + - pyramid + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection + shortlink: https://sg.run/W7eE + semgrep.dev: + rule: + r_id: 21453 + rv_id: 1263573 + rule_id: QrUZ7l + version_id: jQTn5WA + url: https://semgrep.dev/playground/r/jQTn5WA/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-inside: "from pyramid.view import view_config\n...\n@view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-inside: '$QUERY = $REQ.dbsession.query(...) + + ... + + ' + - pattern-either: + - pattern: '$QUERY.$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...)) + + ' + - pattern: '$QUERY.join(...).$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...)) + + ' + - pattern: $SINK + - metavariable-regex: + metavariable: $SQLFUNC + regex: (group_by|order_by|distinct|having|filter) + - metavariable-regex: + metavariable: $FORMATFUNC + regex: (?!bindparams) + fix-regex: + regex: format + replacement: bindparams +- id: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text + mode: taint + pattern-sinks: + - pattern: 'sqlalchemy.text(...) + + ' + pattern-sources: + - patterns: + - pattern: '$X + $Y + + ' + - metavariable-type: + metavariable: $X + type: string + - patterns: + - pattern: '$X + $Y + + ' + - metavariable-type: + metavariable: $Y + type: string + - patterns: + - pattern: 'f"..." + + ' + - patterns: + - pattern: '$X.format(...) + + ' + - metavariable-type: + metavariable: $X + type: string + - patterns: + - pattern: '$X % $Y + + ' + - metavariable-type: + metavariable: $X + type: string + message: sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual + SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. + Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + category: security + technology: + - sqlalchemy + confidence: MEDIUM + references: + - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text + shortlink: https://sg.run/yP1O + semgrep.dev: + rule: + r_id: 15824 + rv_id: 1263577 + rule_id: r6U2wE + version_id: rxTAKqq + url: https://semgrep.dev/playground/r/rxTAKqq/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text + origin: community + languages: + - python + severity: ERROR +- id: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + patterns: + - pattern-either: + - pattern: "def $FUNC(...,$VAR,...):\n ...\n $SESSION.query(...).$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n" + - pattern: "def $FUNC(...,$VAR,...):\n ...\n $SESSION.query.join(...).$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n" + - pattern: "def $FUNC(...,$VAR,...):\n ...\n $SESSION.query.$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n" + - pattern: "def $FUNC(...,$VAR,...):\n ...\n query.$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n" + - metavariable-regex: + metavariable: $SQLFUNC + regex: (group_by|order_by|distinct|having|filter) + - metavariable-regex: + metavariable: $FORMATFUNC + regex: (?!bindparams) + message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs + raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL + into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function + besides "bindparams". Use bindParams to securely bind user-input to SQL statements. + fix-regex: + regex: format + replacement: bindparams + languages: + - python + severity: WARNING + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + category: security + technology: + - sqlalchemy + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + shortlink: https://sg.run/J3Xo + semgrep.dev: + rule: + r_id: 9702 + rv_id: 1263579 + rule_id: BYUBWo + version_id: NdTzyL4 + url: https://semgrep.dev/playground/r/NdTzyL4/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + origin: community +- id: python.twilio.security.twiml-injection.twiml-injection + languages: + - python + severity: WARNING + message: Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the + injection of additional TwiML commands + metadata: + cwe: + - 'CWE-91: XML Injection' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - python + - twilio + - twiml + confidence: MEDIUM + likelihood: HIGH + impact: MEDIUM + subcategory: + - vuln + references: + - https://codeberg.org/fennix/funjection + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection + shortlink: https://sg.run/GdEEy + semgrep.dev: + rule: + r_id: 134692 + rv_id: 1263580 + rule_id: oqUgjj2 + version_id: kbTzGp1 + url: https://semgrep.dev/playground/r/kbTzGp1/python.twilio.security.twiml-injection.twiml-injection + origin: community + mode: taint + pattern-sources: + - pattern: 'f"..." + + ' + - pattern: '"..." % ... + + ' + - pattern: '"...".format(...) + + ' + - patterns: + - pattern: $ARG + - pattern-inside: "def $F(..., $ARG, ...):\n ...\n" + pattern-sanitizers: + - pattern: xml.sax.saxutils.escape(...) + - pattern: html.escape(...) + pattern-sinks: + - patterns: + - pattern: '$CLIENT.calls.create(..., twiml=$SINK, ...) + + ' + - focus-metavariable: $SINK +- id: ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli + languages: + - ruby + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `Example.find_by_sql ["SELECT title FROM posts WHERE author = ? + AND created > ?", author_id, start_date]`' + mode: taint + metadata: + references: + - https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - active-record + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli + shortlink: https://sg.run/vXvY + semgrep.dev: + rule: + r_id: 18277 + rv_id: 1263581 + rule_id: 0oUw9g + version_id: w8TRor7 + url: https://semgrep.dev/playground/r/w8TRor7/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli + origin: community + pattern-sinks: + - patterns: + - pattern: $QUERY + - pattern-either: + - pattern: ActiveRecord::Base.connection.execute($QUERY,...) + - pattern: $MODEL.find_by_sql($QUERY,...) + - pattern: $MODEL.select_all($QUERY,...) + - pattern-inside: 'require ''active_record'' + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context)\n ...\nend\n" + severity: WARNING +- id: ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli + languages: + - ruby + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`' + mode: taint + metadata: + references: + - https://github.com/brianmario/mysql2 + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - mysql2 + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli + shortlink: https://sg.run/dJLE + semgrep.dev: + rule: + r_id: 18278 + rv_id: 1263582 + rule_id: KxUrQ3 + version_id: xyTjzOe + url: https://semgrep.dev/playground/r/xyTjzOe/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli + origin: community + pattern-sinks: + - patterns: + - pattern: $QUERY + - pattern-either: + - pattern: $CLIENT.query($QUERY,...) + - pattern: $CLIENT.prepare($QUERY,...) + - pattern-inside: 'require ''mysql2'' + + ... + + ' + pattern-sanitizers: + - pattern: $CLIENT.escape(...) + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context)\n ...\nend\n" + severity: WARNING +- id: ruby.aws-lambda.security.pg-sqli.pg-sqli + languages: + - ruby + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `conn.exec_params(''SELECT $1 AS a, $2 AS b, $3 AS c'', [1, 2, + nil])`' + mode: taint + metadata: + references: + - https://www.rubydoc.info/gems/pg/PG/Connection + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - postgres + - pg + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli + shortlink: https://sg.run/ZKww + semgrep.dev: + rule: + r_id: 18279 + rv_id: 1263583 + rule_id: qNUQee + version_id: O9Tpxz7 + url: https://semgrep.dev/playground/r/O9Tpxz7/ruby.aws-lambda.security.pg-sqli.pg-sqli + origin: community + pattern-sinks: + - patterns: + - pattern: $QUERY + - pattern-either: + - pattern: $CONN.exec($QUERY,...) + - pattern: $CONN.exec_params($QUERY,...) + - pattern: $CONN.exec_prepared($QUERY,...) + - pattern: $CONN.async_exec($QUERY,...) + - pattern: $CONN.async_exec_params($QUERY,...) + - pattern: $CONN.async_exec_prepared($QUERY,...) + - pattern-inside: 'require ''pg'' + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context)\n ...\nend\n" + severity: WARNING +- id: ruby.aws-lambda.security.sequel-sqli.sequel-sqli + languages: + - ruby + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `DB[''select * from items where name = ?'', name]`' + mode: taint + metadata: + references: + - https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - sequel + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli + shortlink: https://sg.run/n9vY + semgrep.dev: + rule: + r_id: 18280 + rv_id: 1263584 + rule_id: lBUy2N + version_id: e1Tyj5j + url: https://semgrep.dev/playground/r/e1Tyj5j/ruby.aws-lambda.security.sequel-sqli.sequel-sqli + origin: community + pattern-sinks: + - patterns: + - pattern: $QUERY + - pattern-either: + - pattern: DB[$QUERY,...] + - pattern: DB.run($QUERY,...) + - pattern-inside: 'require ''sequel'' + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context)\n ...\nend\n" + severity: WARNING +- id: ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization + mode: taint + languages: + - ruby + message: Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then + later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML + or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable + of returning 'primitive' types such as strings, arrays, hashes, numbers and nil. + metadata: + references: + - https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html + - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ + - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb + category: security + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + technology: + - ruby + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization + shortlink: https://sg.run/dplX + semgrep.dev: + rule: + r_id: 22078 + rv_id: 1263585 + rule_id: zdUlNJ + version_id: vdT06gR + url: https://semgrep.dev/playground/r/vdT06gR/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization + origin: community + pattern-sinks: + - patterns: + - pattern: $SINK + - pattern-either: + - pattern-inside: 'YAML.load($SINK,...) + + ' + - pattern-inside: 'CSV.load($SINK,...) + + ' + - pattern-inside: 'Marshal.load($SINK,...) + + ' + - pattern-inside: 'Marshal.restore($SINK,...) + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context)\n ...\nend\n" + severity: WARNING +- id: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string + languages: + - ruby + severity: ERROR + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction + could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the + database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider + using an object-relational mapper (ORM) such as Sequelize which will protect your queries. + metadata: + references: + - https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/EB7N + semgrep.dev: + rule: + r_id: 18281 + rv_id: 1263586 + rule_id: PeUxOE + version_id: d6Tyx1Z + url: https://semgrep.dev/playground/r/d6Tyx1Z/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context)\n ...\nend\n" + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: '"...#{...}..." + + ' + - pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].* + - patterns: + - pattern-either: + - pattern: Kernel::sprintf("$SQLSTR", ...) + - pattern: '"$SQLSTR" + $EXPR + + ' + - pattern: '"$SQLSTR" % $EXPR + + ' + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].* + - pattern-not-inside: 'puts(...) + + ' +- id: ruby.lang.security.audit.sha224-hash.sha224-hash + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating + to a stronger hash function such as SHA-384 or higher to ensure compliance and security. + metadata: + cwe: + - 'CWE-328: Use of Weak Hash' + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf + - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography + category: security + technology: + - ruby + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/ruby.lang.security.audit.sha224-hash.sha224-hash + shortlink: https://sg.run/WABbo + semgrep.dev: + rule: + r_id: 151753 + rv_id: 1263592 + rule_id: DbU60wQ + version_id: 8KT5rRY + url: https://semgrep.dev/playground/r/8KT5rRY/ruby.lang.security.audit.sha224-hash.sha224-hash + origin: community + languages: + - ruby + severity: WARNING + pattern-either: + - pattern: Digest::SHA224.$FUNC + - pattern: OpenSSL::Digest::SHA224.$FUNC + - pattern: SHA3::Digest::SHA224(...) + - patterns: + - pattern-either: + - pattern: OpenSSL::HMAC.hexdigest("$ALGO", ...) + - pattern: OpenSSL::HMAC.digest("$ALGO", ...) + - pattern: OpenSSL::HMAC.new($KEY, "$ALGO") + - pattern: OpenSSL::Digest.digest("$ALGO", ...) + - pattern: OpenSSL::Digest.new("$ALGO", ...) + - metavariable-regex: + metavariable: $ALGO + regex: .*224 +- id: ruby.lang.security.bad-deserialization.bad-deserialization + mode: taint + pattern-sources: + - pattern-either: + - pattern: params + - pattern: cookies + pattern-sinks: + - pattern-either: + - pattern: 'CSV.load(...) + + ' + - pattern: 'Marshal.load(...) + + ' + - pattern: 'Marshal.restore(...) + + ' + - pattern: 'Oj.object_load(...) + + ' + - pattern: 'Oj.load($X) + + ' + message: Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. + However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially + be dangerous. Use JSON in a secure fashion instead. + metadata: + references: + - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ + - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb + category: security + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + technology: + - ruby + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization + shortlink: https://sg.run/DJj2 + semgrep.dev: + rule: + r_id: 9708 + rv_id: 1263595 + rule_id: lBUdQg + version_id: 3ZT4Xqp + url: https://semgrep.dev/playground/r/3ZT4Xqp/ruby.lang.security.bad-deserialization.bad-deserialization + origin: community + languages: + - ruby + severity: ERROR +- id: ruby.lang.security.dangerous-exec.dangerous-exec + mode: taint + pattern-sources: + - patterns: + - pattern: "def $F(...,$ARG,...)\n ...\nend\n" + - focus-metavariable: $ARG + - pattern: params + - pattern: cookies + pattern-sinks: + - patterns: + - pattern: '$EXEC(...) + + ' + - pattern-not: '$EXEC("...","...","...",...) + + ' + - pattern-not: '$EXEC(["...","...","...",...],...) + + ' + - pattern-not: '$EXEC({...},"...","...","...",...) + + ' + - pattern-not: '$EXEC({...},["...","...","...",...],...) + + ' + - metavariable-regex: + metavariable: $EXEC + regex: ^(system|exec|spawn|Process.exec|Process.spawn|Open3.capture2|Open3.capture2e|Open3.capture3|Open3.popen2|Open3.popen2e|Open3.popen3|IO.popen|Gem::Util.popen|PTY.spawn)$ + message: Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call + site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_execute.rb + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - ruby + - rails + references: + - https://guides.rubyonrails.org/security.html#command-line-injection + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec + shortlink: https://sg.run/R8GY + semgrep.dev: + rule: + r_id: 9805 + rv_id: 1409405 + rule_id: WAUZOw + version_id: WrT7erb + url: https://semgrep.dev/playground/r/WrT7erb/ruby.lang.security.dangerous-exec.dangerous-exec + origin: community + severity: WARNING + languages: + - ruby +- id: ruby.lang.security.force-ssl-false.force-ssl-false + message: Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network + interception of unencrypted application traffic. To fix, set config.force_ssl = true. + metadata: + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + references: + - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb + category: security + technology: + - ruby + owasp: + - A03:2017 - Sensitive Data Exposure + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false + shortlink: https://sg.run/YgkW + semgrep.dev: + rule: + r_id: 9714 + rv_id: 1263605 + rule_id: 2ZU4lx + version_id: WrTqKB3 + url: https://semgrep.dev/playground/r/WrTqKB3/ruby.lang.security.force-ssl-false.force-ssl-false + origin: community + languages: + - ruby + severity: WARNING + pattern: config.force_ssl = false + fix-regex: + regex: =\s*false + replacement: = true +- id: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller + patterns: + - pattern-inside: "class $CONTROLLER < ApplicationController\n ...\n http_basic_authenticate_with ..., :password => \"\ + $SECRET\", ...\nend\n" + - focus-metavariable: $SECRET + message: Detected hardcoded password used in basic authentication in a controller class. Including this password in version + control could expose this credential. Consider refactoring to use environment variables or configuration files. + severity: WARNING + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/basic_auth/index.markdown + category: security + technology: + - ruby + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller + shortlink: https://sg.run/6r0w + semgrep.dev: + rule: + r_id: 9715 + rv_id: 1263606 + rule_id: X5UZWK + version_id: 0bTKzNK + url: https://semgrep.dev/playground/r/0bTKzNK/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller + origin: community + languages: + - ruby +- id: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase + message: Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should + not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment + variables or a restricted configuration file. + languages: + - ruby + severity: WARNING + metadata: + technology: + - ruby + - secrets + category: security + references: + - https://cwe.mitre.org/data/definitions/522.html + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase + shortlink: https://sg.run/xPEe + semgrep.dev: + rule: + r_id: 20730 + rv_id: 1263607 + rule_id: bwULyN + version_id: K3TKkEo + url: https://semgrep.dev/playground/r/K3TKkEo/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase + origin: community + patterns: + - pattern-either: + - pattern: OpenSSL::PKey::RSA.new(..., '...') + - pattern: OpenSSL::PKey::RSA.new(...).to_pem(..., '...') + - pattern: OpenSSL::PKey::RSA.new(...).export(..., '...') + - patterns: + - pattern-inside: '$OPENSSL = OpenSSL::PKey::RSA.new(...) + + ... + + ' + - pattern-either: + - pattern: '$OPENSSL.export(...,''...'') + + ' + - pattern: '$OPENSSL.to_pem(...,''...'') + + ' + - patterns: + - pattern-either: + - patterns: + - pattern-inside: '$ASSIGN = ''...'' + + ... + + ' + - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN) + - patterns: + - pattern-inside: 'def $METHOD1(...) + + ... + + $ASSIGN = ''...'' + + ... + + end + + ... + + def $METHOD2(...) + + ... + + end + + ' + - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN) + - patterns: + - pattern-inside: "$ASSIGN = '...'\n...\ndef $METHOD(...)\n $OPENSSL = OpenSSL::PKey::RSA.new(...)\n...\nend\n\ + ...\n" + - pattern-either: + - pattern: $OPENSSL.export(...,$ASSIGN) + - pattern: $OPENSSL.to_pem(...,$ASSIGN) + - patterns: + - pattern-inside: 'def $METHOD1(...) + + ... + + $OPENSSL = OpenSSL::PKey::RSA.new(...) + + ... + + $ASSIGN = ''...'' + + ... + + end + + ... + + ' + - pattern-either: + - pattern: $OPENSSL.export(...,$ASSIGN) + - pattern: $OPENSSL.to_pem(...,$ASSIGN) + - patterns: + - pattern-inside: 'def $METHOD1(...) + + ... + + $ASSIGN = ''...'' + + ... + + end + + ... + + def $METHOD2(...) + + ... + + $OPENSSL = OpenSSL::PKey::RSA.new(...) + + ... + + end + + ... + + ' + - pattern-either: + - pattern: $OPENSSL.export(...,$ASSIGN) + - pattern: $OPENSSL.to_pem(...,$ASSIGN) +- id: ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size + message: The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher. + languages: + - ruby + severity: WARNING + metadata: + technology: + - ruby + category: security + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size + shortlink: https://sg.run/O4Re + semgrep.dev: + rule: + r_id: 20731 + rv_id: 1263608 + rule_id: NbUe4N + version_id: qkTR76v + url: https://semgrep.dev/playground/r/qkTR76v/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size + origin: community + patterns: + - pattern-either: + - pattern: OpenSSL::PKey::RSA.generate($SIZE,...) + - pattern: OpenSSL::PKey::RSA.new($SIZE, ...) + - patterns: + - pattern-either: + - patterns: + - pattern-inside: '$ASSIGN = $SIZE + + ... + + ' + - pattern-either: + - pattern: OpenSSL::PKey::RSA.new($ASSIGN, ...) + - pattern: OpenSSL::PKey::RSA.generate($ASSIGN, ...) + - patterns: + - pattern-inside: 'def $METHOD1(...) + + ... + + $ASSIGN = $SIZE + + ... + + end + + ... + + ' + - pattern-either: + - pattern: OpenSSL::PKey::RSA.new($ASSIGN, ...) + - pattern: OpenSSL::PKey::RSA.generate($ASSIGN, ...) + - metavariable-comparison: + metavariable: $SIZE + comparison: $SIZE < 2048 +- id: ruby.lang.security.md5-used-as-password.md5-used-as-password + languages: + - ruby + severity: WARNING + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked + by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use + the `bcrypt` gem. + metadata: + category: security + technology: + - md5 + references: + - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html + - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords + - https://github.com/returntocorp/semgrep-rules/issues/1609 + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password + shortlink: https://sg.run/GOZy + semgrep.dev: + rule: + r_id: 14704 + rv_id: 1263611 + rule_id: oqU4p2 + version_id: JdTzx0e + url: https://semgrep.dev/playground/r/JdTzx0e/ruby.lang.security.md5-used-as-password.md5-used-as-password + origin: community + mode: taint + pattern-sources: + - pattern: Digest::MD5 + pattern-sinks: + - patterns: + - pattern: $FUNCTION(...); + - metavariable-regex: + metavariable: $FUNCTION + regex: (?i)(.*password.*) +- id: ruby.lang.security.no-eval.ruby-eval + message: Use of eval with user-controllable input detected. This can lead to attackers running arbitrary code. Ensure external + data does not reach here, otherwise this is a security vulnerability. Consider other ways to do this without eval. + severity: WARNING + metadata: + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + category: security + cwe2022-top25: true + cwe2021-top25: true + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_evaluation.rb + subcategory: + - vuln + technology: + - ruby + - rails + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval + shortlink: https://sg.run/bDwZ + semgrep.dev: + rule: + r_id: 9726 + rv_id: 1263615 + rule_id: OrUGNk + version_id: A8TgdDv + url: https://semgrep.dev/playground/r/A8TgdDv/ruby.lang.security.no-eval.ruby-eval + origin: community + languages: + - ruby + mode: taint + pattern-sources: + - pattern-either: + - pattern: params + - pattern: cookies + - patterns: + - pattern: 'RubyVM::InstructionSequence.compile(...) + + ' + - pattern-not: 'RubyVM::InstructionSequence.compile("...") + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $X.eval + - pattern: $X.class_eval + - pattern: $X.instance_eval + - pattern: $X.module_eval + - pattern: $X.eval(...) + - pattern: $X.class_eval(...) + - pattern: $X.instance_eval(...) + - pattern: $X.module_eval(...) + - pattern: eval(...) + - pattern: class_eval(...) + - pattern: module_eval(...) + - pattern: instance_eval(...) + - pattern-not: $M("...",...) +- id: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify + pattern: OpenSSL::SSL::VERIFY_NONE + message: Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle + attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. + fix-regex: + regex: VERIFY_NONE + replacement: VERIFY_PEER + severity: WARNING + languages: + - ruby + metadata: + cwe: + - 'CWE-295: Improper Certificate Validation' + category: security + technology: + - ruby + owasp: + - A03:2017 - Sensitive Data Exposure + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify + shortlink: https://sg.run/kLxX + semgrep.dev: + rule: + r_id: 9728 + rv_id: 1263617 + rule_id: v8U5Yn + version_id: DkTRbl4 + url: https://semgrep.dev/playground/r/DkTRbl4/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify + origin: community +- id: ruby.lang.security.weak-hashes-md5.weak-hashes-md5 + message: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could + also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. + metadata: + cwe: + - 'CWE-328: Use of Weak Hash' + references: + - https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575 + category: security + technology: + - ruby + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5 + shortlink: https://sg.run/O1re + semgrep.dev: + rule: + r_id: 9731 + rv_id: 1263619 + rule_id: nJUYxZ + version_id: 0bTKzN8 + url: https://semgrep.dev/playground/r/0bTKzN8/ruby.lang.security.weak-hashes-md5.weak-hashes-md5 + origin: community + languages: + - ruby + severity: WARNING + pattern-either: + - pattern: Digest::MD5.base64digest $X + - pattern: Digest::MD5.hexdigest $X + - pattern: Digest::MD5.digest $X + - pattern: Digest::MD5.new + - pattern: OpenSSL::Digest::MD5.base64digest $X + - pattern: OpenSSL::Digest::MD5.hexdigest $X + - pattern: OpenSSL::Digest::MD5.digest $X + - pattern: OpenSSL::Digest::MD5.new +- id: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1 + message: Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. + Use SHA256, SHA3 or other hashing functions instead. + metadata: + cwe: + - 'CWE-328: Use of Weak Hash' + references: + - https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html + - https://shattered.io/ + category: security + technology: + - ruby + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1 + shortlink: https://sg.run/e4qX + semgrep.dev: + rule: + r_id: 9732 + rv_id: 1263620 + rule_id: EwU4jq + version_id: K3TKkEZ + url: https://semgrep.dev/playground/r/K3TKkEZ/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1 + origin: community + languages: + - ruby + severity: WARNING + pattern-either: + - pattern: Digest::SHA1.$FUNC + - pattern: OpenSSL::Digest::SHA1.$FUNC + - pattern: OpenSSL::HMAC.$FUNC("sha1",...) +- id: ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation + metadata: + shortDescription: Allowing an attacker to manipulate the session may lead to unintended behavior. + tags: + - security + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-276: Incorrect Default Permissions' + references: + - https://brakemanscanner.org/docs/warning_types/session_manipulation/ + category: security + technology: + - rails + help: '## Remediation + + Session manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered + a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the + session may lead to unintended behavior. + + + ## References + + [Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/) + + ' + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation + shortlink: https://sg.run/86q7 + semgrep.dev: + rule: + r_id: 13584 + rv_id: 1263621 + rule_id: BYUdW6 + version_id: qkTR76G + url: https://semgrep.dev/playground/r/qkTR76G/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation + origin: community + message: This gets data from session using user inputs. A malicious user may be able to retrieve information from your session + that you didn't intend them to. Do not use user input as a session key. + languages: + - ruby + severity: WARNING + mode: taint + pattern-sources: + - pattern: params + - pattern: cookies + - pattern: request.env + pattern-sinks: + - pattern: session[...] +- id: ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access + metadata: + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + references: + - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown + category: security + technology: + - rails + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access + shortlink: https://sg.run/gYln + semgrep.dev: + rule: + r_id: 13585 + rv_id: 1263622 + rule_id: DbU1dr + version_id: l4TJRkk + url: https://semgrep.dev/playground/r/l4TJRkk/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access + origin: community + message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access + files they have no right to. + languages: + - ruby + severity: WARNING + mode: taint + pattern-sources: + - pattern: params + - pattern: cookies + - pattern: request.env + pattern-sinks: + - patterns: + - pattern-either: + - pattern: Dir.$X(...) + - pattern: File.$X(...) + - pattern: IO.$X(...) + - pattern: Kernel.$X(...) + - pattern: PStore.$X(...) + - pattern: Pathname.$X(...) + - metavariable-pattern: + metavariable: $X + patterns: + - pattern-either: + - pattern: chdir + - pattern: chroot + - pattern: delete + - pattern: entries + - pattern: foreach + - pattern: glob + - pattern: install + - pattern: lchmod + - pattern: lchown + - pattern: link + - pattern: load + - pattern: load_file + - pattern: makedirs + - pattern: move + - pattern: new + - pattern: open + - pattern: read + - pattern: readlines + - pattern: rename + - pattern: rmdir + - pattern: safe_unlink + - pattern: symlink + - pattern: syscopy + - pattern: sysopen + - pattern: truncate + - pattern: unlink +- id: ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call + metadata: + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + references: + - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown + category: security + technology: + - rails + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call + shortlink: https://sg.run/Q9gP + semgrep.dev: + rule: + r_id: 13586 + rv_id: 1263623 + rule_id: WAUyzp + version_id: YDTZeWL + url: https://semgrep.dev/playground/r/YDTZeWL/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call + origin: community + message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access + files they have no right to. + languages: + - ruby + severity: WARNING + mode: taint + pattern-sources: + - pattern: params + - pattern: cookies + - pattern: request.env + pattern-sinks: + - pattern-either: + - pattern: Net::FTP.$X(...) + - patterns: + - pattern-inside: '$FTP = Net::FTP.$OPEN(...) + + ... + + $FTP.$METHOD(...) + + ' + - pattern: $FTP.$METHOD(...) +- id: ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request + metadata: + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + references: + - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown + category: security + technology: + - rails + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request + shortlink: https://sg.run/3rLb + semgrep.dev: + rule: + r_id: 13587 + rv_id: 1263624 + rule_id: 0oU2x3 + version_id: 6xT29nN + url: https://semgrep.dev/playground/r/6xT29nN/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request + origin: community + message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access + files they have no right to. + languages: + - ruby + severity: WARNING + mode: taint + pattern-sources: + - pattern: params + - pattern: cookies + - pattern: request.env + pattern-sinks: + - pattern-either: + - patterns: + - pattern: Net::HTTP::$METHOD.new(...) + - metavariable-pattern: + metavariable: $METHOD + patterns: + - pattern-either: + - pattern: Copy + - pattern: Delete + - pattern: Get + - pattern: Head + - pattern: Lock + - pattern: Mkcol + - pattern: Move + - pattern: Options + - pattern: Patch + - pattern: Post + - pattern: Propfind + - pattern: Proppatch + - pattern: Put + - pattern: Trace + - pattern: Unlock + - patterns: + - pattern: Net::HTTP.$X(...) + - metavariable-pattern: + metavariable: $X + patterns: + - pattern-either: + - pattern: get + - pattern: get2 + - pattern: head + - pattern: head2 + - pattern: options + - pattern: patch + - pattern: post + - pattern: post2 + - pattern: post_form + - pattern: put + - pattern: request + - pattern: request_get + - pattern: request_head + - pattern: request_post + - pattern: send_request + - pattern: trace + - pattern: get_print + - pattern: get_response + - pattern: start +- id: ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + references: + - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown + category: security + technology: + - rails + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call + shortlink: https://sg.run/4e8E + semgrep.dev: + rule: + r_id: 13588 + rv_id: 1263625 + rule_id: KxU72k + version_id: o5TbDq8 + url: https://semgrep.dev/playground/r/o5TbDq8/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call + origin: community + message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access + files they have no right to. + languages: + - ruby + severity: ERROR + mode: taint + pattern-sources: + - pattern-either: + - pattern: params[...] + - pattern: cookies + - pattern: request.env + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: Kernel.$X(...) + - patterns: + - pattern-either: + - pattern: Shell.$X(...) + - patterns: + - pattern-inside: '$SHELL = Shell.$ANY(...) + + ... + + $SHELL.$X(...) + + ' + - pattern: $SHELL.$X(...) + - metavariable-pattern: + metavariable: $X + patterns: + - pattern-either: + - pattern: cat + - pattern: chdir + - pattern: chroot + - pattern: delete + - pattern: entries + - pattern: exec + - pattern: foreach + - pattern: glob + - pattern: install + - pattern: lchmod + - pattern: lchown + - pattern: link + - pattern: load + - pattern: load_file + - pattern: makedirs + - pattern: move + - pattern: new + - pattern: open + - pattern: read + - pattern: readlines + - pattern: rename + - pattern: rmdir + - pattern: safe_unlink + - pattern: symlink + - pattern: syscopy + - pattern: sysopen + - pattern: system + - pattern: truncate + - pattern: unlink +- id: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli + mode: taint + pattern-propagators: + - pattern: $X << $Y + from: $Y + to: $X + pattern-sources: + - pattern-either: + - pattern: 'params + + ' + - pattern: 'cookies + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$CON = PG.connect(...) + + ... + + ' + - pattern-inside: '$CON = PG::Connection.open(...) + + ... + + ' + - pattern-inside: '$CON = PG::Connection.new(...) + + ... + + ' + - pattern-either: + - pattern: '$CON.$METHOD($X,...) + + ' + - pattern: '$CON.$METHOD $X, ... + + ' + - focus-metavariable: $X + - metavariable-regex: + metavariable: $METHOD + regex: ^(exec|exec_params)$ + languages: + - ruby + message: 'Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection + if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries + or prepared statements instead. You can use parameterized queries like so: `conn.exec_params(''SELECT $1 AS a, $2 AS b, + $3 AS c'', [1, 2, nil])` And you can use prepared statements with `exec_prepared`.' + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://www.rubydoc.info/gems/pg/PG/Connection + category: security + technology: + - rails + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli + shortlink: https://sg.run/kL0o + semgrep.dev: + rule: + r_id: 10328 + rv_id: 1263628 + rule_id: NbUAz7 + version_id: 2KTv2y2 + url: https://semgrep.dev/playground/r/2KTv2y2/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli + origin: community + severity: WARNING +- id: ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_link_to.rb + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + references: + - https://brakemanscanner.org/docs/warning_types/link_to/ + - https://brakemanscanner.org/docs/warning_types/link_to_href/ + category: security + technology: + - rails + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to + shortlink: https://sg.run/JxXQ + semgrep.dev: + rule: + r_id: 13590 + rv_id: 1263632 + rule_id: lBU8Qj + version_id: 9lT4brj + url: https://semgrep.dev/playground/r/9lT4brj/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to + origin: community + message: This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that + user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting + with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument. + languages: + - ruby + severity: WARNING + mode: taint + pattern-sources: + - pattern: params + - pattern: cookies + - pattern: request.env + - pattern-either: + - pattern: $MODEL.url(...) + - pattern: $MODEL.uri(...) + - pattern: $MODEL.link(...) + - pattern: $MODEL.page(...) + - pattern: $MODEL.site(...) + pattern-sinks: + - pattern: link_to(...) + pattern-sanitizers: + - patterns: + - pattern: '"...#{...}..." + + ' + - pattern-not: '"#{...}..." + + ' +- id: ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect + metadata: + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + references: + - https://brakemanscanner.org/docs/warning_types/redirect/ + category: security + technology: + - rails + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect + shortlink: https://sg.run/5DY3 + semgrep.dev: + rule: + r_id: 13591 + rv_id: 1263634 + rule_id: YGUDqJ + version_id: rxTAKdY + url: https://semgrep.dev/playground/r/rxTAKdY/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect + origin: community + message: When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted + parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. + languages: + - ruby + severity: WARNING + mode: taint + pattern-sources: + - pattern: params + - pattern: cookies + - pattern: request.env + - patterns: + - pattern: $MODEL.$X(...) + - pattern-not: $MODEL.$X("...") + - metavariable-pattern: + metavariable: $X + pattern-either: + - pattern: all + - pattern: create + - pattern: create! + - pattern: find + - pattern: find_by_sql + - pattern: first + - pattern: last + - pattern: new + - pattern: from + - pattern: group + - pattern: having + - pattern: joins + - pattern: lock + - pattern: order + - pattern: reorder + - pattern: select + - pattern: where + - pattern: find_by + - pattern: find_by! + - pattern: take + pattern-sinks: + - pattern: redirect_to(...) + pattern-sanitizers: + - pattern: params.merge(:only_path => true) + - pattern: params.merge(:host => ...) +- id: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path + metadata: + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + references: + - https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/ + category: security + technology: + - rails + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path + shortlink: https://sg.run/GO2n + semgrep.dev: + rule: + r_id: 13592 + rv_id: 1263635 + rule_id: 6JU1bL + version_id: bZT53p0 + url: https://semgrep.dev/playground/r/bZT53p0/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path + origin: community + message: Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template + they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed + template. + languages: + - ruby + severity: WARNING + mode: taint + pattern-sources: + - pattern: params + - pattern: cookies + - pattern: request.env + pattern-sinks: + - patterns: + - pattern-inside: render($X => $INPUT, ...) + - pattern: $INPUT + - metavariable-pattern: + metavariable: $X + pattern-either: + - pattern: action + - pattern: template + - pattern: partial + - pattern: file +- id: ruby.rails.security.brakeman.check-before-filter.check-before-filter + mode: search + patterns: + - pattern-either: + - pattern: 'skip_filter ..., :except => $ARGS + + ' + - pattern: 'skip_before_filter ..., :except => $ARGS + + ' + - pattern: 'skip_before_action ..., :except => $ARGS + + ' + message: 'Disabled-by-default Rails controller checks make it much easier to introduce access control mistakes. Prefer an + allowlist approach with `:only => [...]` rather than `except: => [...]`' + languages: + - ruby + severity: ERROR + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_skip_before_filter.rb + category: security + cwe: + - 'CWE-284: Improper Access Control' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + technology: + - ruby + - rails + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-before-filter.check-before-filter + shortlink: https://sg.run/O4Zn + semgrep.dev: + rule: + r_id: 20531 + rv_id: 1263649 + rule_id: wdUkBP + version_id: 8KT5rDy + url: https://semgrep.dev/playground/r/8KT5rDy/ruby.rails.security.brakeman.check-before-filter.check-before-filter + origin: community +- id: ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include + mode: search + paths: + include: + - '*.erb' + patterns: + - pattern: 'params[...] + + ' + - pattern-inside: 'render :file => ... + + ' + message: Found request parameters in a call to `render` in a dynamic context. This can allow end users to request arbitrary + local files which may result in leaking sensitive information persisted on disk. + languages: + - generic + severity: WARNING + metadata: + technology: + - ruby + - rails + category: security + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb + references: + - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion + - https://github.com/presidentbeef/brakeman/blob/f74cb53ead47f0af821d98b5b41e16d63100c240/test/apps/rails2/app/views/home/test_render.html.erb + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include + shortlink: https://sg.run/3QWl + semgrep.dev: + rule: + r_id: 20043 + rv_id: 1263651 + rule_id: JDUokO + version_id: QkTGq9X + url: https://semgrep.dev/playground/r/QkTGq9X/ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include + origin: community +- id: ruby.rails.security.brakeman.check-http-verb-confusion.check-http-verb-confusion + mode: search + patterns: + - pattern: "if request.get?\n ...\nelse\n ...\nend\n" + - pattern-not-inside: "if ...\nelsif ...\n ...\nend\n" + message: Found an improperly constructed control flow block with `request.get?`. Rails will route HEAD requests as GET requests + but they will fail the `request.get?` check, potentially causing unexpected behavior unless an `elif` condition is used. + languages: + - ruby + severity: ERROR + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_verb_confusion.rb + category: security + cwe: + - 'CWE-650: Trusting HTTP Permission Methods on the Server Side' + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + technology: + - ruby + - rails + references: + - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/accounts_controller.rb + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-http-verb-confusion.check-http-verb-confusion + shortlink: https://sg.run/eJ6y + semgrep.dev: + rule: + r_id: 20532 + rv_id: 1263652 + rule_id: x8UdDE + version_id: 3ZT4X82 + url: https://semgrep.dev/playground/r/3ZT4X82/ruby.rails.security.brakeman.check-http-verb-confusion.check-http-verb-confusion + origin: community +- id: ruby.rails.security.brakeman.check-rails-session-secret-handling.check-rails-session-secret-handling + patterns: + - pattern-either: + - patterns: + - pattern: ':$KEY => "$LITERAL" + + ' + - pattern-inside: 'ActionController::Base.session = {...} + + ' + - pattern: '$RAILS::Application.config.$KEY = "$LITERAL" + + ' + - pattern: 'Rails.application.config.$KEY = "$LITERAL" + + ' + - metavariable-regex: + metavariable: $KEY + regex: ^secret(_(token|key_base))?$ + message: Found a string literal assignment to a Rails session secret `$KEY`. Do not commit secret values to source control! + Any user in possession of this value may falsify arbitrary session data in your application. Read this value from an environment + variable, KMS, or file on disk outside of source control. + languages: + - ruby + severity: WARNING + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_session_settings.rb + category: security + cwe: + - 'CWE-540: Inclusion of Sensitive Information in Source Code' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + technology: + - ruby + - rails + references: + - https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes + - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails4_with_engines/config/initializers/secret_token.rb + - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3/config/initializers/secret_token.rb + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-rails-session-secret-handling.check-rails-session-secret-handling + shortlink: https://sg.run/KyJd + semgrep.dev: + rule: + r_id: 20155 + rv_id: 1263656 + rule_id: lBUX1r + version_id: 5PTo1ZY + url: https://semgrep.dev/playground/r/5PTo1ZY/ruby.rails.security.brakeman.check-rails-session-secret-handling.check-rails-session-secret-handling + origin: community +- id: ruby.rails.security.brakeman.check-redirect-to.check-redirect-to + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: params + - pattern: cookies + - pattern: request.env + - pattern: url_for(params[...],...,:only_path => false,...) + pattern-sanitizers: + - patterns: + - pattern-either: + - patterns: + - pattern: '$F(...) + + ' + - metavariable-pattern: + metavariable: $F + patterns: + - pattern-not-regex: (params|url_for|cookies|request.env|permit|redirect_to) + - pattern: 'params.merge! :only_path => true + + ... + + ' + - pattern: 'params.slice(...) + + ... + + ' + - pattern: 'redirect_to [...] + + ' + - patterns: + - pattern: '$MODEL. ... .$M(...) + + ... + + ' + - metavariable-regex: + metavariable: $MODEL + regex: '[A-Z]\w+' + - metavariable-regex: + metavariable: $M + regex: (all|create|find|find_by|find_by_sql|first|last|new|from|group|having|joins|lock|order|reorder|select|where|take) + - patterns: + - pattern: 'params.$UNSAFE_HASH.merge(...,:only_path => true,...) + + ... + + ' + - metavariable-regex: + metavariable: $UNSAFE_HASH + regex: to_unsafe_h(ash)? + - patterns: + - pattern: params.permit(...,$X,...) + - metavariable-pattern: + metavariable: $X + patterns: + - pattern-not-regex: (host|port|(sub)?domain) + pattern-sinks: + - patterns: + - pattern: $X + - pattern-inside: 'redirect_to $X, ... + + ' + - pattern-not-regex: params\.\w+(? true` hash value. + languages: + - ruby + severity: WARNING + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_redirect.rb + category: security + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + technology: + - ruby + - rails + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to + shortlink: https://sg.run/eJNX + semgrep.dev: + rule: + r_id: 20732 + rv_id: 1263657 + rule_id: kxUOJ6 + version_id: GxTke14 + url: https://semgrep.dev/playground/r/GxTke14/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to + origin: community +- id: ruby.rails.security.brakeman.check-regex-dos.check-regex-dos + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: 'cookies[...] + + ' + - patterns: + - pattern: 'cookies. ... .$PROPERTY[...] + + ' + - metavariable-regex: + metavariable: $PROPERTY + regex: (?!signed|encrypted) + - pattern: 'params[...] + + ' + - pattern: 'request.env[...] + + ' + - patterns: + - pattern: $Y + - pattern-either: + - pattern-inside: '$RECORD.read_attribute($Y) + + ' + - pattern-inside: '$RECORD[$Y] + + ' + - metavariable-regex: + metavariable: $RECORD + regex: '[A-Z][a-z]+' + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: $Y + - pattern-inside: '/...#{...}.../ + + ' + - patterns: + - pattern: $Y + - pattern-inside: 'Regexp.new(...) + + ' + message: Found a potentially user-controllable argument in the construction of a regular expressions. This may result in + excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. + Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input + in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking. + languages: + - ruby + severity: ERROR + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_regex_dos.rb + category: security + cwe: + - 'CWE-1333: Inefficient Regular Expression Complexity' + owasp: + - A03:2017 - Sensitive Data Exposure + technology: + - ruby + - rails + references: + - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Denial-of-Service (DoS) + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos + shortlink: https://sg.run/qZwx + semgrep.dev: + rule: + r_id: 20156 + rv_id: 1409406 + rule_id: YGUY4R + version_id: 0bTG0WO + url: https://semgrep.dev/playground/r/0bTG0WO/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos + origin: community +- id: ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include + mode: taint + pattern-sources: + - patterns: + - pattern: params[...] + pattern-sinks: + - patterns: + - pattern-either: + - pattern: 'render ..., file: $X + + ' + - pattern: 'render ..., inline: $X + + ' + - pattern: 'render ..., template: $X + + ' + - pattern: 'render ..., action: $X + + ' + - pattern: 'render $X, ... + + ' + - focus-metavariable: $X + pattern-sanitizers: + - patterns: + - pattern: $MAP[...] + - metavariable-pattern: + metavariable: $MAP + patterns: + - pattern-not-regex: params + - pattern: File.basename(...) + message: Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which + may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths + for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value + with `File.basename(...)`. + languages: + - ruby + severity: WARNING + metadata: + technology: + - ruby + - rails + category: security + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb + references: + - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion + - https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60 + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + vulnerability_class: + - Path Traversal + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include + shortlink: https://sg.run/Jw8Z + semgrep.dev: + rule: + r_id: 20046 + rv_id: 1409407 + rule_id: ReU2pZ + version_id: K3TgANN + url: https://semgrep.dev/playground/r/K3TgANN/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include + origin: community +- id: ruby.rails.security.brakeman.check-secrets.check-secrets + patterns: + - pattern: $VAR = "$VALUE" + - metavariable-regex: + metavariable: $VAR + regex: (?i)password|secret|(rest_auth_site|api)_key$ + - metavariable-regex: + metavariable: $VALUE + regex: .+ + message: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty + string literal value. + languages: + - ruby + severity: WARNING + metadata: + technology: + - ruby + - rails + category: security + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_secrets.rb + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + - https://github.com/presidentbeef/brakeman/blob/3f5d5d5f00864cdf7769c50f5bd26f1769a4ba75/test/apps/rails3.1/app/controllers/users_controller.rb + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-secrets.check-secrets + shortlink: https://sg.run/5ZKl + semgrep.dev: + rule: + r_id: 20047 + rv_id: 1263659 + rule_id: AbUNqO + version_id: A8TgdBv + url: https://semgrep.dev/playground/r/A8TgdBv/ruby.rails.security.brakeman.check-secrets.check-secrets + origin: community +- id: ruby.rails.security.brakeman.check-send-file.check-send-file + mode: taint + pattern-sources: + - pattern-either: + - pattern: 'cookies[...] + + ' + - patterns: + - pattern: 'cookies. ... .$PROPERTY[...] + + ' + - metavariable-regex: + metavariable: $PROPERTY + regex: (?!signed|encrypted) + - pattern: 'params[...] + + ' + - pattern: 'request.env[...] + + ' + pattern-sinks: + - patterns: + - pattern: 'send_file ... + + ' + message: Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. + Avoid accepting user input in `send_file` or normalize with `File.basename(...)` + languages: + - ruby + severity: ERROR + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send_file.rb + category: security + cwe: + - 'CWE-73: External Control of File Name or Path' + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + technology: + - ruby + - rails + references: + - https://owasp.org/www-community/attacks/Path_Traversal + - https://owasp.org/Top10/A01_2021-Broken_Access_Control/ + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file + shortlink: https://sg.run/GbY1 + semgrep.dev: + rule: + r_id: 20048 + rv_id: 1263660 + rule_id: BYUKbl + version_id: BjTkZRj + url: https://semgrep.dev/playground/r/BjTkZRj/ruby.rails.security.brakeman.check-send-file.check-send-file + origin: community +- id: ruby.rails.security.brakeman.check-sql.check-sql + mode: taint + pattern-sources: + - pattern-either: + - pattern: 'cookies[...] + + ' + - patterns: + - pattern: 'cookies. ... .$PROPERTY[...] + + ' + - metavariable-regex: + metavariable: $PROPERTY + regex: (?!signed|encrypted) + - pattern: 'params[...] + + ' + - pattern: 'request.env[...] + + ' + pattern-sanitizers: + - patterns: + - pattern-either: + - patterns: + - pattern: $X + - pattern-either: + - pattern-inside: ':$KEY => $X + + ' + - pattern-inside: '["...",$X,...] + + ' + - pattern: 'params[...].to_i + + ' + - pattern: 'params[...].to_f + + ' + - patterns: + - pattern: 'params[...] ? $A : $B + + ' + - metavariable-pattern: + metavariable: $A + patterns: + - pattern-not: 'params[...] + + ' + - metavariable-pattern: + metavariable: $B + patterns: + - pattern-not: 'params[...] + + ' + pattern-sinks: + - patterns: + - pattern: $X + - pattern-not-inside: '$P.where("...",...) + + ' + - pattern-not-inside: '$P.where(:$KEY => $VAL,...) + + ' + - pattern-either: + - pattern-inside: '$P.$M(...) + + ' + - pattern-inside: '$P.$M("...",...) + + ' + - pattern-inside: "class $P < ActiveRecord::Base\n ...\nend\n" + - metavariable-regex: + metavariable: $M + regex: (where|find|first|last|select|minimum|maximum|calculate|sum|average) + message: Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized + queries. + languages: + - ruby + severity: ERROR + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_sql.rb + category: security + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + technology: + - ruby + - rails + references: + - https://owasp.org/www-community/attacks/SQL_Injection + - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql + shortlink: https://sg.run/vpgb + semgrep.dev: + rule: + r_id: 20533 + rv_id: 1263661 + rule_id: OrUv2z + version_id: DkTRbE4 + url: https://semgrep.dev/playground/r/DkTRbE4/ruby.rails.security.brakeman.check-sql.check-sql + origin: community +- id: ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods + mode: taint + pattern-sources: + - pattern-either: + - pattern: 'cookies[...] + + ' + - patterns: + - pattern: 'cookies. ... .$PROPERTY[...] + + ' + - metavariable-regex: + metavariable: $PROPERTY + regex: (?!signed|encrypted) + - pattern: 'params[...] + + ' + - pattern: 'request.env[...] + + ' + pattern-sinks: + - patterns: + - pattern: $X + - pattern-either: + - pattern-inside: '$X. ... .to_proc + + ' + - patterns: + - pattern-inside: '$Y.method($Z) + + ' + - focus-metavariable: $Z + - patterns: + - pattern-inside: '$Y.tap($Z) + + ' + - focus-metavariable: $Z + - patterns: + - pattern-inside: '$Y.tap{ |$ANY| $Z } + + ' + - focus-metavariable: $Z + message: Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially + execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, + or `to_proc` + languages: + - ruby + severity: ERROR + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection_methods.rb + category: security + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + technology: + - ruby + - rails + references: + - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods + shortlink: https://sg.run/dPYd + semgrep.dev: + rule: + r_id: 20534 + rv_id: 1263662 + rule_id: eqUZ2Q + version_id: WrTqKLA + url: https://semgrep.dev/playground/r/WrTqKLA/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods + origin: community +- id: ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection + mode: taint + pattern-sources: + - pattern-either: + - pattern: 'cookies[...] + + ' + - patterns: + - pattern: 'cookies. ... .$PROPERTY[...] + + ' + - metavariable-regex: + metavariable: $PROPERTY + regex: (?!signed|encrypted) + - pattern: 'params[...] + + ' + - pattern: 'request.env[...] + + ' + pattern-sinks: + - patterns: + - pattern: $X + - pattern-either: + - pattern-inside: '$X.constantize + + ' + - pattern-inside: '$X. ... .safe_constantize + + ' + - pattern-inside: 'const_get(...) + + ' + - pattern-inside: 'qualified_const_get(...) + + ' + message: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime + behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. + Do not call symbol conversion on user-controllable input. + languages: + - ruby + severity: ERROR + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection.rb + category: security + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + technology: + - ruby + - rails + references: + - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection + shortlink: https://sg.run/vpEX + semgrep.dev: + rule: + r_id: 20733 + rv_id: 1263663 + rule_id: wdUkYA + version_id: 0bTKzn8 + url: https://semgrep.dev/playground/r/0bTKzn8/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection + origin: community +- id: ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find + mode: taint + pattern-sources: + - pattern-either: + - pattern: 'cookies[...] + + ' + - patterns: + - pattern: 'cookies. ... .$PROPERTY[...] + + ' + - metavariable-regex: + metavariable: $PROPERTY + regex: (?!signed|encrypted) + - pattern: 'params[...] + + ' + - pattern: 'request.env[...] + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $MODEL.find(...) + - pattern: $MODEL.find_by_id(...) + - pattern: $MODEL.find_by_id!(...) + - metavariable-regex: + metavariable: $MODEL + regex: '[A-Z]\S+' + message: Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is + sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. + Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`. + languages: + - ruby + severity: WARNING + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unscoped_find.rb + category: security + cwe: + - 'CWE-639: Authorization Bypass Through User-Controlled Key' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + technology: + - ruby + - rails + references: + - https://brakemanscanner.org/docs/warning_types/unscoped_find/ + - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find + shortlink: https://sg.run/dPbP + semgrep.dev: + rule: + r_id: 20734 + rv_id: 1263664 + rule_id: x8Ud6d + version_id: K3TKkxZ + url: https://semgrep.dev/playground/r/K3TKkxZ/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find + origin: community +- id: ruby.rails.security.brakeman.check-validation-regex.check-validation-regex + mode: search + patterns: + - pattern-either: + - pattern: 'validates ..., :format => <... $V ...>,... + + ' + - pattern: 'validates_format_of ..., :with => <... $V ...>,... + + ' + - metavariable-regex: + metavariable: $V + regex: /(.{2}(? ...`. Ruby regex + behavior is multiline by default and lines should be terminated by `\A` for beginning of line and `\Z` for end of line, + respectively. + languages: + - ruby + severity: ERROR + metadata: + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_validation_regex.rb + category: security + cwe: + - 'CWE-185: Incorrect Regular Expression' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + technology: + - ruby + - rails + references: + - https://brakemanscanner.org/docs/warning_types/format_validation/ + - https://github.com/presidentbeef/brakeman/blob/aef6253a8b7bcb97116f2af1ed2a561a6ae35bd5/test/apps/rails3/app/models/account.rb + - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/account.rb + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-validation-regex.check-validation-regex + shortlink: https://sg.run/ZPo7 + semgrep.dev: + rule: + r_id: 20735 + rv_id: 1263665 + rule_id: OrUv1X + version_id: qkTR7DG + url: https://semgrep.dev/playground/r/qkTR7DG/ruby.rails.security.brakeman.check-validation-regex.check-validation-regex + origin: community +- id: ruby.rails.security.injection.raw-html-format.raw-html-format + languages: + - ruby + severity: WARNING + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML + instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - rails + references: + - https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/ + - https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format + shortlink: https://sg.run/b2JQ + semgrep.dev: + rule: + r_id: 14470 + rv_id: 1409408 + rule_id: kxUwZX + version_id: qkTvgYY + url: https://semgrep.dev/playground/r/qkTvgYY/ruby.rails.security.injection.raw-html-format.raw-html-format + origin: community + mode: taint + pattern-sanitizers: + - pattern-either: + - pattern: sanitize(...) + - pattern: strip_tags(...) + pattern-sources: + - patterns: + - pattern-either: + - pattern: params + - pattern: request + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: '$HTMLSTR + + ' + - pattern-regex: <\w+.* + - patterns: + - pattern-either: + - pattern: Kernel::sprintf("$HTMLSTR", ...) + - pattern: '"$HTMLSTR" + $EXPR + + ' + - pattern: '"$HTMLSTR" % $EXPR + + ' + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... +- id: ruby.rails.security.injection.tainted-sql-string.tainted-sql-string + languages: + - ruby + severity: ERROR + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction + could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the + database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider + using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - rails + references: + - https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/Y85o + semgrep.dev: + rule: + r_id: 14714 + rv_id: 1263667 + rule_id: bwU8gl + version_id: YDTZeLL + url: https://semgrep.dev/playground/r/YDTZeLL/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: params + - pattern: request + pattern-sanitizers: + - pattern: '$PARAMS.slice(...) + + ' + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - patterns: + - pattern: '$RECORD.where($X,...) + + ' + - pattern: '$RECORD.find(..., :conditions => $X,...) + + ' + - focus-metavariable: $X + - patterns: + - pattern: '"$SQLVERB#{$EXPR}..." + + ' + - pattern-not-inside: '$FUNC("...", "...#{$EXPR}...",...) + + ' + - focus-metavariable: $SQLVERB + - pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b + - patterns: + - pattern-either: + - pattern: Kernel::sprintf("$SQLSTR", $EXPR) + - pattern: '"$SQLSTR" + $EXPR + + ' + - pattern: '"$SQLSTR" % $EXPR + + ' + - pattern-not-inside: '$FUNC("...", "...#{$EXPR}...",...) + + ' + - focus-metavariable: $EXPR + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(select|delete|insert|create|update|alter|drop)\b +- id: ruby.rails.security.injection.tainted-url-host.tainted-url-host + languages: + - ruby + severity: WARNING + message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data + to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. + They could also probe internal servers or other resources that the server running this code can access. (This is called + server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction + with `SsrfFilter(...)`, or create an allowlist for approved hosts. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - rails + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html + - https://github.com/arkadiyt/ssrf_filter + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host + shortlink: https://sg.run/RX3g + semgrep.dev: + rule: + r_id: 14705 + rv_id: 1263668 + rule_id: zdUY0W + version_id: 6xT29BN + url: https://semgrep.dev/playground/r/6xT29BN/ruby.rails.security.injection.tainted-url-host.tainted-url-host + origin: community + mode: taint + pattern-sanitizers: + - pattern: SsrfFilter + pattern-sources: + - patterns: + - pattern-either: + - pattern: params + - pattern: request + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: '$URLSTR + + ' + - pattern-regex: \w+:\/\/#{.*} + - patterns: + - pattern-either: + - pattern: Kernel::sprintf("$URLSTR", ...) + - pattern: '"$URLSTR" + $EXPR + + ' + - pattern: '"$URLSTR" % $EXPR + + ' + - metavariable-pattern: + metavariable: $URLSTR + language: generic + pattern: $SCHEME:// ... +- id: scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode + patterns: + - pattern-inside: 'import pdi.jwt.$DEPS + + ... + + ' + - pattern-either: + - pattern: $JWT.encode($X, "...", ...) + - pattern: $JWT.decode($X, "...", ...) + - pattern: $JWT.decodeRawAll($X, "...", ...) + - pattern: $JWT.decodeRaw($X, "...", ...) + - pattern: $JWT.decodeAll($X, "...", ...) + - pattern: $JWT.validate($X, "...", ...) + - pattern: $JWT.isValid($X, "...", ...) + - pattern: $JWT.decodeJson($X, "...", ...) + - pattern: $JWT.decodeJsonAll($X, "...", ...) + - patterns: + - pattern-either: + - pattern: $JWT.encode($X, $KEY, ...) + - pattern: $JWT.decode($X, $KEY, ...) + - pattern: $JWT.decodeRawAll($X, $KEY, ...) + - pattern: $JWT.decodeRaw($X, $KEY, ...) + - pattern: $JWT.decodeAll($X, $KEY, ...) + - pattern: $JWT.validate($X, $KEY, ...) + - pattern: $JWT.isValid($X, $KEY, ...) + - pattern: $JWT.decodeJson($X, $KEY, ...) + - pattern: $JWT.decodeJsonAll($X, $KEY, ...) + - pattern: $JWT.encode($X, this.$KEY, ...) + - pattern: $JWT.decode($X, this.$KEY, ...) + - pattern: $JWT.decodeRawAll($X, this.$KEY, ...) + - pattern: $JWT.decodeRaw($X, this.$KEY, ...) + - pattern: $JWT.decodeAll($X, this.$KEY, ...) + - pattern: $JWT.validate($X, this.$KEY, ...) + - pattern: $JWT.isValid($X, this.$KEY, ...) + - pattern: $JWT.decodeJson($X, this.$KEY, ...) + - pattern: $JWT.decodeJsonAll($X, this.$KEY, ...) + - pattern-either: + - pattern-inside: "class $CL {\n ...\n $KEY = \"...\"\n ...\n}\n" + - pattern-inside: "object $CL {\n ...\n $KEY = \"...\"\n ...\n}\n" + - metavariable-pattern: + metavariable: $JWT + patterns: + - pattern-either: + - pattern: Jwt + - pattern: JwtArgonaut + - pattern: JwtCirce + - pattern: JwtJson4s + - pattern: JwtJson + - pattern: JwtUpickle + message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html + Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' + languages: + - scala + severity: WARNING + metadata: + references: + - https://jwt-scala.github.io/jwt-scala/ + category: security + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + technology: + - scala + confidence: HIGH + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode + shortlink: https://sg.run/8zE7 + semgrep.dev: + rule: + r_id: 19040 + rv_id: 1263669 + rule_id: WAUdK0 + version_id: o5TbDA8 + url: https://semgrep.dev/playground/r/o5TbDA8/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode + origin: community +- id: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled + patterns: + - pattern-either: + - pattern: '$DF = DocumentBuilderFactory.newInstance(...) + + ... + + $DB = $DF.newDocumentBuilder(...) + + ' + - patterns: + - pattern: $DB = DocumentBuilderFactory.newInstance(...) + - pattern-not-inside: '... + + $X = $DB.newDocumentBuilder(...) + + ' + - pattern: $DB = DocumentBuilderFactory.newInstance(...).newDocumentBuilder(...) + - pattern-not-inside: '... + + $DB.setXIncludeAware(true) + + ... + + $DB.setNamespaceAware(true) + + ... + + $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) + + ... + + $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) + + ... + + $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) + + ' + - pattern-not-inside: '... + + $DB.setXIncludeAware(true) + + ... + + $DB.setNamespaceAware(true) + + ... + + $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) + + ... + + $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) + + ... + + $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) + + ' + - pattern-not-inside: '... + + $DB.setXIncludeAware(true) + + ... + + $DB.setNamespaceAware(true) + + ... + + $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) + + ... + + $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) + + ... + + $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) + + ' + - pattern-not-inside: '... + + $DB.setXIncludeAware(true) + + ... + + $DB.setNamespaceAware(true) + + ... + + $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) + + ... + + $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) + + ... + + $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) + + ' + message: Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling + entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities + like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure + to disable entity processing functionality. + languages: + - scala + severity: WARNING + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html + category: security + technology: + - scala + confidence: HIGH + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled + shortlink: https://sg.run/gRQn + semgrep.dev: + rule: + r_id: 19041 + rv_id: 1263673 + rule_id: 0oUwzP + version_id: X0TzyRq + url: https://semgrep.dev/playground/r/X0TzyRq/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled + origin: community +- id: scala.lang.security.audit.io-source-ssrf.io-source-ssrf + patterns: + - pattern-either: + - pattern: Source.fromURL($URL,...) + - pattern: Source.fromURI($URL,...) + - pattern-inside: 'import scala.io.$SOURCE + + ... + + ' + - pattern-either: + - pattern-inside: "def $FUNC(..., $URL: $T, ...) = $A {\n ...\n}\n" + - pattern-inside: "def $FUNC(..., $URL: $T, ...) = {\n ...\n}\n" + message: A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send + data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers + or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist + for approved hosts, or hardcode the correct host. + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html + - https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource + category: security + technology: + - scala + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf + shortlink: https://sg.run/Qbz4 + semgrep.dev: + rule: + r_id: 18486 + rv_id: 1263675 + rule_id: GdUDOZ + version_id: 1QTypG9 + url: https://semgrep.dev/playground/r/1QTypG9/scala.lang.security.audit.io-source-ssrf.io-source-ssrf + origin: community + languages: + - scala + severity: WARNING +- id: scala.lang.security.audit.rsa-padding-set.rsa-padding-set + metadata: + cwe: + - 'CWE-780: Use of RSA Algorithm without OAEP' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + category: security + technology: + - scala + - cryptography + resources: + - https://blog.codacy.com/9-scala-security-issues/ + confidence: HIGH + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set + shortlink: https://sg.run/GO5p + semgrep.dev: + rule: + r_id: 15192 + rv_id: 1263677 + rule_id: 3qUj1Q + version_id: yeTxpoX + url: https://semgrep.dev/playground/r/yeTxpoX/scala.lang.security.audit.rsa-padding-set.rsa-padding-set + origin: community + message: Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive + data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead. + severity: WARNING + languages: + - scala + patterns: + - pattern: '$VAR = $CIPHER.getInstance($MODE) + + ' + - metavariable-regex: + metavariable: $MODE + regex: .*RSA/.*/NoPadding.* +- id: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled + patterns: + - pattern-either: + - pattern: $SR = new SAXReader(...) + - pattern: '$SF = SAXParserFactory.newInstance(...) + + ... + + $SR = $SF.newSAXParser(...) + + ' + - patterns: + - pattern: $SR = SAXParserFactory.newInstance(...) + - pattern-not-inside: '... + + $X = $SR.newSAXParser(...) + + ' + - pattern: $SR = SAXParserFactory.newInstance(...).newSAXParser(...) + - pattern: $SR = new SAXBuilder(...) + - pattern-not-inside: '... + + $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) + + ... + + $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) + + ... + + $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) + + ' + - pattern-not-inside: '... + + $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) + + ... + + $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) + + ... + + $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) + + ' + - pattern-not-inside: '... + + $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) + + ... + + $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) + + ... + + $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) + + ' + - pattern-not-inside: '... + + $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) + + ... + + $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) + + ... + + $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) + + ' + message: XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling + entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like + the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to + disable entity processing functionality. + languages: + - scala + severity: WARNING + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html + category: security + technology: + - scala + confidence: HIGH + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled + shortlink: https://sg.run/QbYP + semgrep.dev: + rule: + r_id: 19042 + rv_id: 1263678 + rule_id: KxUrkq + version_id: rxTAKWY + url: https://semgrep.dev/playground/r/rxTAKWY/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled + origin: community +- id: scala.lang.security.audit.scalac-debug.scalac-debug + patterns: + - pattern-either: + - pattern: scalacOptions ... "-Vdebug" + - pattern: scalacOptions ... "-Ydebug" + message: Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug + mode also affects performance and reliability. Remove it from configuration. + languages: + - generic + severity: WARNING + paths: + include: + - '*.sbt*' + metadata: + category: security + cwe: + - 'CWE-489: Active Debug Code' + owasp: A05:2021 - Security Misconfiguration + technology: + - scala + - sbt + references: + - https://docs.scala-lang.org/overviews/compiler-options/index.html + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Active Debug Code + source: https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug + shortlink: https://sg.run/QbGd + semgrep.dev: + rule: + r_id: 18686 + rv_id: 946569 + rule_id: JDUlE0 + version_id: qkT4j0N + url: https://semgrep.dev/playground/r/qkT4j0N/scala.lang.security.audit.scalac-debug.scalac-debug + origin: community +- id: scala.lang.security.audit.tainted-sql-string.tainted-sql-string + languages: + - scala + severity: ERROR + mode: taint + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using + prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of + SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements + (`connection.PreparedStatement`) or a safe library. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html + category: security + technology: + - scala + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/scala.lang.security.audit.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/ALD6 + semgrep.dev: + rule: + r_id: 20050 + rv_id: 1263682 + rule_id: WAUY8B + version_id: w8TRoO6 + url: https://semgrep.dev/playground/r/w8TRoO6/scala.lang.security.audit.tainted-sql-string.tainted-sql-string + origin: community + pattern-sources: + - patterns: + - pattern: $PARAM + - pattern-either: + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = $A {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = $A(...) {\n ...\n}\n" + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$SQLSTR" + ... + + ' + - pattern: '"$SQLSTR".format(...) + + ' + - patterns: + - pattern-inside: '$SB = new StringBuilder("$SQLSTR"); + + ... + + ' + - pattern: $SB.append(...) + - patterns: + - pattern-inside: '$VAR = "$SQLSTR" + + ... + + ' + - pattern: $VAR += ... + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(select|delete|insert|create|update|alter|drop)\b + - patterns: + - pattern-either: + - pattern: s"..." + - pattern: f"..." + - pattern-regex: '.*\b(?i)(select|delete|insert|create|update|alter|drop)\b.* + + ' + - pattern-not-inside: println(...) + - pattern-not-inside: throw new $EXCEPTION(...) + pattern-sanitizers: + - pattern-either: + - patterns: + - pattern-either: + - pattern: $LOGGER.$METHOD(...) + - pattern: $LOGGER(...) + - metavariable-regex: + metavariable: $LOGGER + regex: (i?)log.* + - patterns: + - pattern: $LOGGER.$METHOD(...) + - metavariable-regex: + metavariable: $METHOD + regex: (i?)(trace|info|warn|warning|warnToError|error|debug) +- id: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled + patterns: + - pattern-not-inside: '... + + $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false) + + ' + - pattern-either: + - pattern: $XMLFACTORY = XMLInputFactory.newFactory(...) + - pattern: $XMLFACTORY = XMLInputFactory.newInstance(...) + - pattern: $XMLFACTORY = new XMLInputFactory(...) + message: XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling + entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities + like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure + to disable entity processing functionality. + languages: + - scala + severity: WARNING + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html + category: security + technology: + - scala + confidence: HIGH + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled + shortlink: https://sg.run/3BEb + semgrep.dev: + rule: + r_id: 19043 + rv_id: 1263683 + rule_id: qNUQ7w + version_id: xyTjzkA + url: https://semgrep.dev/playground/r/xyTjzkA/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled + origin: community +- id: scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass + patterns: + - pattern-either: + - pattern: X-Requested-With = "*" + - pattern: Csrf-Token = "..." + - pattern-inside: 'bypassHeaders {... + + ... + + ...} + + ' + - pattern-not-inside: "{...\n ...\n ...blackList = [...\"application/x-www-form-urlencoded\"...\"multipart/form-data\"\ + ...\"text/plain\"...]\n ...\n...}\n" + - pattern-not-inside: "{...\n ...\n ...blackList = [...\"application/x-www-form-urlencoded\"...\"text/plain\"...\"multipart/form-data\"\ + ...]\n ...\n...}\n" + - pattern-not-inside: "{...\n ...\n ...blackList = [...\"multipart/form-data\"...\"application/x-www-form-urlencoded\"\ + ...\"text/plain\"...]\n ...\n...}\n" + - pattern-not-inside: "{...\n ...\n ...blackList = [...\"multipart/form-data\"...\"text/plain\"...\"application/x-www-form-urlencoded\"\ + ...]\n ...\n...}\n" + - pattern-not-inside: "{...\n ...\n ...blackList = [...\"text/plain\"...\"application/x-www-form-urlencoded\"...\"multipart/form-data\"\ + ...]\n ...\n...}\n" + - pattern-not-inside: "{...\n ...\n ...blackList = [...\"text/plain\"...\"multipart/form-data\"...\"application/x-www-form-urlencoded\"\ + ...]\n ...\n...}\n" + message: Possibly bypassable CSRF configuration found. CSRF is an attack that forces an end user to execute unwanted actions + on a web application in which they’re currently authenticated. Make sure that Content-Type black list is configured and + CORS filter is turned on. + languages: + - generic + severity: ERROR + paths: + include: + - '*.conf' + metadata: + references: + - https://www.playframework.com/documentation/2.8.x/Migration25#CSRF-changes + - https://owasp.org/www-community/attacks/csrf + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - scala + - play + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + source: https://semgrep.dev/r/scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass + shortlink: https://sg.run/4DEE + semgrep.dev: + rule: + r_id: 19044 + rv_id: 1263684 + rule_id: lBUyRR + version_id: O9Tpx53 + url: https://semgrep.dev/playground/r/O9Tpx53/scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass + origin: community +- id: scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings + patterns: + - pattern: secure = false + - pattern-inside: "session = {\n ...\n}\n" + message: Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting + the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file. + languages: + - generic + severity: WARNING + paths: + include: + - '*.conf' + metadata: + category: security + references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security + - https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration + technology: + - play + - scala + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + confidence: MEDIUM + subcategory: + - vuln + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings + shortlink: https://sg.run/8z8N + semgrep.dev: + rule: + r_id: 18284 + rv_id: 1263685 + rule_id: GdUDJO + version_id: e1TyjJv + url: https://semgrep.dev/playground/r/e1TyjJv/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings + origin: community +- id: scala.play.security.tainted-html-response.tainted-html-response + mode: taint + metadata: + category: security + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + technology: + - scala + - play + confidence: MEDIUM + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response + shortlink: https://sg.run/BG96 + semgrep.dev: + rule: + r_id: 18795 + rv_id: 1263686 + rule_id: 0oUwn2 + version_id: vdT06yj + url: https://semgrep.dev/playground/r/vdT06yj/scala.play.security.tainted-html-response.tainted-html-response + origin: community + message: Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template + environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. + Consider using a view technology such as Twirl which automatically escapes HTML views. + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern: $REQ + - pattern-either: + - pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n" + - pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n" + - pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n" + - pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n" + - patterns: + - pattern: $PARAM + - pattern-either: + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {\n ...\n}\n" + pattern-sanitizers: + - pattern-either: + - pattern: org.apache.commons.lang3.StringEscapeUtils.escapeHtml4(...) + - pattern: org.owasp.encoder.Encode.forHtml(...) + pattern-sinks: + - pattern-either: + - pattern: Html.apply(...) + - pattern: Ok(...).as(HTML) + - pattern: Ok(...).as(ContentTypes.HTML) + - patterns: + - pattern: Ok(...).as($CTYPE) + - metavariable-regex: + metavariable: $CTYPE + regex: '"[tT][eE][xX][tT]/[hH][tT][mM][lL]"' + - patterns: + - pattern: Ok(...).as($CTYPE) + - pattern-not: Ok(...).as("...") + - pattern-either: + - pattern-inside: "def $FUNC(..., $URL: $T, ...) = $A {\n ...\n}\n" + - pattern-inside: "def $FUNC(..., $URL: $T, ...) = {\n ...\n}\n" + severity: WARNING + languages: + - scala +- id: scala.play.security.tainted-slick-sqli.tainted-slick-sqli + mode: taint + metadata: + references: + - https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values + - https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code + category: security + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + technology: + - scala + - slick + - play + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli + shortlink: https://sg.run/k9K2 + semgrep.dev: + rule: + r_id: 18328 + rv_id: 1263687 + rule_id: GdUDWO + version_id: d6TyxJe + url: https://semgrep.dev/playground/r/d6TyxJe/scala.play.security.tainted-slick-sqli.tainted-slick-sqli + origin: community + message: Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly + sanitized. Avoid using using user input for generating SQL strings. + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern: $REQ + - pattern-either: + - pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n" + - pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n" + - pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n" + - pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n" + - patterns: + - pattern: $PARAM + - pattern-either: + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {\n ...\n}\n" + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $MODEL.overrideSql(...) + - pattern: sql"..." + - pattern-inside: 'import slick.$DEPS + + ... + + ' + severity: ERROR + languages: + - scala +- id: scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request + languages: + - scala + severity: ERROR + mode: taint + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using + prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of + SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements + (`connection.PreparedStatement`) or a safe library. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html + category: security + technology: + - scala + - play + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request + shortlink: https://sg.run/BeW9 + semgrep.dev: + rule: + r_id: 20051 + rv_id: 1263688 + rule_id: 0oUpon + version_id: ZRTKAoG + url: https://semgrep.dev/playground/r/ZRTKAoG/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request + origin: community + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern: $REQ + - pattern-either: + - pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n" + - pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n" + - pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n" + - pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n" + - patterns: + - pattern: $PARAM + - pattern-either: + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {\n ...\n}\n" + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$SQLSTR" + ... + + ' + - pattern: '"$SQLSTR".format(...) + + ' + - patterns: + - pattern-inside: '$SB = new StringBuilder("$SQLSTR"); + + ... + + ' + - pattern: $SB.append(...) + - patterns: + - pattern-inside: '$VAR = "$SQLSTR" + + ... + + ' + - pattern: $VAR += ... + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(select|delete|insert|create|update|alter|drop)\b + - patterns: + - pattern: s"..." + - pattern-regex: '.*\b(?i)(select|delete|insert|create|update|alter|drop)\b.* + + ' + - pattern-not-inside: println(...) +- id: scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret + languages: + - scala + message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html + Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' + metadata: + category: security + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + technology: + - jwt + confidence: HIGH + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + cwe2021-top25: true + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret + shortlink: https://sg.run/Z40o + semgrep.dev: + rule: + r_id: 15079 + rv_id: 1263691 + rule_id: OrU6W1 + version_id: 7ZTE3kr + url: https://semgrep.dev/playground/r/7ZTE3kr/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret + origin: community + pattern-either: + - pattern: 'com.auth0.jwt.algorithms.Algorithm.HMAC256("..."); + + ' + - pattern: '$SECRET = "..."; + + ... + + com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET); + + ' + - pattern: "class $CLASS {\n ...\n $DECL $SECRET = \"...\";\n ...\n def $FUNC (...): $RETURNTYPE = {\n ...\n com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET);\n\ + \ ...\n }\n ...\n}\n" + - pattern: 'com.auth0.jwt.algorithms.Algorithm.HMAC384("..."); + + ' + - pattern: '$SECRET = "..."; + + ... + + com.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET); + + ' + - pattern: "class $CLASS {\n ...\n $DECL $SECRET = \"...\";\n ...\n def $FUNC (...): $RETURNTYPE = {\n ...\n com.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET);\n\ + \ ...\n }\n ...\n}\n" + - pattern: 'com.auth0.jwt.algorithms.Algorithm.HMAC512("..."); + + ' + - pattern: '$SECRET = "..."; + + ... + + com.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET); + + ' + - pattern: "class $CLASS {\n ...\n $DECL $SECRET = \"...\";\n ...\n def $FUNC (...): $RETURNTYPE = {\n ...\n com.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET);\n\ + \ ...\n }\n ...\n}\n" + severity: ERROR +- id: solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx + languages: + - solidity + message: Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation + on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance + manipulation during self-transfers. + severity: ERROR + metadata: + category: security + technology: + - blockchain + - solidity + cwe: 'CWE-682: Incorrect Calculation' + subcategory: + - vuln + confidence: HIGH + likelihood: HIGH + impact: HIGH + owasp: + - A7:2021 Identification and Authentication Failures + references: + - https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities + - https://x.com/shoucccc/status/1757777764646859121 + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx + shortlink: https://sg.run/Or6X7 + semgrep.dev: + rule: + r_id: 133075 + rv_id: 946620 + rule_id: 6JUv7Nz + version_id: A8TJzYz + url: https://semgrep.dev/playground/r/A8TJzYz/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx + origin: community + patterns: + - pattern-either: + - pattern: '_balances[$FROM] = $FROM_BALANCE - value; + + ' + - pattern: '_balances[$TO] = $TO_BALANCE + value; + + ' + - pattern-not-inside: "if ($FROM != $TO) {\n ...\n _balances[$FROM] = $FROM_BALANCE - value;\n ...\n _balances[$TO]\ + \ = $TO_BALANCE + value;\n ...\n}\n" + - pattern-inside: "function _update(address $FROM, address $TO, uint256 value, bool mint) internal virtual {\n ...\n}\n" +- id: swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults + message: Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive + information. For data of a sensitive nature, applications should leverage the Keychain. + severity: WARNING + metadata: + likelihood: LOW + impact: HIGH + confidence: MEDIUM + category: security + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + masvs: + - 'MASVS-STORAGE-1: The app securely stores sensitive data' + owasp: + - A03:2017 - Sensitive Data Exposure + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + references: + - https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html + - https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/ + subcategory: + - vuln + technology: + - ios + - macos + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults + shortlink: https://sg.run/qvoO + semgrep.dev: + rule: + r_id: 66512 + rv_id: 1263696 + rule_id: KxUqoZ + version_id: 3ZT4Xy2 + url: https://semgrep.dev/playground/r/3ZT4Xy2/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults + origin: community + languages: + - swift + options: + symbolic_propagation: true + patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) + + ' + - metavariable-regex: + metavariable: $VALUE + regex: (?i).*(passcode|password|pass_word|passphrase|pass_code|pass_word|pass_phrase)$ + - focus-metavariable: $VALUE + - patterns: + - pattern-either: + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) + + ' + - metavariable-regex: + metavariable: $KEY + regex: (?i).*(passcode|password|pass_word|passphrase|pass_code|pass_word|pass_phrase)$ + - focus-metavariable: $KEY + - patterns: + - pattern-either: + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) + + ' + - metavariable-regex: + metavariable: $VALUE + regex: (?i).*(api_key|apikey)$ + - focus-metavariable: $VALUE + - patterns: + - pattern-either: + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) + + ' + - metavariable-regex: + metavariable: $KEY + regex: (?i).*(api_key|apikey)$ + - focus-metavariable: $KEY + - patterns: + - pattern-either: + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) + + ' + - metavariable-regex: + metavariable: $VALUE + regex: (?i).*(secretkey|secret_key|secrettoken|secret_token|clientsecret|client_secret)$ + - focus-metavariable: $VALUE + - patterns: + - pattern-either: + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) + + ' + - metavariable-regex: + metavariable: $KEY + regex: (?i).*(secretkey|secret_key|secrettoken|secret_token|clientsecret|client_secret)$ + - focus-metavariable: $KEY + - patterns: + - pattern-either: + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) + + ' + - metavariable-regex: + metavariable: $VALUE + regex: (?i).*(cryptkey|cryptokey|crypto_key|cryptionkey|symmetrickey|privatekey|symmetric_key|private_key)$ + - focus-metavariable: $VALUE + - patterns: + - pattern-either: + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") + + ' + - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) + + ' + - metavariable-regex: + metavariable: $KEY + regex: (?i).*(cryptkey|cryptokey|crypto_key|cryptionkey|symmetrickey|privatekey|symmetric_key|private_key)$ + - focus-metavariable: $KEY +- id: terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version + patterns: + - pattern: "resource \"aws_cloudfront_distribution\" $ANYTHING {\n ...\n viewer_certificate {\n ...\n }\n ...\n}\n" + - pattern-not-inside: "resource \"aws_cloudfront_distribution\" $ANYTHING {\n ...\n viewer_certificate {\n ...\n \ + \ minimum_protocol_version = \"TLSv1.2_2018\"\n ...\n }\n ...\n}\n" + - pattern-not-inside: "resource \"aws_cloudfront_distribution\" $ANYTHING {\n ...\n viewer_certificate {\n ...\n \ + \ minimum_protocol_version = \"TLSv1.2_2019\"\n ...\n }\n ...\n}\n" + - pattern-not-inside: "resource \"aws_cloudfront_distribution\" $ANYTHING {\n ...\n viewer_certificate {\n ...\n \ + \ minimum_protocol_version = \"TLSv1.2_2021\"\n ...\n }\n ...\n}\n" + - pattern-not-inside: "resource \"aws_cloudfront_distribution\" $ANYTHING {\n ...\n viewer_certificate {\n ...\n \ + \ minimum_protocol_version = \"TLSv1.2_2025\"\n ...\n }\n ...\n}\n" + - pattern-not-inside: "resource \"aws_cloudfront_distribution\" $ANYTHING {\n ...\n viewer_certificate {\n ...\n \ + \ minimum_protocol_version = \"TLSv1.3_2025\"\n ...\n }\n ...\n}\n" + message: Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered + insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `"TLSv1.2_2018", "TLSv1.2_2019", + "TLSv1.2_2021", "TLSv1.2_2025" or "TLSv1.3_2025"`. + metadata: + category: security + technology: + - terraform + - aws + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-326: Inadequate Encryption Strength' + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version + shortlink: https://sg.run/Q6o4 + semgrep.dev: + rule: + r_id: 17342 + rv_id: 1263700 + rule_id: kxU6A8 + version_id: 5PTo1bY + url: https://semgrep.dev/playground/r/5PTo1bY/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention + patterns: + - pattern: "resource \"aws_cloudwatch_log_group\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_cloudwatch_log_group\" $ANYTHING {\n ...\n retention_in_days = ...\n ...\n}\n" + message: The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event + information. + languages: + - hcl + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + cwe: + - 'CWE-320: CWE CATEGORY: Key Management Errors' + technology: + - aws + - terraform + category: security + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention + shortlink: https://sg.run/4lwl + semgrep.dev: + rule: + r_id: 17344 + rv_id: 946665 + rule_id: x8UGBG + version_id: BjT1N2B + url: https://semgrep.dev/playground/r/BjT1N2B/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention + origin: community +- id: terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted + patterns: + - pattern: "resource \"aws_codebuild_project\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_codebuild_project\" $ANYTHING {\n ...\n encryption_key = ...\n ...\n}\n" + message: The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create + your own, create a aws_kms_key resource or use the ARN string of a key in your account. + languages: + - hcl + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + cwe: + - 'CWE-320: CWE CATEGORY: Key Management Errors' + technology: + - aws + - terraform + category: security + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted + shortlink: https://sg.run/5yxA + semgrep.dev: + rule: + r_id: 17347 + rv_id: 946669 + rule_id: v8U4kG + version_id: K3TJbNr + url: https://semgrep.dev/playground/r/K3TJbNr/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted + origin: community +- id: terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions + pattern-either: + - pattern: "resource \"aws_config_configuration_aggregator\" $ANYTHING {\n ...\n account_aggregation_source {\n ...\n\ + \ regions = ...\n ...\n }\n ...\n}\n" + - pattern: "resource \"aws_config_configuration_aggregator\" $ANYTHING {\n ...\n organization_aggregation_source {\n \ + \ ...\n regions = ...\n ...\n }\n ...\n}\n" + message: The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration + in regions that are thought to be unused. Configure the aggregator with all_regions for the source. + languages: + - hcl + severity: WARNING + metadata: + category: security + technology: + - terraform + - aws + owasp: + - A09:2021 - Security Logging and Monitoring Failures + - A09:2025 - Security Logging & Alerting Failures + cwe: + - 'CWE-778: Insufficient Logging' + references: + - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/ + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insufficient Logging + source: https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions + shortlink: https://sg.run/O6A7 + semgrep.dev: + rule: + r_id: 47275 + rv_id: 1263703 + rule_id: DbUo7v + version_id: A8Tgdwv + url: https://semgrep.dev/playground/r/A8Tgdwv/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions + origin: community +- id: terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging + patterns: + - pattern: "resource \"aws_db_instance\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_db_instance\" $ANYTHING {\n ...\n enabled_cloudwatch_logs_exports = [$SOMETHING,\ + \ ...]\n ...\n}\n" + message: Database instance has no logging. Missing logs can cause missing important event information. + languages: + - hcl + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + technology: + - aws + - terraform + category: security + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + subcategory: + - vuln + likelihood: MEDIUM + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging + shortlink: https://sg.run/GyAp + semgrep.dev: + rule: + r_id: 17348 + rv_id: 1263704 + rule_id: d8U4RA + version_id: BjTkZ6j + url: https://semgrep.dev/playground/r/BjTkZ6j/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging + origin: community +- id: terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled + patterns: + - pattern: "resource \"aws_docdb_cluster\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_docdb_cluster\" $ANYTHING {\n ...\n enabled_cloudwatch_logs_exports = [..., \"audit\"\ + , ...]\n ...\n}\n" + message: Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB + cluster, you should enable auditing and export logs to CloudWatch. + languages: + - hcl + severity: INFO + metadata: + category: security + technology: + - terraform + - aws + owasp: + - A09:2021 - Security Logging and Monitoring Failures + - A09:2025 - Security Logging & Alerting Failures + cwe: + - 'CWE-778: Insufficient Logging' + references: + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports + - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/ + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insufficient Logging + source: https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled + shortlink: https://sg.run/xJYP + semgrep.dev: + rule: + r_id: 48630 + rv_id: 1263705 + rule_id: AbU1WN + version_id: DkTRbA4 + url: https://semgrep.dev/playground/r/DkTRbA4/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled + origin: community +- id: terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted + patterns: + - pattern: "resource \"aws_dynamodb_table\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_dynamodb_table\" $ANYTHING {\n ...\n server_side_encryption {\n enabled = true\n\ + \ kms_key_arn = ...\n }\n ...\n}\n" + message: By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended + to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key + resource or use the ARN of an existing key in your AWS account to do so. + languages: + - hcl + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-326: Inadequate Encryption Strength' + technology: + - aws + - terraform + category: security + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted + shortlink: https://sg.run/Ay4p + semgrep.dev: + rule: + r_id: 17350 + rv_id: 1263707 + rule_id: nJUGe2 + version_id: 0bTKzj8 + url: https://semgrep.dev/playground/r/0bTKzj8/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted + origin: community +- id: terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk + patterns: + - pattern: "resource \"aws_ebs_snapshot_copy\" $ANYTHING {\n ...\n encrypted = true\n ...\n}\n" + - pattern-not-inside: "resource \"aws_ebs_snapshot_copy\" $ANYTHING {\n ...\n encrypted = true\n kms_key_id = ...\n \ + \ ...\n}\n" + message: Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms + of access and rotation. + metadata: + category: security + technology: + - terraform + - aws + owasp: + - A03:2017 - Sensitive Data Exposure + cwe: + - 'CWE-320: CWE CATEGORY: Key Management Errors' + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk + shortlink: https://sg.run/ByPW + semgrep.dev: + rule: + r_id: 17351 + rv_id: 946677 + rule_id: EwUqko + version_id: A8TJzb0 + url: https://semgrep.dev/playground/r/A8TJzb0/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted + patterns: + - pattern: "resource \"aws_ebs_encryption_by_default\" $ANYTHING {\n ...\n enabled = false\n ...\n}\n" + message: The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS. + languages: + - hcl + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + cwe: + - 'CWE-320: CWE CATEGORY: Key Management Errors' + technology: + - aws + - terraform + category: security + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted + shortlink: https://sg.run/Dy5Y + semgrep.dev: + rule: + r_id: 17352 + rv_id: 946678 + rule_id: 7KUW7K + version_id: BjT1N2v + url: https://semgrep.dev/playground/r/BjT1N2v/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted + origin: community +- id: terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted + patterns: + - pattern: "resource \"aws_ebs_volume\" $ANYTHING {\n ...\n}\n" + - pattern-not: "resource \"aws_ebs_volume\" $ANYTHING {\n ...\n encrypted = true\n ...\n}\n" + message: The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. + Volumes should be encrypted to ensure sensitive data is stored securely. + languages: + - hcl + severity: WARNING + metadata: + category: security + technology: + - terraform + - aws + owasp: + - A03:2017 - Sensitive Data Exposure + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted + - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html + subcategory: + - audit + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted + shortlink: https://sg.run/6ZbY + semgrep.dev: + rule: + r_id: 50759 + rv_id: 1263708 + rule_id: YGUKl1 + version_id: K3TKk1Z + url: https://semgrep.dev/playground/r/K3TKk1Z/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted + origin: community +- id: terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip + patterns: + - pattern-either: + - pattern: "resource \"aws_instance\" $ANYTHING {\n ...\n associate_public_ip_address = true\n ...\n}\n" + - pattern: "resource \"aws_launch_template\" $ANYTHING {\n ...\n network_interfaces {\n ...\n associate_public_ip_address\ + \ = true\n ...\n }\n ...\n}\n" + message: EC2 instances should not have a public IP address attached in order to block public access to the instances. To + fix this, set your `associate_public_ip_address` to `"false"`. + metadata: + category: security + technology: + - terraform + - aws + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-1220: Insufficient Granularity of Access Control' + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip + shortlink: https://sg.run/08rv + semgrep.dev: + rule: + r_id: 17354 + rv_id: 1263709 + rule_id: 8GUA2n + version_id: qkTR73G + url: https://semgrep.dev/playground/r/qkTR73G/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled + patterns: + - pattern: "resource \"aws_launch_template\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_launch_template\" $ANYTHING {\n ...\n metadata_options {\n ...\n http_endpoint\ + \ = \"disabled\"\n ...\n }\n ...\n}\n" + - pattern-not-inside: "resource \"aws_launch_template\" $ANYTHING {\n ...\n metadata_options {\n ...\n http_tokens\ + \ = \"required\"\n ...\n }\n ...\n}\n" + message: The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication + tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2. + languages: + - hcl + severity: WARNING + metadata: + category: security + technology: + - terraform + - aws + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe: + - 'CWE-1390: Weak Authentication' + references: + - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options + - https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service + subcategory: + - audit + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled + shortlink: https://sg.run/pg9J + semgrep.dev: + rule: + r_id: 50762 + rv_id: 1263712 + rule_id: zdU0Wo + version_id: JdTzx88 + url: https://semgrep.dev/playground/r/JdTzx88/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled + origin: community +- id: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags + patterns: + - pattern: "resource \"aws_ecr_repository\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_ecr_repository\" $ANYTHING {\n ...\n image_tag_mutability = \"IMMUTABLE\"\n ...\n\ + }\n" + message: The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should + be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` + to IMMUTABLE. + languages: + - hcl + severity: WARNING + metadata: + category: security + technology: + - terraform + - aws + owasp: + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-345: Insufficient Verification of Data Authenticity' + references: + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability + - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/ + subcategory: + - audit + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags + shortlink: https://sg.run/ZEeL + semgrep.dev: + rule: + r_id: 48635 + rv_id: 1263716 + rule_id: KxUB4o + version_id: A8Tgdwd + url: https://semgrep.dev/playground/r/A8Tgdwd/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags + origin: community +- id: terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal + patterns: + - pattern-inside: "resource \"aws_ecr_repository_policy\" $ANYTHING {\n ...\n}\n" + - pattern-either: + - patterns: + - pattern: policy = "$JSONPOLICY" + - metavariable-pattern: + metavariable: $JSONPOLICY + language: json + patterns: + - pattern-not-inside: '{..., "Effect": "Deny", ...} + + ' + - pattern-either: + - pattern: '{..., "Principal": "*", ...} + + ' + - pattern: '{..., "Principal": [..., "*", ...], ...} + + ' + - pattern: '{..., "Principal": { "AWS": "*" }, ...} + + ' + - pattern: '{..., "Principal": { "AWS": [..., "*", ...] }, ...} + + ' + - patterns: + - pattern-inside: policy = jsonencode(...) + - pattern-not-inside: '{..., Effect = "Deny", ...} + + ' + - pattern-either: + - pattern: '{..., Principal = "*", ...} + + ' + - pattern: '{..., Principal = [..., "*", ...], ...} + + ' + - pattern: '{..., Principal = { AWS = "*" }, ...} + + ' + - pattern: '{..., Principal = { AWS = [..., "*", ...] }, ...} + + ' + message: Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including + anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least + privilege. + metadata: + category: security + technology: + - aws + - terraform + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + references: + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy + - https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html + - https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html + - https://cwe.mitre.org/data/definitions/732.html + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal + shortlink: https://sg.run/nzqb + semgrep.dev: + rule: + r_id: 48636 + rv_id: 1263717 + rule_id: qNUzov + version_id: BjTkZ6A + url: https://semgrep.dev/playground/r/BjTkZ6A/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk + patterns: + - pattern: "resource \"aws_efs_file_system\" $ANYTHING {\n ...\n encrypted = true\n ...\n}\n" + - pattern-not-inside: "resource \"aws_efs_file_system\" $ANYTHING {\n ...\n encrypted = true\n kms_key_id = ...\n ...\n\ + }\n" + message: Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms + of access and rotation. + metadata: + category: security + technology: + - terraform + - aws + owasp: + - A03:2017 - Sensitive Data Exposure + cwe: + - 'CWE-320: CWE CATEGORY: Key Management Errors' + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk + shortlink: https://sg.run/Kk07 + semgrep.dev: + rule: + r_id: 17355 + rv_id: 946690 + rule_id: gxUJ4n + version_id: 2KTYbWy + url: https://semgrep.dev/playground/r/2KTYbWy/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version + pattern: "resource \"aws_elasticsearch_domain\" $ANYTHING {\n ...\n domain_endpoint_options {\n ...\n enforce_https\ + \ = true\n tls_security_policy = \"Policy-Min-TLS-1-0-2019-07\"\n ...\n }\n ...\n}\n" + message: Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set "tls_security_policy" equal + to "Policy-Min-TLS-1-2-2019-07". + languages: + - terraform + severity: WARNING + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + category: security + technology: + - aws + - terraform + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version + shortlink: https://sg.run/PYlq + semgrep.dev: + rule: + r_id: 19045 + rv_id: 1263718 + rule_id: YGUle7 + version_id: DkTRbA5 + url: https://semgrep.dev/playground/r/DkTRbA5/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version + origin: community +- id: terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled + patterns: + - pattern-either: + - pattern: "resource \"aws_elasticsearch_domain\" $ANYTHING {\n ...\n node_to_node_encryption {\n ...\n enabled\ + \ = false\n ...\n }\n ...\n}\n" + - pattern: "resource \"aws_elasticsearch_domain\" $ANYTHING {\n ...\n cluster_config {\n ...\n instance_count\ + \ = $COUNT\n ...\n }\n}\n" + - pattern-not-inside: "resource \"aws_elasticsearch_domain\" $ANYTHING {\n ...\n cluster_config {\n ...\n instance_count\ + \ = $COUNT\n ...\n }\n node_to_node_encryption {\n ...\n enabled = true\n ...\n }\n}\n" + - metavariable-comparison: + metavariable: $COUNT + comparison: $COUNT > 1 + message: "Ensure all Elasticsearch has node-to-node encryption enabled.\t" + metadata: + category: security + technology: + - terraform + - aws + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-326: Inadequate Encryption Strength' + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled + shortlink: https://sg.run/lp3y + semgrep.dev: + rule: + r_id: 17357 + rv_id: 1263719 + rule_id: 3qU6J7 + version_id: WrTqK0v + url: https://semgrep.dev/playground/r/WrTqK0v/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal + patterns: + - pattern-inside: "resource \"aws_glacier_vault\" $ANYTHING {\n ...\n}\n" + - pattern: access_policy = "$STATEMENT" + - metavariable-pattern: + metavariable: $STATEMENT + language: json + patterns: + - pattern-inside: '{..., "Effect": "Allow", ...} + + ' + - pattern-either: + - pattern: '"Principal": "*" + + ' + - pattern: '"Principal": {..., "AWS": "*", ...} + + ' + - pattern-inside: '"Principal": {..., "AWS": ..., ...} + + ' + - pattern-regex: '(^\"arn:aws:iam::\*:(.*)\"$) + + ' + message: 'Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions + on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam:::`.' + metadata: + category: security + technology: + - aws + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + references: + - https://cwe.mitre.org/data/definitions/732.html + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal + shortlink: https://sg.run/XN9K + semgrep.dev: + rule: + r_id: 17364 + rv_id: 1263723 + rule_id: AbUeYK + version_id: l4TJRGB + url: https://semgrep.dev/playground/r/l4TJRGB/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal + origin: community + languages: + - hcl + severity: ERROR +- id: terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin + patterns: + - pattern-inside: "resource \"aws_ssoadmin_permission_set_inline_policy\" $ANYTHING {\n ...\n}\n" + - pattern: inline_policy = "$STATEMENT" + - metavariable-pattern: + metavariable: $STATEMENT + language: json + patterns: + - pattern-not-inside: '{..., "Effect": "Deny", ...} + + ' + - pattern-either: + - pattern: '{..., "Action": [..., "*", ...], "Resource": [..., "*", ...], ...} + + ' + - pattern: '{..., "Action": "*", "Resource": "*", ...} + + ' + - pattern: '{..., "Action": "*", "Resource": [...], ...} + + ' + - pattern: '{..., "Action": [...], "Resource": "*", ...} + + ' + message: Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. + Instead, limit actions and resources to what you need according to least privilege. + metadata: + category: security + technology: + - aws + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + references: + - https://cwe.mitre.org/data/definitions/732.html + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin + shortlink: https://sg.run/jzgY + semgrep.dev: + rule: + r_id: 17365 + rv_id: 1263724 + rule_id: BYUzY5 + version_id: YDTZe9q + url: https://semgrep.dev/playground/r/YDTZe9q/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin + origin: community + languages: + - hcl + severity: ERROR +- id: terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy + patterns: + - pattern-inside: "resource \"aws_iam_policy\" $ANYTHING {\n ...\n}\n" + - pattern: policy = "$STATEMENT" + - metavariable-pattern: + metavariable: $STATEMENT + language: json + patterns: + - pattern-not-inside: '{..., "Effect": "Deny", ...} + + ' + - pattern-either: + - pattern: '{..., "Action": [..., "*", ...], "Resource": [..., "*", ...], ...} + + ' + - pattern: '{..., "Action": "*", "Resource": "*", ...} + + ' + - pattern: '{..., "Action": "*", "Resource": [...], ...} + + ' + - pattern: '{..., "Action": [...], "Resource": "*", ...} + + ' + message: Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. + Instead, limit actions and resources to what you need according to least privilege. + metadata: + category: security + technology: + - aws + - terraform + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + references: + - https://cwe.mitre.org/data/definitions/732.html + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy + shortlink: https://sg.run/1zbw + semgrep.dev: + rule: + r_id: 17366 + rv_id: 1263725 + rule_id: DbUx8l + version_id: 6xT29Pv + url: https://semgrep.dev/playground/r/6xT29Pv/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy + origin: community + languages: + - hcl + severity: ERROR +- id: terraform.aws.security.aws-insecure-api-gateway-tls-version.aws-insecure-api-gateway-tls-version + patterns: + - pattern-either: + - pattern: "resource \"aws_api_gateway_domain_name\" $ANYTHING {\n ...\n security_policy = \"...\"\n ...\n}\n" + - pattern: "resource \"aws_apigatewayv2_domain_name\" $ANYTHING {\n ...\n domain_name_configuration {...}\n ...\n\ + }\n" + - pattern-not: "resource \"aws_api_gateway_domain_name\" $ANYTHING {\n ...\n security_policy = \"TLS_1_2\"\ + \n ...\n }\n" + - pattern-not: "resource \"aws_apigatewayv2_domain_name\" $ANYTHING {\n ...\n domain_name_configuration {\n\ + \ ...\n security_policy = \"TLS_1_2\"\n ...\n }\n }\n" + message: Detected AWS API Gateway to be using an insecure version of TLS. To fix this issue make sure to set "security_policy" + equal to "TLS_1_2". + languages: + - terraform + severity: WARNING + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + category: security + technology: + - aws + - terraform + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-insecure-api-gateway-tls-version.aws-insecure-api-gateway-tls-version + shortlink: https://sg.run/p98J + semgrep.dev: + rule: + r_id: 18818 + rv_id: 1263726 + rule_id: v8UOle + version_id: o5TbD8k + url: https://semgrep.dev/playground/r/o5TbD8k/terraform.aws.security.aws-insecure-api-gateway-tls-version.aws-insecure-api-gateway-tls-version + origin: community +- id: terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration + patterns: + - pattern: "resource \"aws_redshift_parameter_group\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_redshift_parameter_group\" $ANYTHING {\n ...\n parameter {\n name = \"require_ssl\"\ + \n value = \"true\"\n }\n ...\n}\n" + - pattern-not-inside: "resource \"aws_redshift_parameter_group\" $ANYTHING {\n ...\n parameter {\n name = \"require_ssl\"\ + \n value = true\n }\n ...\n}\n" + message: Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `"true"`. + metadata: + category: security + technology: + - terraform + - aws + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-326: Inadequate Encryption Strength' + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration + shortlink: https://sg.run/yPYx + semgrep.dev: + rule: + r_id: 17368 + rv_id: 1263727 + rule_id: 0oUrOj + version_id: zyTb27A + url: https://semgrep.dev/playground/r/zyTb27A/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted + patterns: + - pattern: "resource \"aws_kinesis_stream\" $ANYTHING {\n ...\n}\n" + - pattern-not: "resource \"aws_kinesis_stream\" $ANYTHING {\n ...\n encryption_type = \"KMS\"\n ...\n}\n" + message: The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer + is compromised. Enable Kinesis stream server-side encryption. + languages: + - hcl + severity: WARNING + metadata: + category: security + technology: + - terraform + - aws + owasp: + - A03:2017 - Sensitive Data Exposure + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + references: + - https://owasp.org/Top10/A04_2021-Insecure_Design + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type + - https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html + subcategory: + - audit + likelihood: LOW + impact: HIGH + confidence: MEDIUM + rule-origin-note: published from /src/aws-kinesis-stream-unencrypted.yml in None + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted + shortlink: https://sg.run/KZ0L + semgrep.dev: + rule: + r_id: 52199 + rv_id: 1263728 + rule_id: 8GU72N + version_id: pZT037O + url: https://semgrep.dev/playground/r/pZT037O/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted + origin: community +- id: terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal + patterns: + - pattern-inside: "resource \"aws_kms_key\" $ANYTHING {\n ...\n}\n" + - pattern: policy = "$STATEMENT" + - metavariable-pattern: + metavariable: $STATEMENT + language: json + patterns: + - pattern-not-inside: '{..., "Effect": "Deny", ...} + + ' + - pattern-either: + - pattern: '{..., "Principal": "*", "Action": "kms:*", "Resource": "*", ...} + + ' + - pattern: '{..., "Principal": [..., "*", ...], "Action": "kms:*", "Resource": "*", ...} + + ' + - pattern: '{..., "Principal": { "AWS": "*" }, "Action": "kms:*", "Resource": "*", ...} + + ' + - pattern: '{..., "Principal": { "AWS": [..., "*", ...] }, "Action": "kms:*", "Resource": "*", ...} + + ' + message: Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative + actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege. + metadata: + category: security + technology: + - aws + - terraform + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + references: + - https://cwe.mitre.org/data/definitions/732.html + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal + shortlink: https://sg.run/Nwlp + semgrep.dev: + rule: + r_id: 17371 + rv_id: 1263729 + rule_id: lBUWPD + version_id: 2KTv2J4 + url: https://semgrep.dev/playground/r/2KTv2J4/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal + origin: community + languages: + - hcl + severity: ERROR +- id: terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation + patterns: + - pattern-either: + - pattern: "resource \"aws_kms_key\" $ANYTHING {\n ...\n enable_key_rotation = false\n ...\n}\n" + - pattern: "resource \"aws_kms_key\" $ANYTHING {\n ...\n customer_master_key_spec = \"SYMMETRIC_DEFAULT\"\n enable_key_rotation\ + \ = false\n ...\n}\n" + - pattern: "resource \"aws_kms_key\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_kms_key\" $ANYTHING {\n ...\n enable_key_rotation = true\n ...\n}\n" + - pattern-not-inside: "resource \"aws_kms_key\" $ANYTHING {\n ...\n customer_master_key_spec = \"RSA_2096\"\n ...\n}\n" + message: The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a + `enable_key_rotation`. + languages: + - hcl + severity: WARNING + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-326: Inadequate Encryption Strength' + technology: + - aws + - terraform + category: security + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation + shortlink: https://sg.run/kz47 + semgrep.dev: + rule: + r_id: 17372 + rv_id: 1263730 + rule_id: PeU0L3 + version_id: X0Tzy67 + url: https://semgrep.dev/playground/r/X0Tzy67/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation + origin: community +- id: terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials + patterns: + - pattern-inside: "resource \"$ANYTING\" $ANYTHING {\n ...\n environment {\n variables = {\n ...\n }\n }\n\ + \ ...\n}\n" + - pattern-either: + - pattern-inside: 'AWS_ACCESS_KEY_ID = "$Y" + + ' + - pattern-regex: '(?:root`.' + metadata: + cwe: + - 'CWE-250: Execution with Unnecessary Privileges' + category: security + technology: + - aws + references: + - https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ + owasp: + - A06:2017 - Security Misconfiguration + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role + shortlink: https://sg.run/LXWr + semgrep.dev: + rule: + r_id: 15139 + rv_id: 1263749 + rule_id: 5rUL1P + version_id: LjTkg8D + url: https://semgrep.dev/playground/r/LjTkg8D/terraform.aws.security.wildcard-assume-role.wildcard-assume-role + origin: community + languages: + - hcl + severity: ERROR +- id: terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled + message: Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` + block needs to be filled out with the appropriate auth backend settings + patterns: + - pattern: resource + - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n auth_settings {\n ...\n enabled = true\n\ + \ ...\n }\n...\n}\n" + - pattern-either: + - pattern-inside: 'resource "azurerm_app_service" "..." { + + ... + + } + + ' + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n auth_settings {\n ...\n enabled = false\n\ + \ ...\n }\n...\n}\n" + metadata: + cwe: + - 'CWE-287: Improper Authentication' + category: security + technology: + - terraform + - azure + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings + owasp: + - A02:2017 - Broken Authentication + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled + shortlink: https://sg.run/JxYw + semgrep.dev: + rule: + r_id: 15102 + rv_id: 1263755 + rule_id: 0oU23p + version_id: PkTR3P8 + url: https://semgrep.dev/playground/r/PkTR3P8/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled + origin: community + languages: + - hcl + severity: ERROR +- id: terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2 + message: Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to + your appservice resource block + patterns: + - pattern: resource + - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n site_config {\n ...\n http2_enabled = true\n\ + \ ...\n }\n...\n}\n" + - pattern-either: + - pattern-inside: 'resource "azurerm_app_service" "..." { + + ... + + } + + ' + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n site_config {\n ...\n http2_enabled = false\n\ + \ ...\n }\n...\n}\n" + metadata: + cwe: + - 'CWE-444: Inconsistent Interpretation of HTTP Requests (''HTTP Request/Response Smuggling'')' + category: security + technology: + - terraform + - azure + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2 + shortlink: https://sg.run/5DkA + semgrep.dev: + rule: + r_id: 15103 + rv_id: 1263756 + rule_id: KxU7LJ + version_id: JdTzx98 + url: https://semgrep.dev/playground/r/JdTzx98/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2 + origin: community + languages: + - hcl + severity: INFO +- id: terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only + message: By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the + HTTPS Only setting. + patterns: + - pattern: resource + - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n https_only = true\n...\n}\n" + - pattern-either: + - pattern-inside: 'resource "azurerm_app_service" "..." { + + ... + + } + + ' + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n https_only = false\n...\n}\n" + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + category: security + technology: + - terraform + - azure + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only + - https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only + shortlink: https://sg.run/GOKp + semgrep.dev: + rule: + r_id: 15104 + rv_id: 1263757 + rule_id: qNUXwx + version_id: 5PTo1gg + url: https://semgrep.dev/playground/r/5PTo1gg/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only + origin: community + languages: + - hcl + severity: ERROR +- id: terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert + message: Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in + your resource block. + patterns: + - pattern: resource + - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n client_cert_enabled = true\n...\n}\n" + - pattern-either: + - pattern-inside: 'resource "azurerm_app_service" "..." { + + ... + + } + + ' + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n client_cert_enabled = false\n...\n}\n" + metadata: + cwe: + - 'CWE-295: Improper Certificate Validation' + category: security + technology: + - terraform + - azure + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled + owasp: + - A03:2017 - Sensitive Data Exposure + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert + shortlink: https://sg.run/RX1O + semgrep.dev: + rule: + r_id: 15105 + rv_id: 1263758 + rule_id: lBU8D6 + version_id: GxTkedE + url: https://semgrep.dev/playground/r/GxTkedE/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert + origin: community + languages: + - hcl + severity: INFO +- id: terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy + message: Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = "1.2"` in your + resource block. + patterns: + - pattern: min_tls_version = $ANYTHING + - pattern-inside: "resource \"azurerm_app_service\" \"$NAME\" {\n ...\n}\n" + - pattern-not-inside: min_tls_version = "1.2" + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + category: security + technology: + - terraform + - azure + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy + shortlink: https://sg.run/AXRp + semgrep.dev: + rule: + r_id: 15106 + rv_id: 1263759 + rule_id: YGUDbZ + version_id: RGT0L4x + url: https://semgrep.dev/playground/r/RGT0L4x/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy + origin: community + languages: + - hcl + severity: ERROR +- id: terraform.azure.security.appservice.azure-appservice-detailed-errormessages-enabled.azure-appservice-detailed-errormessages-enabled + message: Ensure that App service enables detailed error messages + patterns: + - pattern: resource + - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\nlogs {\n ...\n detailed_error_messages_enabled\ + \ = true\n ...\n}\n...\n}\n" + - pattern-inside: 'resource "azurerm_app_service" "..." { + + ... + + } + + ' + metadata: + owasp: + - A10:2017 - Insufficient Logging & Monitoring + - A09:2021 - Security Logging and Monitoring Failures + - A09:2025 - Security Logging & Alerting Failures + cwe: + - 'CWE-778: Insufficient Logging' + category: security + technology: + - terraform + - azure + references: + - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insufficient Logging + source: https://semgrep.dev/r/terraform.azure.security.appservice.azure-appservice-detailed-errormessages-enabled.azure-appservice-detailed-errormessages-enabled + shortlink: https://sg.run/pA1g + semgrep.dev: + rule: + r_id: 23962 + rv_id: 1263762 + rule_id: bwU1Eg + version_id: DkTRbr5 + url: https://semgrep.dev/playground/r/DkTRbr5/terraform.azure.security.appservice.azure-appservice-detailed-errormessages-enabled.azure-appservice-detailed-errormessages-enabled + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.azure.security.appservice.azure-appservice-https-only.azure-appservice-https-only + message: Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot + patterns: + - pattern: resource + - pattern-not-inside: 'resource "azurerm_app_service" "..." { + + ... + + https_only = true + + ... + + } + + ' + - pattern-inside: 'resource "azurerm_app_service" "..." { + + ... + + } + + ' + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + category: security + technology: + - terraform + - azure + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/terraform.azure.security.appservice.azure-appservice-https-only.azure-appservice-https-only + shortlink: https://sg.run/1g9w + semgrep.dev: + rule: + r_id: 23966 + rv_id: 1263766 + rule_id: x8UZRP + version_id: qkTR78q + url: https://semgrep.dev/playground/r/qkTR78q/terraform.azure.security.appservice.azure-appservice-https-only.azure-appservice-https-only + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.azure.security.appservice.azure-appservice-min-tls-version.azure-appservice-min-tls-version + message: Ensure web app is using the latest version of TLS encryption + patterns: + - pattern-either: + - pattern: '"1.0" + + ' + - pattern: '"1.1" + + ' + - pattern-inside: min_tls_version = ... + - pattern-inside: '$RESOURCE "azurerm_app_service" "..." { + + ... + + } + + ' + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-326: Inadequate Encryption Strength' + category: security + technology: + - terraform + - azure + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.azure.security.appservice.azure-appservice-min-tls-version.azure-appservice-min-tls-version + shortlink: https://sg.run/rDwn + semgrep.dev: + rule: + r_id: 23969 + rv_id: 1263769 + rule_id: v8UNL7 + version_id: 6xT29gv + url: https://semgrep.dev/playground/r/6xT29gv/terraform.azure.security.appservice.azure-appservice-min-tls-version.azure-appservice-min-tls-version + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.azure.security.azure-key-no-expiration-date.azure-key-no-expiration-date + message: Ensure that the expiration date is set on all keys + patterns: + - pattern: resource + - pattern-not-inside: 'resource "azurerm_key_vault_key" "..." { + + ... + + expiration_date = "..." + + ... + + } + + ' + - pattern-inside: 'resource "azurerm_key_vault_key" "..." { + + ... + + } + + ' + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + cwe: + - 'CWE-320: CWE CATEGORY: Key Management Errors' + category: security + technology: + - terraform + - azure + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.azure.security.azure-key-no-expiration-date.azure-key-no-expiration-date + shortlink: https://sg.run/J1vw + semgrep.dev: + rule: + r_id: 23990 + rv_id: 946834 + rule_id: 0oUlgp + version_id: pZTNGkl + url: https://semgrep.dev/playground/r/pZTNGkl/terraform.azure.security.azure-key-no-expiration-date.azure-key-no-expiration-date + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.azure.security.azure-mssql-service-mintls-version.azure-mssql-service-mintls-version + message: Ensure MSSQL is using the latest version of TLS encryption + patterns: + - pattern-either: + - pattern: '"1.0" + + ' + - pattern: '"1.1" + + ' + - pattern-inside: minimum_tls_version = ... + - pattern-inside: '$RESOURCE "azurerm_mssql_server" "..." { + + ... + + } + + ' + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-326: Inadequate Encryption Strength' + category: security + technology: + - terraform + - azure + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.azure.security.azure-mssql-service-mintls-version.azure-mssql-service-mintls-version + shortlink: https://sg.run/B1lW + semgrep.dev: + rule: + r_id: 23995 + rv_id: 1263784 + rule_id: 6JUJG8 + version_id: xyTjzeR + url: https://semgrep.dev/playground/r/xyTjzeR/terraform.azure.security.azure-mssql-service-mintls-version.azure-mssql-service-mintls-version + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.azure.security.azure-mysql-encryption-enabled.azure-mysql-encryption-enabled + message: Ensure that MySQL server enables infrastructure encryption + patterns: + - pattern: resource + - pattern-inside: 'resource "azurerm_mysql_server" "..." { + + ... + + } + + ' + - pattern-not-inside: 'resource "azurerm_mysql_server" "..." { + + ... + + infrastructure_encryption_enabled = true + + ... + + } + + ' + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + cwe: + - 'CWE-320: CWE CATEGORY: Key Management Errors' + category: security + technology: + - terraform + - azure + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.azure.security.azure-mysql-encryption-enabled.azure-mysql-encryption-enabled + shortlink: https://sg.run/Dd6Y + semgrep.dev: + rule: + r_id: 23996 + rv_id: 946840 + rule_id: oqUloL + version_id: yeT0vBn + url: https://semgrep.dev/playground/r/yeT0vBn/terraform.azure.security.azure-mysql-encryption-enabled.azure-mysql-encryption-enabled + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.azure.security.azure-mysql-mintls-version.azure-mysql-mintls-version + message: Ensure MySQL is using the latest version of TLS encryption + patterns: + - pattern-either: + - pattern: '"TLS1_0" + + ' + - pattern: '"TLS1_1" + + ' + - pattern-inside: ssl_minimal_tls_version_enforced = ... + - pattern-inside: '$RESOURCE "azurerm_mysql_server" "..." { + + ... + + } + + ' + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-326: Inadequate Encryption Strength' + category: security + technology: + - terraform + - azure + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.azure.security.azure-mysql-mintls-version.azure-mysql-mintls-version + shortlink: https://sg.run/WR44 + semgrep.dev: + rule: + r_id: 23997 + rv_id: 1263785 + rule_id: zdU8NN + version_id: O9TpxWE + url: https://semgrep.dev/playground/r/O9TpxWE/terraform.azure.security.azure-mysql-mintls-version.azure-mysql-mintls-version + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.azure.security.storage.storage-enforce-https.storage-enforce-https + message: Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in + your resource block. + patterns: + - pattern-not-inside: "resource \"azurerm_storage_account\" \"...\" {\n...\n enable_https_traffic_only = true\n...\n}\n" + - pattern-inside: "resource \"azurerm_storage_account\" \"...\" {\n...\n enable_https_traffic_only = false\n...\n}\n" + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + category: security + technology: + - terraform + - azure + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only + - https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https + shortlink: https://sg.run/0y9v + semgrep.dev: + rule: + r_id: 15110 + rv_id: 1263805 + rule_id: pKUpDA + version_id: BjTkZ0A + url: https://semgrep.dev/playground/r/BjTkZ0A/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy + message: 'Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS + 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will + warn if the minimum TLS is not set to TLS1_2.' + patterns: + - pattern-either: + - pattern-inside: "resource \"azurerm_storage_account\" \"...\" {\n ...\n min_tls_version = \"$ANYTHING\"\n ...\n}\n" + - pattern-inside: "resource \"azurerm_storage_account\" \"...\" {\n ...\n}\n" + - pattern-not-inside: "resource \"azurerm_storage_account\" \"...\" {\n ...\n min_tls_version = \"TLS1_2\"\n ...\n}\n" + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + category: security + technology: + - terraform + - azure + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version + - https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy + shortlink: https://sg.run/KXD7 + semgrep.dev: + rule: + r_id: 15155 + rv_id: 1263807 + rule_id: AbUQdL + version_id: WrTqKpv + url: https://semgrep.dev/playground/r/WrTqKpv/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy + origin: community + languages: + - hcl + severity: ERROR +- id: terraform.gcp.security.gcp-cloud-storage-logging.gcp-cloud-storage-logging + patterns: + - pattern: "resource \"google_storage_bucket\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"google_storage_bucket\" $ANYTHING {\n ...\n logging {\n log_bucket = ...\n } \ + \ \n ...\n}\n" + message: Ensure bucket logs access. + languages: + - hcl + severity: WARNING + metadata: + owasp: + - A10:2017 - Insufficient Logging & Monitoring + - A09:2021 - Security Logging and Monitoring Failures + - A09:2025 - Security Logging & Alerting Failures + cwe: + - 'CWE-778: Insufficient Logging' + technology: + - terraform + - gcp + category: security + references: + - https://docs.bridgecrew.io/docs/google-cloud-policy-index + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insufficient Logging + source: https://semgrep.dev/r/terraform.gcp.security.gcp-cloud-storage-logging.gcp-cloud-storage-logging + shortlink: https://sg.run/5g5D + semgrep.dev: + rule: + r_id: 32303 + rv_id: 1263813 + rule_id: gxUrdg + version_id: JdTzxRN + url: https://semgrep.dev/playground/r/JdTzxRN/terraform.gcp.security.gcp-cloud-storage-logging.gcp-cloud-storage-logging + origin: community +- id: terraform.gcp.security.gcp-dns-key-specs-rsasha1.gcp-dns-key-specs-rsasha1 + patterns: + - pattern: resource + - pattern-inside: "resource \"google_dns_managed_zone\" \"...\" {\n...\ndnssec_config {\n ...\n default_key_specs\ + \ {\n ...\n algorithm = \"rsasha1\"\n key_type = \"zoneSigning\"\n ...\n }\n ...\n\ + }\n...\n}\n" + - pattern-inside: "resource \"google_dns_managed_zone\" \"...\" {\n...\ndnssec_config {\n ...\n default_key_specs\ + \ {\n ...\n algorithm = \"rsasha1\"\n key_type = \"keySigning\"\n ...\n }\n ...\n\ + }\n...\n}\n" + message: "Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC\t" + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-326: Inadequate Encryption Strength' + category: security + technology: + - terraform + - gcp + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.gcp.security.gcp-dns-key-specs-rsasha1.gcp-dns-key-specs-rsasha1 + shortlink: https://sg.run/bKKW + semgrep.dev: + rule: + r_id: 33670 + rv_id: 1263837 + rule_id: 7KUZZb + version_id: bZT53oD + url: https://semgrep.dev/playground/r/bZT53oD/terraform.gcp.security.gcp-dns-key-specs-rsasha1.gcp-dns-key-specs-rsasha1 + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.gcp.security.gcp-sql-database-require-ssl.gcp-sql-database-require-ssl + patterns: + - pattern: resource + - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n}\n" + - pattern-not-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n\ + \ require_ssl = true\n ...\n }\n ...\n}\n" + - pattern-not-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n\ + \ ssl_mode = ...\n ...\n }\n ...\n}\n" + message: Ensure all Cloud SQL database instance requires all incoming connections to use SSL + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-326: Inadequate Encryption Strength' + category: security + technology: + - terraform + - gcp + references: + - https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#ipconfiguration + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.gcp.security.gcp-sql-database-require-ssl.gcp-sql-database-require-ssl + shortlink: https://sg.run/W4Yg + semgrep.dev: + rule: + r_id: 33709 + rv_id: 1263873 + rule_id: v8Uod5 + version_id: pZT033e + url: https://semgrep.dev/playground/r/pZT033e/terraform.gcp.security.gcp-sql-database-require-ssl.gcp-sql-database-require-ssl + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.gcp.security.gcp-sql-database-ssl-insecure-value-postgres-mysql.gcp-sql-database-ssl-insecure-value-postgres-mysql + patterns: + - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n database_version = \"$DB\"\n ...\n\ + }\n" + - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n \ + \ ssl_mode = $VALUE\n ...\n }\n ...\n}\n" + - pattern-not-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n\ + \ ssl_mode = \"TRUSTED_CLIENT_CERTIFICATE_REQUIRED\"\n ...\n }\n ...\n}\n" + - metavariable-regex: + metavariable: $DB + regex: .*(MYSQL|POSTGRES).* + - focus-metavariable: $VALUE + fix: '"TRUSTED_CLIENT_CERTIFICATE_REQUIRED" + + ' + message: Ensure all Cloud SQL database instance require incoming connections to use SSL. To enable this for PostgresSQL + and MySQL, use `ssl_mode="TRUSTED_CLIENT_CERTIFICATE_REQUIRED"`. + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-326: Inadequate Encryption Strength' + category: security + technology: + - terraform + - gcp + references: + - https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#ipconfiguration + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-postgres-mysql.gcp-sql-database-ssl-insecure-value-postgres-mysql + shortlink: https://sg.run/WANR2 + semgrep.dev: + rule: + r_id: 153509 + rv_id: 1263874 + rule_id: 5rUdGAz + version_id: 2KTv22E + url: https://semgrep.dev/playground/r/2KTv22E/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-postgres-mysql.gcp-sql-database-ssl-insecure-value-postgres-mysql + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.gcp.security.gcp-sql-database-ssl-insecure-value-sqlserver.gcp-sql-database-ssl-insecure-value-sqlserver + patterns: + - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n database_version = \"$DB\"\n ...\n\ + }\n" + - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n \ + \ ssl_mode = $VALUE\n ...\n }\n ...\n}\n" + - pattern-not-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n\ + \ ssl_mode = \"ENCRYPTED_ONLY\"\n ...\n }\n ...\n}\n" + - metavariable-regex: + metavariable: $DB + regex: .*(SQLSERVER).* + - focus-metavariable: $VALUE + fix: '"ENCRYPTED_ONLY" + + ' + message: Ensure all Cloud SQL database instance require incoming connections to use SSL. For SQL Server, `ssl_mode="ENCRYPTED_ONLY"` + is the most secure value that is supported. + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-326: Inadequate Encryption Strength' + category: security + technology: + - terraform + - gcp + references: + - https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#ipconfiguration + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-sqlserver.gcp-sql-database-ssl-insecure-value-sqlserver + shortlink: https://sg.run/0o92j + semgrep.dev: + rule: + r_id: 153510 + rv_id: 1263875 + rule_id: GdUvX6A + version_id: X0Tzyyl + url: https://semgrep.dev/playground/r/X0Tzyyl/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-sqlserver.gcp-sql-database-ssl-insecure-value-sqlserver + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.gcp.security.gcp-sql-public-database.gcp-sql-public-database + patterns: + - pattern: resource + - pattern-either: + - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n...\nip_configuration {\n ...\n authorized_networks\ + \ {\n ...\n value = \"0.0.0.0/0\"\n ...\n }\n ...\n}\n...\n}\n" + - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n...\nip_configuration {\n ...\n dynamic \"authorized_networks\"\ + \ {\n ...\n content {\n ...\n value = \"0.0.0.0/0\"\n ...\n }\n ...\n }\n ...\n}\n...\n\ + }\n" + message: Ensure that Cloud SQL database Instances are not open to the world + metadata: + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-1220: Insufficient Granularity of Access Control' + category: security + technology: + - terraform + - gcp + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/terraform.gcp.security.gcp-sql-public-database.gcp-sql-public-database + shortlink: https://sg.run/0Xv5 + semgrep.dev: + rule: + r_id: 33710 + rv_id: 1263876 + rule_id: d8U7Ll + version_id: jQTn559 + url: https://semgrep.dev/playground/r/jQTn559/terraform.gcp.security.gcp-sql-public-database.gcp-sql-public-database + origin: community + languages: + - hcl + severity: WARNING +- id: terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional + languages: + - hcl + message: AWS EC2 Instance allowing use of the IMDSv1 + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + references: + - https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options + category: security + technology: + - terraform + - aws + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional + shortlink: https://sg.run/J3BQ + semgrep.dev: + rule: + r_id: 11302 + rv_id: 1263884 + rule_id: GdU0eA + version_id: w8TRooE + url: https://semgrep.dev/playground/r/w8TRooE/terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional + origin: community + pattern-either: + - patterns: + - pattern: http_tokens = "optional" + - pattern-inside: 'metadata_options { ... } + + ' + - patterns: + - pattern: "resource \"aws_instance\" \"$NAME\" {\n ...\n}\n" + - pattern-not: "resource \"aws_instance\" \"$NAME\" {\n ...\n metadata_options {\n ...\n http_tokens = \"required\"\ + \n ...\n }\n ...\n}\n" + - pattern-not: "resource \"aws_instance\" \"$NAME\" {\n ...\n metadata_options {\n ...\n http_tokens = \"optional\"\ + \n ...\n }\n ...\n}\n" + - pattern-not: "resource \"aws_instance\" \"$NAME\" {\n ...\n metadata_options {\n ...\n http_endpoint = \"disabled\"\ + \n ...\n }\n ...\n}\n" + severity: ERROR +- id: terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code + pattern-either: + - patterns: + - pattern: password = "..." + - pattern-inside: "resource \"aws_db_instance\" \"...\" {\n ...\n}\n" + - patterns: + - pattern: master_password = "..." + - pattern-inside: "resource \"aws_rds_cluster\" \"...\" {\n ...\n}\n" + languages: + - hcl + severity: WARNING + message: RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at + runtime, or generate random credentials using the random_password resource. + metadata: + references: + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password + - https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + category: security + technology: + - terraform + - aws + - secrets + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code + shortlink: https://sg.run/x4qA + semgrep.dev: + rule: + r_id: 15830 + rv_id: 1263896 + rule_id: OrUl6W + version_id: gETB77b + url: https://semgrep.dev/playground/r/gETB77b/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code + origin: community +- id: terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket + pattern: acl = "public-read-write" + languages: + - hcl + severity: ERROR + message: S3 bucket with public read-write access detected. + metadata: + references: + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl + - https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + category: security + technology: + - terraform + - aws + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket + shortlink: https://sg.run/0nok + semgrep.dev: + rule: + r_id: 9754 + rv_id: 1263900 + rule_id: 6JUqvn + version_id: PkTR3y5 + url: https://semgrep.dev/playground/r/PkTR3y5/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket + origin: community +- id: terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket + patterns: + - pattern: a + - pattern: b + languages: + - hcl + severity: INFO + message: This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration + for more info. + metadata: + references: + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + category: security + technology: + - terraform + - aws + owasp: + - A03:2017 - Sensitive Data Exposure + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + deprecated: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket + shortlink: https://sg.run/Jezw + semgrep.dev: + rule: + r_id: 16202 + rv_id: 1263901 + rule_id: 3qU62L + version_id: JdTzxjN + url: https://semgrep.dev/playground/r/JdTzxjN/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket + origin: community +- id: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust + message: Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from + user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention + mechanism e.g. input validation or sanitization depending on the context. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + references: + - https://angular.io/api/platform-browser/DomSanitizer + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + confidence: MEDIUM + category: security + technology: + - angular + - browser + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust + shortlink: https://sg.run/KWxP + semgrep.dev: + rule: + r_id: 9755 + rv_id: 1263902 + rule_id: oqUzgA + version_id: 5PTo1zk + url: https://semgrep.dev/playground/r/5PTo1zk/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust + origin: community + languages: + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: 'function ...({..., $X: string, ...}) { ... } + + ' + - pattern-inside: 'function ...(..., $X: string, ...) { ... } + + ' + - focus-metavariable: $X + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $X.$TRUST($Y) + - focus-metavariable: $Y + - pattern-not: '$X.$TRUST(`...`) + + ' + - pattern-not: '$X.$TRUST("...") + + ' + - metavariable-regex: + metavariable: $TRUST + regex: (bypassSecurityTrustHtml|bypassSecurityTrustStyle|bypassSecurityTrustScript|bypassSecurityTrustUrl|bypassSecurityTrustResourceUrl) + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import * as $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: '$S = require("underscore.string") + + ... + + ' + - pattern-either: + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "dompurify" + + ... + + ' + - pattern-inside: 'import { ..., $S,... } from "dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "dompurify" + + ... + + ' + - pattern-inside: '$S = require("dompurify") + + ... + + ' + - pattern-inside: 'import $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: '$S = require("isomorphic-dompurify") + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$VALUE = $S(...) + + ... + + ' + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: '$VALUE = $S.sanitize + + ... + + ' + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''xss''; + + ... + + ' + - pattern-inside: 'import * as $S from ''xss''; + + ... + + ' + - pattern-inside: '$S = require("xss") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''sanitize-html''; + + ... + + ' + - pattern-inside: 'import * as $S from "sanitize-html"; + + ... + + ' + - pattern-inside: '$S = require("sanitize-html") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern: sanitizer.sanitize(...) + - pattern-not: sanitizer.sanitize(SecurityContext.NONE, ...); +- id: typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption + message: 'Add "encryption: $Y.BucketEncryption.KMS_MANAGED" or "encryption: $Y.BucketEncryption.S3_MANAGED" to the bucket + props for Bucket construct $X' + metadata: + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + category: security + technology: + - AWS-CDK + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html + owasp: + - A03:2017 - Sensitive Data Exposure + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption + shortlink: https://sg.run/eowX + semgrep.dev: + rule: + r_id: 15276 + rv_id: 1263903 + rule_id: bwU8qz + version_id: GxTkeRx + url: https://semgrep.dev/playground/r/GxTkeRx/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption + origin: community + languages: + - typescript + severity: ERROR + pattern-either: + - patterns: + - pattern-inside: 'import {Bucket} from ''@aws-cdk/aws-s3'' + + ... + + ' + - pattern: const $X = new Bucket(...) + - pattern-not: 'const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS_MANAGED, ...}) + + ' + - pattern-not: 'const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS, ...}) + + ' + - pattern-not: 'const $X = new Bucket(..., {..., encryption: BucketEncryption.S3_MANAGED, ...}) + + ' + - patterns: + - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-s3'' + + ... + + ' + - pattern: const $X = new $Y.Bucket(...) + - pattern-not: 'const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS_MANAGED, ...}) + + ' + - pattern-not: 'const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS, ...}) + + ' + - pattern-not: 'const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.S3_MANAGED, ...}) + + ' +- id: typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl + message: Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the + property "enforceSSL" should be set to true + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + category: security + technology: + - AWS-CDK + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl + shortlink: https://sg.run/vqBX + semgrep.dev: + rule: + r_id: 15277 + rv_id: 1263904 + rule_id: NbUN8B + version_id: RGT0Llg + url: https://semgrep.dev/playground/r/RGT0Llg/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl + origin: community + languages: + - ts + severity: ERROR + pattern-either: + - patterns: + - pattern-inside: 'import {Bucket} from ''@aws-cdk/aws-s3''; + + ... + + ' + - pattern: const $X = new Bucket(...) + - pattern-not: 'const $X = new Bucket(..., {enforceSSL: true}, ...) + + ' + - patterns: + - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-s3''; + + ... + + ' + - pattern: const $X = new $Y.Bucket(...) + - pattern-not: 'const $X = new $Y.Bucket(..., {..., enforceSSL: true, ...}) + + ' +- id: typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue + message: 'Queue $X is missing encryption at rest. Add "encryption: $Y.QueueEncryption.KMS" or "encryption: $Y.QueueEncryption.KMS_MANAGED" + to the queue props to enable encryption at rest for the queue.' + metadata: + category: security + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + technology: + - AWS-CDK + references: + - https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html + owasp: + - A03:2017 - Sensitive Data Exposure + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue + shortlink: https://sg.run/d23P + semgrep.dev: + rule: + r_id: 15278 + rv_id: 1263905 + rule_id: kxUwqO + version_id: A8Tgd2W + url: https://semgrep.dev/playground/r/A8Tgd2W/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue + origin: community + languages: + - ts + severity: WARNING + pattern-either: + - patterns: + - pattern-inside: 'import {Queue} from ''@aws-cdk/aws-sqs'' + + ... + + ' + - pattern: const $X = new Queue(...) + - pattern-not: 'const $X = new Queue(..., {..., encryption: QueueEncryption.KMS_MANAGED, ...}) + + ' + - pattern-not: 'const $X = new Queue(..., {..., encryption: QueueEncryption.KMS, ...}) + + ' + - patterns: + - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-sqs'' + + ... + + ' + - pattern: const $X = new $Y.Queue(...) + - pattern-not: 'const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS_MANAGED, ...}) + + ' + - pattern-not: 'const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS, ...}) + + ' +- id: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod + message: Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. + Verify if this is intentional. + metadata: + cwe: + - 'CWE-306: Missing Authentication for Critical Function' + category: security + technology: + - AWS-CDK + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod + shortlink: https://sg.run/Z4p7 + semgrep.dev: + rule: + r_id: 15279 + rv_id: 1263906 + rule_id: wdUjZK + version_id: BjTkZA7 + url: https://semgrep.dev/playground/r/BjTkZA7/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod + origin: community + languages: + - ts + severity: WARNING + pattern-either: + - patterns: + - pattern-inside: 'import {Bucket} from ''@aws-cdk/aws-s3'' + + ... + + ' + - pattern: 'const $X = new Bucket(...) + + ... + + $X.grantPublicAccess(...) + + ' + - patterns: + - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-s3'' + + ... + + ' + - pattern: 'const $X = new $Y.Bucket(...) + + ... + + $X.grantPublicAccess(...) + + ' +- id: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public + message: CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically + accessible, including builds prior to the project being public. Ensure this is acceptable for the project. + metadata: + category: security + cwe: + - 'CWE-306: Missing Authentication for Critical Function' + technology: + - AWS-CDK + references: + - https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public + shortlink: https://sg.run/nK7G + semgrep.dev: + rule: + r_id: 15280 + rv_id: 1263907 + rule_id: x8UxXZ + version_id: DkTRbj1 + url: https://semgrep.dev/playground/r/DkTRbj1/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public + origin: community + languages: + - ts + severity: WARNING + pattern-either: + - patterns: + - pattern-inside: 'import {Project} from ''@aws-cdk/aws-codebuild'' + + ... + + ' + - pattern: 'const $X = new Project(..., {..., badge: true, ...}) + + ' + - patterns: + - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-codebuild'' + + ... + + ' + - pattern: 'const $X = new $Y.Project(..., {..., badge: true, ...}) + + ' +- id: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml + message: Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site + scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using + a sanitization library such as DOMPurify to sanitize your HTML. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html + category: security + confidence: MEDIUM + technology: + - react + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml + shortlink: https://sg.run/rAx6 + semgrep.dev: + rule: + r_id: 9769 + rv_id: 1263912 + rule_id: x8UWvK + version_id: l4TJR0v + url: https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml + origin: community + languages: + - typescript + - javascript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: 'function ...({..., $X, ...}) { ... } + + ' + - pattern-inside: 'function ...(..., $X, ...) { ... } + + ' + - focus-metavariable: $X + - pattern-not-inside: '$F. ... .$SANITIZEUNC(...) + + ' + pattern-sinks: + - patterns: + - focus-metavariable: $X + - pattern-either: + - pattern: '{...,dangerouslySetInnerHTML: {__html: $X},...} + + ' + - pattern: '<$Y ... dangerouslySetInnerHTML={{__html: $X}} /> + + ' + - pattern-not: '<$Y ... dangerouslySetInnerHTML={{__html: "..."}} /> + + ' + - pattern-not: '{...,dangerouslySetInnerHTML:{__html: "..."},...} + + ' + - metavariable-pattern: + patterns: + - pattern-not: '{...} + + ' + metavariable: $X + - pattern-not: '<... {__html: "..."} ...> + + ' + - pattern-not: '<... {__html: `...`} ...> + + ' + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import * as $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: '$S = require("underscore.string") + + ... + + ' + - pattern-either: + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "dompurify" + + ... + + ' + - pattern-inside: 'import { ..., $S,... } from "dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "dompurify" + + ... + + ' + - pattern-inside: '$S = require("dompurify") + + ... + + ' + - pattern-inside: 'import $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: '$S = require("isomorphic-dompurify") + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$VALUE = $S(...) + + ... + + ' + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: '$VALUE = $S.sanitize + + ... + + ' + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''xss''; + + ... + + ' + - pattern-inside: 'import * as $S from ''xss''; + + ... + + ' + - pattern-inside: '$S = require("xss") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''sanitize-html''; + + ... + + ' + - pattern-inside: 'import * as $S from "sanitize-html"; + + ... + + ' + - pattern-inside: '$S = require("sanitize-html") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: '$S = new Remarkable() + + ... + + ' + - pattern: $S.render(...) +- id: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method + message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) + attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as + DOMPurify to sanitize your HTML. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln + - https://developer.mozilla.org/en-US/docs/Web/API/Document/write + - https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML + category: security + confidence: MEDIUM + technology: + - react + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method + shortlink: https://sg.run/E5x8 + semgrep.dev: + rule: + r_id: 9781 + rv_id: 1263916 + rule_id: QrU68w + version_id: GxTkeRl + url: https://semgrep.dev/playground/r/GxTkeRl/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method + origin: community + languages: + - typescript + - javascript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: 'function ...({..., $X, ...}) { ... } + + ' + - pattern-inside: 'function ...(..., $X, ...) { ... } + + ' + - focus-metavariable: $X + - pattern-either: + - pattern: $X.$Y + - pattern: $X[...] + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "this.window.document. ... .$HTML('...',$SINK) \n" + - pattern: "window.document. ... .$HTML('...',$SINK) \n" + - pattern: "document.$HTML($SINK) \n" + - metavariable-regex: + metavariable: $HTML + regex: (writeln|write) + - focus-metavariable: $SINK + - patterns: + - pattern-either: + - pattern: "$PROP. ... .$HTML('...',$SINK) \n" + - metavariable-regex: + metavariable: $HTML + regex: (insertAdjacentHTML) + - focus-metavariable: $SINK + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import * as $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: '$S = require("underscore.string") + + ... + + ' + - pattern-either: + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "dompurify" + + ... + + ' + - pattern-inside: 'import { ..., $S,... } from "dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "dompurify" + + ... + + ' + - pattern-inside: '$S = require("dompurify") + + ... + + ' + - pattern-inside: 'import $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: '$S = require("isomorphic-dompurify") + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$VALUE = $S(...) + + ... + + ' + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: '$VALUE = $S.sanitize + + ... + + ' + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''xss''; + + ... + + ' + - pattern-inside: 'import * as $S from ''xss''; + + ... + + ' + - pattern-inside: '$S = require("xss") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''sanitize-html''; + + ... + + ' + - pattern-inside: 'import * as $S from "sanitize-html"; + + ... + + ' + - pattern-inside: '$S = require("sanitize-html") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: '$S = new Remarkable() + + ... + + ' + - pattern: $S.render(...) +- id: typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property + message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) + attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as + DOMPurify to sanitize your HTML. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html + category: security + confidence: MEDIUM + technology: + - react + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property + shortlink: https://sg.run/70Zv + semgrep.dev: + rule: + r_id: 9782 + rv_id: 1263917 + rule_id: 3qUBl4 + version_id: RGT0Lln + url: https://semgrep.dev/playground/r/RGT0Lln/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property + origin: community + languages: + - typescript + - javascript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: 'function ...({..., $X, ...}) { ... } + + ' + - pattern-inside: 'function ...(..., $X, ...) { ... } + + ' + - focus-metavariable: $X + - pattern-either: + - pattern: $X.$Y + - pattern: $X[...] + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$BODY = $REACT.useRef(...) + + ... + + ' + - pattern-inside: '$BODY = useRef(...) + + ... + + ' + - pattern-inside: '$BODY = findDOMNode(...) + + ... + + ' + - pattern-inside: '$BODY = createRef(...) + + ... + + ' + - pattern-inside: '$BODY = $REACT.findDOMNode(...) + + ... + + ' + - pattern-inside: '$BODY = $REACT.createRef(...) + + ... + + ' + - pattern-either: + - pattern: "$BODY. ... .$HTML = $SINK \n" + - pattern: "$BODY.$HTML = $SINK \n" + - metavariable-regex: + metavariable: $HTML + regex: (innerHTML|outerHTML) + - focus-metavariable: $SINK + - patterns: + - pattern-either: + - pattern: ReactDOM.findDOMNode(...).$HTML = $SINK + - metavariable-regex: + metavariable: $HTML + regex: (innerHTML|outerHTML) + - focus-metavariable: $SINK + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import * as $S from "underscore.string" + + ... + + ' + - pattern-inside: 'import $S from "underscore.string" + + ... + + ' + - pattern-inside: '$S = require("underscore.string") + + ... + + ' + - pattern-either: + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from "dompurify" + + ... + + ' + - pattern-inside: 'import { ..., $S,... } from "dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "dompurify" + + ... + + ' + - pattern-inside: '$S = require("dompurify") + + ... + + ' + - pattern-inside: 'import $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: 'import * as $S from "isomorphic-dompurify" + + ... + + ' + - pattern-inside: '$S = require("isomorphic-dompurify") + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: '$VALUE = $S(...) + + ... + + ' + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: '$VALUE = $S.sanitize + + ... + + ' + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''xss''; + + ... + + ' + - pattern-inside: 'import * as $S from ''xss''; + + ... + + ' + - pattern-inside: '$S = require("xss") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: 'import $S from ''sanitize-html''; + + ... + + ' + - pattern-inside: 'import * as $S from "sanitize-html"; + + ... + + ' + - pattern-inside: '$S = require("sanitize-html") + + ... + + ' + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: '$S = new Remarkable() + + ... + + ' + - pattern: $S.render(...) +- id: typescript.react.security.react-insecure-request.react-insecure-request + message: Unencrypted request over HTTP detected. + metadata: + vulnerability: Insecure Transport + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + references: + - https://www.npmjs.com/package/axios + category: security + technology: + - react + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request + shortlink: https://sg.run/1n0b + semgrep.dev: + rule: + r_id: 9766 + rv_id: 1263918 + rule_id: NbUA3O + version_id: A8Tgd2p + url: https://semgrep.dev/playground/r/A8Tgd2p/typescript.react.security.react-insecure-request.react-insecure-request + origin: community + languages: + - typescript + - javascript + severity: ERROR + patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: 'import $AXIOS from ''axios''; + + ... + + $AXIOS.$METHOD(...) + + ' + - pattern-inside: '$AXIOS = require(''axios''); + + ... + + $AXIOS.$METHOD(...) + + ' + - pattern: $AXIOS.$VERB("$URL",...) + - metavariable-regex: + metavariable: $VERB + regex: ^(get|post|delete|head|patch|put|options) + - patterns: + - pattern-either: + - pattern-inside: 'import $AXIOS from ''axios''; + + ... + + $AXIOS(...) + + ' + - pattern-inside: '$AXIOS = require(''axios''); + + ... + + $AXIOS(...) + + ' + - pattern-either: + - pattern: '$AXIOS({url: "$URL"}, ...)' + - pattern: '$OPTS = {url: "$URL"} + + ... + + $AXIOS($OPTS, ...) + + ' + - pattern: fetch("$URL", ...) + - metavariable-regex: + metavariable: $URL + regex: ^([Hh][Tt][Tt][Pp]:\/\/(?!localhost).*) +- id: yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection + message: Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the + parameters to env variables instead. + languages: + - yaml + metadata: + category: security + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 – Injection + confidence: MEDIUM + likelihood: MEDIUM + impact: HIGH + subcategory: + - vuln + references: + - https://github.com/argoproj/argo-workflows/issues/5061 + - https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370 + technology: + - ci + - argo + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + - Command Injection + source: https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection + shortlink: https://sg.run/yqeZ + semgrep.dev: + rule: + r_id: 40768 + rv_id: 1151472 + rule_id: 10U0zW + version_id: xyTp17z + url: https://semgrep.dev/playground/r/xyTp17z/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection + origin: community + severity: ERROR + patterns: + - pattern-inside: 'apiVersion: $VERSION + + ... + + ' + - metavariable-regex: + metavariable: $VERSION + regex: (argoproj.io.*) + - pattern-either: + - patterns: + - pattern-inside: "command:\n ...\n - $LANG\n ...\n...\nsource:\n $SCRIPT\n" + - metavariable-regex: + metavariable: $LANG + regex: .*(sh|bash|ksh|csh|tcsh|zsh|python|python3|node|perl|ruby|php|lua|awk|sed|powershell|fish|dash|R|grooby|scala|clj|elixir|coffee|dart|haskell|ocaml).* + - metavariable-pattern: + metavariable: $SCRIPT + pattern-either: + - pattern-regex: (.*{{.*inputs.parameters.*}}.*) + - pattern-regex: (.*{{.*workflow.parameters.*}}.*) + - focus-metavariable: $SCRIPT + - patterns: + - pattern-either: + - pattern-inside: "container:\n ...\n command: $LANG\n ...\n args: $PARAM\n" + - pattern-inside: "containerSet:\n ...\n containers:\n - ...\n command: $LANG\n ...\n args: $PARAM\n" + - metavariable-regex: + metavariable: $LANG + regex: .*(sh|bash|ksh|csh|tcsh|zsh|python|python3|node|perl|ruby|php|lua|awk|sed|powershell|fish|dash|R|grooby|scala|clj|elixir|coffee|dart|haskell|ocaml).* + - metavariable-pattern: + metavariable: $PARAM + pattern-either: + - pattern-regex: (.*{{.*inputs.parameters.*}}.*) + - pattern-regex: (.*{{.*workflow.parameters.*}}.*) + - focus-metavariable: $PARAM +- id: yaml.docker-compose.security.privileged-service.privileged-service + patterns: + - pattern-inside: "version: ...\n...\nservices:\n ...\n $SERVICE:\n ...\n privileged: $TRUE\n" + - focus-metavariable: $TRUE + - metavariable-regex: + metavariable: $TRUE + regex: (true) + fix: 'false + + ' + message: Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities + on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the + 'privileged' key to disable this capability. + metadata: + cwe: + - 'CWE-250: Execution with Unnecessary Privileges' + owasp: + - A06:2017 - Security Misconfiguration + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html + - https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/ + category: security + technology: + - docker-compose + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service + shortlink: https://sg.run/AlX0 + semgrep.dev: + rule: + r_id: 10006 + rv_id: 1263922 + rule_id: DbUW17 + version_id: 0bTKzXZ + url: https://semgrep.dev/playground/r/0bTKzXZ/yaml.docker-compose.security.privileged-service.privileged-service + origin: community + languages: + - yaml + severity: WARNING +- id: yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands + languages: + - yaml + severity: WARNING + message: The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` + and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified + by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the + system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen + code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files + for more information. + metadata: + cwe: + - 'CWE-749: Exposed Dangerous Method or Function' + owasp: A06:2017 - Security Misconfiguration + references: + - https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/ + - https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w + - https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files + category: security + technology: + - github-actions + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Dangerous Method or Function + source: https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands + shortlink: https://sg.run/qq78 + semgrep.dev: + rule: + r_id: 13412 + rv_id: 947039 + rule_id: EwUQ9x + version_id: jQTzq34 + url: https://semgrep.dev/playground/r/jQTzq34/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands + origin: community + patterns: + - pattern-either: + - patterns: + - pattern-inside: '{env: ...}' + - pattern: 'ACTIONS_ALLOW_UNSECURE_COMMANDS: true' +- id: yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor + languages: + - yaml + message: The Shai-hulud backdoor creates a purposefully vulnerable github action with the name `discussion.yaml`. + paths: + include: + - '**/.github/workflows/discussion.yaml' + metadata: + category: security + cwe: + - 'CWE-509: Replicating Malicious Code (Virus or Worm)' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + technology: + - github-actions + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source_rule_url: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack + references: + - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains + source: https://semgrep.dev/r/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor + shortlink: https://sg.run/JdYPZ + semgrep.dev: + rule: + r_id: 238946 + rv_id: 1263927 + rule_id: 7KUDRPj + version_id: 6xT29ol + url: https://semgrep.dev/playground/r/6xT29ol/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor + origin: community + patterns: + - pattern-inside: 'steps: [...]' + - pattern-inside: "- run: ...\n ...\n" + - pattern: 'run: $SHELL' + - metavariable-pattern: + language: generic + metavariable: $SHELL + patterns: + - pattern-either: + - pattern: ${{ github.event.issue.title }} + - pattern: ${{ github.event.issue.body }} + - pattern: ${{ github.event.pull_request.title }} + - pattern: ${{ github.event.pull_request.body }} + - pattern: ${{ github.event.comment.body }} + - pattern: ${{ github.event.review.body }} + - pattern: ${{ github.event.review_comment.body }} + - pattern: ${{ github.event.pages. ... .page_name}} + - pattern: ${{ github.event.head_commit.message }} + - pattern: ${{ github.event.head_commit.author.email }} + - pattern: ${{ github.event.head_commit.author.name }} + - pattern: ${{ github.event.commits ... .author.email }} + - pattern: ${{ github.event.commits ... .author.name }} + - pattern: ${{ github.event.pull_request.head.ref }} + - pattern: ${{ github.event.pull_request.head.label }} + - pattern: ${{ github.event.pull_request.head.repo.default_branch }} + - pattern: ${{ github.head_ref }} + - pattern: ${{ github.event.inputs ... }} + - pattern: ${{ github.event.discussion.title }} + - pattern: ${{ github.event.discussion.body }} + - pattern: ${{ inputs ... }} + severity: ERROR +- id: yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell + languages: + - yaml + message: A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | bash" + install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in + your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it. + metadata: + category: security + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A03:2021 - Injection + - A03:2025 - Injection + references: + - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions + - https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ + technology: + - github-actions + - bash + - curl + cwe2021-top25: true + cwe2022-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell + shortlink: https://sg.run/GR8K1 + semgrep.dev: + rule: + r_id: 309392 + rv_id: 1443456 + rule_id: x8UAgrE + version_id: 9lT3zYb + url: https://semgrep.dev/playground/r/9lT3zYb/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell + origin: community + patterns: + - pattern-inside: 'steps: [...]' + - pattern-inside: "- run: ...\n ...\n" + - pattern: 'run: $SHELL' + - metavariable-pattern: + language: bash + metavariable: $SHELL + patterns: + - pattern-either: + - pattern: curl ... | $CMD ... + - pattern: wget ... | $CMD ... + - metavariable-regex: + metavariable: $CMD + regex: ^(bash|sh|python3?|ruby|perl)$ + severity: ERROR +- id: yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret + languages: + - yaml + message: 'A secret is exposed in the workflow-level `env:` block, making it available to every job and step in this workflow + — including any untrusted code run in pull-request workflows. Scope secrets as narrowly as possible: prefer step-level + `env:` so the secret is only available where it is actually needed.' + metadata: + category: security + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-secrets + - https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow + technology: + - github-actions + subcategory: + - audit + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret + shortlink: https://sg.run/Rrn12 + semgrep.dev: + rule: + r_id: 309393 + rv_id: 1443457 + rule_id: OrUnq7z + version_id: yeTqX9r + url: https://semgrep.dev/playground/r/yeTqX9r/yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret + origin: community + patterns: + - pattern-inside: "env:\n ...\n" + - pattern-regex: \$\{\{\s*secrets\. + - pattern-not-inside: 'jobs: ...' + severity: WARNING +- id: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag + message: 'GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by + the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin + the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.' + severity: WARNING + languages: + - yaml + metadata: + category: security + cwe: + - 'CWE-1357: Reliance on Insufficiently Trustworthy Component' + - 'CWE-353: Missing Support for Integrity Check' + owasp: + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software and Data Integrity Failures + references: + - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions + technology: + - github-actions + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + - Other + source: https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag + shortlink: https://sg.run/2LgAL + semgrep.dev: + rule: + r_id: 288863 + rv_id: 1413422 + rule_id: GdUxYDx + version_id: xyTRDAd + url: https://semgrep.dev/playground/r/xyTRDAd/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag + origin: community + patterns: + - pattern-inside: '{steps: ...}' + - pattern: 'uses: "$ACTION" + + ' + - metavariable-pattern: + metavariable: $ACTION + language: generic + patterns: + - pattern-not-regex: ^\./ + - pattern-not-regex: ^docker:// + - pattern-not-regex: '@[0-9a-f]{40}(\s|$)' +- id: yaml.github-actions.security.github-script-injection.github-script-injection + languages: + - yaml + message: 'Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`''s `script:` step + could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` + context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment + variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes + the environment variable, like this: "$ENVVAR".' + metadata: + category: security + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections + - https://securitylab.github.com/research/github-actions-untrusted-input/ + - https://github.com/actions/github-script + technology: + - github-actions + cwe2022-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection + shortlink: https://sg.run/g1G0 + semgrep.dev: + rule: + r_id: 31441 + rv_id: 1501843 + rule_id: OrUQvK + version_id: e1TboJK + url: https://semgrep.dev/playground/r/e1TboJK/yaml.github-actions.security.github-script-injection.github-script-injection + origin: community + patterns: + - pattern-inside: 'steps: [...]' + - pattern-inside: 'uses: $ACTION + + ... + + ' + - pattern-inside: "with:\n ...\n script: ...\n ...\n" + - pattern: 'script: $SHELL' + - metavariable-regex: + metavariable: $ACTION + regex: actions/github-script@.* + - metavariable-pattern: + language: generic + metavariable: $SHELL + patterns: + - pattern-either: + - pattern: ${{ ... github.event.issue.title ... }} + - pattern: ${{ ... github.event.issue.body ... }} + - pattern: ${{ ... github.event.pull_request.title ... }} + - pattern: ${{ ... github.event.pull_request.body ... }} + - pattern: ${{ ... github.event.comment.body ... }} + - pattern: ${{ ... github.event.review.body ... }} + - pattern: ${{ ... github.event.review_comment.body ... }} + - pattern: ${{ ... github.event.pages ... .page_name ... }} + - pattern: ${{ ... github.event.head_commit.message ... }} + - pattern: ${{ ... github.event.head_commit.author.email ... }} + - pattern: ${{ ... github.event.head_commit.author.name ... }} + - pattern: ${{ ... github.event.commits ... .author.email ... }} + - pattern: ${{ ... github.event.commits ... .author.name ... }} + - pattern: ${{ ... github.event.commits ... .message ... }} + - pattern: ${{ ... github.event.pull_request.head.ref ... }} + - pattern: ${{ ... github.event.pull_request.head.label ... }} + - pattern: ${{ ... github.event.pull_request.head.repo.default_branch ... }} + - pattern: ${{ ... github.ref ... }} + - pattern: ${{ ... github.base_ref ... }} + - pattern: ${{ ... github.head_ref ... }} + - pattern: ${{ ... github.ref_name ... }} + - pattern: ${{ ... github.event.inputs ... }} + - pattern: ${{ ... github.event.discussion.title ... }} + - pattern: ${{ ... github.event.discussion.body ... }} + - pattern: ${{ ... github.event.workflow_run.head_branch ... }} + - pattern: ${{ ... github.event.workflow_run.head_commit.message ... }} + - pattern: ${{ ... github.event.milestone.title ... }} + - pattern: ${{ ... github.event.milestone.description ... }} + - pattern: ${{ ... github.event.project_card.note ... }} + - pattern: ${{ ... github.event.project.name ... }} + - pattern: ${{ ... github.event.project_column.name ... }} + - pattern: ${{ ... github.event.release.name ... }} + - pattern: ${{ ... github.event.release.body ... }} + - pattern: ${{ ... github.event.deployment.ref ... }} + - pattern: ${{ ... inputs ... }} + - pattern-not: ${{ ... github.event.issue.title && ... }} + - pattern-not: ${{ ... github.event.issue.body && ... }} + - pattern-not: ${{ ... github.event.pull_request.title && ... }} + - pattern-not: ${{ ... github.event.pull_request.body && ... }} + - pattern-not: ${{ ... github.event.comment.body && ... }} + - pattern-not: ${{ ... github.event.review.body && ... }} + - pattern-not: ${{ ... github.event.review_comment.body && ... }} + - pattern-not: ${{ ... github.event.pages ... .page_name && ... }} + - pattern-not: ${{ ... github.event.head_commit.message && ... }} + - pattern-not: ${{ ... github.event.head_commit.author.email && ... }} + - pattern-not: ${{ ... github.event.head_commit.author.name && ... }} + - pattern-not: ${{ ... github.event.commits ... .author.email && ... }} + - pattern-not: ${{ ... github.event.commits ... .author.name && ... }} + - pattern-not: ${{ ... github.event.commits ... .message && ... }} + - pattern-not: ${{ ... github.event.pull_request.head.ref && ... }} + - pattern-not: ${{ ... github.event.pull_request.head.label && ... }} + - pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch && ... }} + - pattern-not: ${{ ... github.ref && ... }} + - pattern-not: ${{ ... github.base_ref && ... }} + - pattern-not: ${{ ... github.head_ref && ... }} + - pattern-not: ${{ ... github.ref_name && ... }} + - pattern-not: ${{ ... github.event.inputs && ... }} + - pattern-not: ${{ ... github.event.discussion.title && ... }} + - pattern-not: ${{ ... github.event.discussion.body && ... }} + - pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }} + - pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ... }} + - pattern-not: ${{ ... github.event.milestone.title && ... }} + - pattern-not: ${{ ... github.event.milestone.description && ... }} + - pattern-not: ${{ ... github.event.project_card.note && ... }} + - pattern-not: ${{ ... github.event.project.name && ... }} + - pattern-not: ${{ ... github.event.project_column.name && ... }} + - pattern-not: ${{ ... github.event.release.name && ... }} + - pattern-not: ${{ ... github.event.release.body && ... }} + - pattern-not: ${{ ... github.event.deployment.ref && ... }} + severity: ERROR +- id: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout + languages: + - yaml + message: This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. + When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all + repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming + PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You + may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let + an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or + dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from + the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ + for additional mitigations. + metadata: + category: security + owasp: + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software and Data Integrity Failures + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + references: + - https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ + - https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target + - https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md + technology: + - github-actions + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout + shortlink: https://sg.run/jkdn + semgrep.dev: + rule: + r_id: 13365 + rv_id: 1413423 + rule_id: d8Ulkd + version_id: O9TQ2nX + url: https://semgrep.dev/playground/r/O9TQ2nX/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout + origin: community + patterns: + - pattern-either: + - pattern-inside: "on:\n ...\n pull_request_target: ...\n ...\n...\n" + - pattern-inside: 'on: [..., pull_request_target, ...] + + ... + + ' + - pattern-inside: 'on: pull_request_target + + ... + + ' + - pattern-inside: "jobs:\n ...\n $JOBNAME:\n ...\n steps:\n ...\n" + - pattern: "...\nuses: \"$ACTION\"\nwith:\n ...\n ref: $EXPR\n" + - metavariable-regex: + metavariable: $ACTION + regex: actions/checkout@.* + - metavariable-pattern: + language: generic + metavariable: $EXPR + patterns: + - pattern-inside: ${{ ... }} + - pattern-either: + - pattern: github.event.pull_request ... + - pattern: github.head_ref ... + severity: ERROR +- id: yaml.github-actions.security.run-shell-injection.run-shell-injection + languages: + - yaml + message: 'Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to + inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have + arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` + to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment + variable, like this: "$ENVVAR".' + metadata: + category: security + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections + - https://securitylab.github.com/research/github-actions-untrusted-input/ + technology: + - github-actions + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection + shortlink: https://sg.run/pkzk + semgrep.dev: + rule: + r_id: 13162 + rv_id: 1501844 + rule_id: v8UjQj + version_id: vdTowy6 + url: https://semgrep.dev/playground/r/vdTowy6/yaml.github-actions.security.run-shell-injection.run-shell-injection + origin: community + patterns: + - pattern-inside: 'steps: [...]' + - pattern-inside: "- run: ...\n ...\n" + - pattern: 'run: $SHELL' + - metavariable-pattern: + language: generic + metavariable: $SHELL + patterns: + - pattern-either: + - pattern: ${{ ... github.event.issue.title ... }} + - pattern: ${{ ... github.event.issue.body ... }} + - pattern: ${{ ... github.event.pull_request.title ... }} + - pattern: ${{ ... github.event.pull_request.body ... }} + - pattern: ${{ ... github.event.comment.body ... }} + - pattern: ${{ ... github.event.review.body ... }} + - pattern: ${{ ... github.event.review_comment.body ... }} + - pattern: ${{ ... github.event.pages ... .page_name ... }} + - pattern: ${{ ... github.event.head_commit.message ... }} + - pattern: ${{ ... github.event.head_commit.author.email ... }} + - pattern: ${{ ... github.event.head_commit.author.name ... }} + - pattern: ${{ ... github.event.commits ... .author.email ... }} + - pattern: ${{ ... github.event.commits ... .author.name ... }} + - pattern: ${{ ... github.event.commits ... .message ... }} + - pattern: ${{ ... github.event.pull_request.head.ref ... }} + - pattern: ${{ ... github.event.pull_request.head.label ... }} + - pattern: ${{ ... github.event.pull_request.head.repo.default_branch ... }} + - pattern: ${{ ... github.ref ... }} + - pattern: ${{ ... github.base_ref ... }} + - pattern: ${{ ... github.head_ref ... }} + - pattern: ${{ ... github.ref_name ... }} + - pattern: ${{ ... github.event.inputs ... }} + - pattern: ${{ ... github.event.discussion.title ... }} + - pattern: ${{ ... github.event.discussion.body ... }} + - pattern: ${{ ... github.event.workflow_run.head_branch ... }} + - pattern: ${{ ... github.event.workflow_run.head_commit.message ... }} + - pattern: ${{ ... github.event.milestone.title ... }} + - pattern: ${{ ... github.event.milestone.description ... }} + - pattern: ${{ ... github.event.project_card.note ... }} + - pattern: ${{ ... github.event.project.name ... }} + - pattern: ${{ ... github.event.project_column.name ... }} + - pattern: ${{ ... github.event.release.name ... }} + - pattern: ${{ ... github.event.release.body ... }} + - pattern: ${{ ... github.event.deployment.ref ... }} + - pattern: ${{ ... inputs ... }} + - pattern-not: ${{ ... github.event.issue.title && ... }} + - pattern-not: ${{ ... github.event.issue.body && ... }} + - pattern-not: ${{ ... github.event.pull_request.title && ... }} + - pattern-not: ${{ ... github.event.pull_request.body && ... }} + - pattern-not: ${{ ... github.event.comment.body && ... }} + - pattern-not: ${{ ... github.event.review.body && ... }} + - pattern-not: ${{ ... github.event.review_comment.body && ... }} + - pattern-not: ${{ ... github.event.pages ... .page_name && ... }} + - pattern-not: ${{ ... github.event.head_commit.message && ... }} + - pattern-not: ${{ ... github.event.head_commit.author.email && ... }} + - pattern-not: ${{ ... github.event.head_commit.author.name && ... }} + - pattern-not: ${{ ... github.event.commits ... .author.email && ... }} + - pattern-not: ${{ ... github.event.commits ... .author.name && ... }} + - pattern-not: ${{ ... github.event.commits ... .message && ... }} + - pattern-not: ${{ ... github.event.pull_request.head.ref && ... }} + - pattern-not: ${{ ... github.event.pull_request.head.label && ... }} + - pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch && ... }} + - pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ... }} + - pattern-not: ${{ ... github.ref && ... }} + - pattern-not: ${{ ... github.base_ref && ... }} + - pattern-not: ${{ ... github.head_ref && ... }} + - pattern-not: ${{ ... github.ref_name && ... }} + - pattern-not: ${{ ... github.event.inputs && ... }} + - pattern-not: ${{ ... github.event.discussion.title && ... }} + - pattern-not: ${{ ... github.event.discussion.body && ... }} + - pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }} + - pattern-not: ${{ ... github.event.milestone.title && ... }} + - pattern-not: ${{ ... github.event.milestone.description && ... }} + - pattern-not: ${{ ... github.event.project_card.note && ... }} + - pattern-not: ${{ ... github.event.project.name && ... }} + - pattern-not: ${{ ... github.event.project_column.name && ... }} + - pattern-not: ${{ ... github.event.release.name && ... }} + - pattern-not: ${{ ... github.event.release.body && ... }} + - pattern-not: ${{ ... github.event.deployment.ref && ... }} + severity: ERROR +- id: yaml.github-actions.security.secrets-inherit.secrets-inherit + languages: + - yaml + severity: ERROR + message: 'This workflow uses `secrets: inherit` to pass all of the calling workflow''s secrets to a reusable workflow. This + violates the principle of least privilege because the called workflow receives access to every secret in the repository, + not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access + to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` + map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`.' + metadata: + category: security + cwe: + - 'CWE-250: Execution with Unnecessary Privileges' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow + - https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions + technology: + - github-actions + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/yaml.github-actions.security.secrets-inherit.secrets-inherit + shortlink: https://sg.run/X2PZB + semgrep.dev: + rule: + r_id: 288864 + rv_id: 1413424 + rule_id: ReUQnKg + version_id: e1T42L1 + url: https://semgrep.dev/playground/r/e1T42L1/yaml.github-actions.security.secrets-inherit.secrets-inherit + origin: community + patterns: + - pattern-inside: "jobs:\n ...\n" + - pattern: 'secrets: inherit' +- id: yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout + languages: + - yaml + message: This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When + using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository + secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, + by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently + executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository + secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts + (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please + see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations. + metadata: + category: security + owasp: A01:2017 - Injection + cwe: 'CWE-913: Improper Control of Dynamically-Managed Code Resources' + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + subcategory: + - vuln + references: + - https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ + - https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md + - https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability + technology: + - github-actions + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout + shortlink: https://sg.run/A0p6 + semgrep.dev: + rule: + r_id: 35494 + rv_id: 947046 + rule_id: 4bU8E4 + version_id: kbTYRwl + url: https://semgrep.dev/playground/r/kbTYRwl/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout + origin: community + patterns: + - pattern-inside: "on:\n ...\n workflow_run: ...\n ...\n...\n" + - pattern-inside: "jobs:\n ...\n $JOBNAME:\n ...\n steps:\n ...\n" + - pattern: "...\nuses: \"$ACTION\"\nwith:\n ...\n ref: $EXPR\n" + - metavariable-regex: + metavariable: $ACTION + regex: actions/checkout@.* + - metavariable-pattern: + language: generic + metavariable: $EXPR + patterns: + - pattern: ${{ github.event.workflow_run ... }} + severity: WARNING +- id: yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext + patterns: + - pattern-inside: "containers:\n ...\n" + - pattern-inside: "- $NAME: $CONTAINER\n ...\n" + - pattern: 'image: ... + + ... + + ' + - pattern-not: "image: ...\n...\nsecurityContext:\n ...\n" + - metavariable-regex: + metavariable: $NAME + regex: name + - focus-metavariable: $NAME + fix: "securityContext:\n allowPrivilegeEscalation: false\n$NAME\n" + message: In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain + container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation + and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container + in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running + any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes + pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation + attacks. + metadata: + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + owasp: + - A05:2021 - Security Misconfiguration + - A06:2017 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation + - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + - https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt + - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag + category: security + technology: + - kubernetes + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext + shortlink: https://sg.run/eleR + semgrep.dev: + rule: + r_id: 47276 + rv_id: 1263931 + rule_id: WAU5J6 + version_id: 2KTv2j8 + url: https://semgrep.dev/playground/r/2KTv2j8/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext + origin: community + languages: + - yaml + severity: WARNING +- id: yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true + patterns: + - pattern-inside: "containers:\n ...\n" + - pattern-inside: "- name: $CONTAINER\n ...\n" + - pattern-inside: 'image: ... + + ... + + ' + - pattern-inside: "securityContext:\n ...\n" + - pattern: 'allowPrivilegeEscalation: $TRUE + + ' + - metavariable-pattern: + metavariable: $TRUE + pattern: 'true + + ' + - focus-metavariable: $TRUE + fix: 'false + + ' + message: In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain + container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation + and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container + in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running + any privileged processes and limit the impact of any potential attacks. In the container `$CONTAINER` this parameter + is set to `true` which makes this container much more vulnerable to privelege escalation attacks. + metadata: + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + owasp: + - A05:2021 - Security Misconfiguration + - A06:2017 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation + - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + - https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt + - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag + category: security + technology: + - kubernetes + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true + shortlink: https://sg.run/vw3W + semgrep.dev: + rule: + r_id: 47277 + rv_id: 1263932 + rule_id: 0oUkqQ + version_id: X0Tzyqr + url: https://semgrep.dev/playground/r/X0Tzyqr/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true + origin: community + languages: + - yaml + severity: WARNING +- id: yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation + patterns: + - pattern-inside: "containers:\n ...\n" + - pattern-inside: "- name: $CONTAINER\n ...\n" + - pattern: 'image: ... + + ... + + ' + - pattern-inside: "image: ...\n...\n$SC:\n ...\n" + - metavariable-regex: + metavariable: $SC + regex: ^(securityContext)$ + - pattern-not-inside: "image: ...\n...\nsecurityContext:\n ...\n allowPrivilegeEscalation: $VAL\n" + - focus-metavariable: $SC + fix: "securityContext:\n allowPrivilegeEscalation: false #\n" + message: In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain + container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation + and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container + in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running + any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter + to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable + to privilege escalation attacks. + metadata: + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + owasp: + - A05:2021 - Security Misconfiguration + - A06:2017 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation + - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + - https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt + - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag + category: security + technology: + - kubernetes + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation + shortlink: https://sg.run/ljp6 + semgrep.dev: + rule: + r_id: 10057 + rv_id: 1263933 + rule_id: 6JUqEO + version_id: jQTn527 + url: https://semgrep.dev/playground/r/jQTn527/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation + origin: community + languages: + - yaml + severity: WARNING +- id: yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions + patterns: + - pattern: '"*" + + ' + - pattern-inside: 'resources: $A + + ... + + ' + - pattern-inside: 'verbs: $A + + ... + + ' + - pattern-inside: "- apiGroups: [\"\"]\n ...\n" + - pattern-inside: 'apiVersion: rbac.authorization.k8s.io/v1 + + ... + + ' + - pattern-inside: 'kind: ClusterRole + + ... + + ' + message: 'Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions + to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources + attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. ' + languages: + - yaml + severity: WARNING + metadata: + cwe: + - 'CWE-269: Improper Privilege Management' + owasp: + - A05:2021 - Security Misconfiguration + - A06:2017 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole + - https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice + - https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups + category: security + technology: + - kubernetes + cwe2021-top25: false + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions + shortlink: https://sg.run/x6Dz + semgrep.dev: + rule: + r_id: 73474 + rv_id: 1263935 + rule_id: GdUR2A + version_id: 9lT4bw7 + url: https://semgrep.dev/playground/r/9lT4bw7/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions + origin: community +- id: yaml.kubernetes.security.run-as-non-root-unsafe-value.run-as-non-root-unsafe-value + patterns: + - pattern-either: + - pattern: "spec:\n ...\n securityContext:\n ...\n runAsNonRoot: $VALUE\n" + - patterns: + - pattern-inside: "containers:\n ...\n" + - pattern: "image: ...\n...\nsecurityContext:\n ...\n runAsNonRoot: $VALUE\n" + - metavariable-pattern: + metavariable: $VALUE + pattern: 'false + + ' + - focus-metavariable: $VALUE + fix: 'true + + ' + message: When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege + escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, + which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add + a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container + runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` + to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure + and less vulnerable to privilege escalation attacks. + metadata: + references: + - https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/ + - https://kubernetes.io/docs/concepts/policy/pod-security-policy/ + - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user + cwe: + - 'CWE-250: Execution with Unnecessary Privileges' + owasp: + - A05:2021 - Security Misconfiguration + - A06:2017 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - kubernetes + subcategory: + - audit + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root-unsafe-value.run-as-non-root-unsafe-value + shortlink: https://sg.run/D9No + semgrep.dev: + rule: + r_id: 26096 + rv_id: 1263939 + rule_id: L1UAxy + version_id: NdTzyj8 + url: https://semgrep.dev/playground/r/NdTzyj8/yaml.kubernetes.security.run-as-non-root-unsafe-value.run-as-non-root-unsafe-value + origin: community + languages: + - yaml + severity: INFO +- id: yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled + patterns: + - pattern-inside: "containers:\n ...\n" + - pattern: "image: ...\n...\nsecurityContext:\n ...\n seccompProfile: unconfined\n" + message: 'Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove + ''seccompProfile: unconfined'' to prevent this.' + metadata: + cwe: + - 'CWE-284: Improper Access Control' + references: + - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp + - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + category: security + technology: + - kubernetes + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled + shortlink: https://sg.run/6rgY + semgrep.dev: + rule: + r_id: 10059 + rv_id: 1263941 + rule_id: zdUynw + version_id: w8TRoL3 + url: https://semgrep.dev/playground/r/w8TRoL3/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled + origin: community + languages: + - yaml + severity: WARNING +- id: yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file + patterns: + - pattern: '$KEY: $VALUE + + ' + - pattern-inside: 'data: ... + + ' + - pattern-inside: 'kind: Secret + + ... + + ' + - metavariable-regex: + metavariable: $VALUE + regex: (?i)^[aA-zZ0-9+/]+={0,2}$ + - metavariable-analysis: + analyzer: entropy + metavariable: $VALUE + message: 'Secrets ($VALUE) should not be stored in infrastructure as code files. Use an alternative such as Bitnami Sealed + Secrets or KSOPS to encrypt Kubernetes Secrets. ' + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + category: security + technology: + - kubernetes + references: + - https://kubernetes.io/docs/concepts/configuration/secret/ + - https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR_Kubernetes_Hardening_Guidance_1.1_20220315.PDF + - https://docs.gitlab.com/ee/user/clusters/agent/gitops/secrets_management.html + - https://www.cncf.io/blog/2021/04/22/revealing-the-secrets-of-kubernetes-secrets/ + - https://github.com/bitnami-labs/sealed-secrets + - https://www.cncf.io/blog/2022/01/25/secrets-management-essential-when-using-kubernetes/ + - https://blog.oddbit.com/post/2021-03-09-getting-started-with-ksops/ + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file + shortlink: https://sg.run/KyL6 + semgrep.dev: + rule: + r_id: 20055 + rv_id: 1263942 + rule_id: YGUYEb + version_id: xyTjz5B + url: https://semgrep.dev/playground/r/xyTjz5B/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file + origin: community + languages: + - yaml + severity: WARNING +- id: yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster + pattern: "cluster:\n ...\n insecure-skip-tls-verify: true\n" + message: 'Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections + insecure. Remove the ''insecure-skip-tls-verify: true'' key to secure communication.' + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + references: + - https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster + category: security + technology: + - kubernetes + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster + shortlink: https://sg.run/okyn + semgrep.dev: + rule: + r_id: 10116 + rv_id: 1263943 + rule_id: zdUyWx + version_id: O9Tpxbo + url: https://semgrep.dev/playground/r/O9Tpxbo/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster + origin: community + languages: + - yaml + severity: WARNING +- id: yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service + pattern: "spec:\n ...\n insecureSkipTLSVerify: true\n" + message: 'Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections + insecure. Remove the ''insecureSkipTLSVerify: true'' key to secure communication.' + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + references: + - https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io + category: security + technology: + - kubernetes + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service + shortlink: https://sg.run/zk10 + semgrep.dev: + rule: + r_id: 10117 + rv_id: 1263944 + rule_id: pKUGXr + version_id: e1TyjnR + url: https://semgrep.dev/playground/r/e1TyjnR/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service + origin: community + languages: + - yaml + severity: WARNING +- id: yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false + languages: + - yaml + message: 'Found ''x-openai-isConsequential: false'' in a state-changing HTTP method: $METHOD $PATH. This Action configuration + will enable the ''Always Allow'' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk + of a user selecting the ''Always Allow'' button is that the agent could perform unintended actions on behalf of the user. + When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider + the trade-off between security and user friction and then make a risk-based decision about this function.' + severity: WARNING + pattern-either: + - pattern-inside: "post:\n ...\n x-openai-isConsequential: false\n" + - pattern-inside: "put:\n ...\n x-openai-isConsequential: false\n" + - pattern-inside: "patch:\n ...\n x-openai-isConsequential: false\n" + - pattern-inside: "delete:\n ...\n x-openai-isConsequential: false\n" + metadata: + category: security + subcategory: + - audit + technology: + - openapi + - openai + likelihood: HIGH + impact: HIGH + confidence: HIGH + cwe: 'CWE-441: Unintended Proxy or Intermediary (''Confused Deputy'')' + owasp: + - A04:2021 Insecure Design + - LLM08:2023 - Excessive Agency + references: + - https://platform.openai.com/docs/actions/consequential-flag + - https://owasp.org/Top10/A04_2021-Insecure_Design/ + - https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false + shortlink: https://sg.run/x8EEP + semgrep.dev: + rule: + r_id: 146574 + rv_id: 947071 + rule_id: yyURooD + version_id: WrTEZN8 + url: https://semgrep.dev/playground/r/WrTEZN8/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false + origin: community +- id: yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication + languages: + - yaml + message: Basic authentication is considered weak and should be avoided. Use a different authentication scheme, such of + OAuth2, OpenID Connect, or mTLS. + severity: ERROR + patterns: + - pattern-inside: "openapi: $VERSION\n...\ncomponents:\n ...\n securitySchemes:\n ...\n $SCHEME:\n ...\n" + - metavariable-regex: + metavariable: $VERSION + regex: 3.* + - pattern: 'type: http + + ... + + scheme: basic + + ' + metadata: + category: security + subcategory: + - vuln + technology: + - openapi + likelihood: MEDIUM + impact: HIGH + confidence: HIGH + cwe: 'CWE-287: Improper Authentication' + owasp: + - A04:2021 Insecure Design + - A07:2021 Identification and Authentication Failures + references: + - https://cwe.mitre.org/data/definitions/287.html + - https://owasp.org/Top10/A04_2021-Insecure_Design/ + - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/ + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication + shortlink: https://sg.run/v8wNW + semgrep.dev: + rule: + r_id: 133077 + rv_id: 947072 + rule_id: zdUKgEX + version_id: 0bT1ErG + url: https://semgrep.dev/playground/r/0bT1ErG/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication + origin: community diff --git a/.semgrep/registry/package-managers.yaml b/.semgrep/registry/package-managers.yaml new file mode 100644 index 0000000..1088b85 --- /dev/null +++ b/.semgrep/registry/package-managers.yaml @@ -0,0 +1,428 @@ +# GENERATED FILE - DO NOT EDIT. +# Snapshot of Semgrep registry config(s): r/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age, r/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown, r/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age, r/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate, r/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age, r/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age, r/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown +# Rules are fetched from https://semgrep.dev/c/, deduplicated by rule id, +# and sorted. Refresh with: python3 .github/scripts/semgrep_registry.py sync +# (the semgrep-registry-update workflow does this on a schedule). +rules: +- id: package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age + pattern-either: + - patterns: + - pattern-regex: (?ms)\[install\](?P[^\[]*?)(?=\[|\z) + - metavariable-regex: + metavariable: $TARGET + regex: ^(?![\s\S]*minimumReleaseAge) + - focus-metavariable: $TARGET + - patterns: + - pattern-regex: minimumReleaseAge\s*=\s*\d+ + - pattern-regex: =\s*(?P\d+) + - metavariable-comparison: + metavariable: $AGE + comparison: int($AGE) < 604800 + - focus-metavariable: $AGE + - patterns: + - pattern-regex: (?m)minimumReleaseAge[ \t]*=[ \t]*(?P[^\s\d][^\n]*) + - focus-metavariable: $VAL + - patterns: + - pattern-regex: (?m)minimumReleaseAge\s*=\s*$ + message: 'This bunfig.toml does not set a minimum release age or sets it too low. Newly published packages can be malicious + or unstable. Add `minimumReleaseAge = 604800` under the `[install]` section to wait 7 days before resolving newly published + package versions. Added in: v1.3 Reference: https://bun.sh/docs/runtime/bunfig' + languages: + - generic + severity: MEDIUM + paths: + include: + - '**/bunfig.toml' + - '**/.bunfig.toml' + metadata: + category: security + technology: + - bun + - javascript + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://bun.sh/docs/runtime/bunfig + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age + shortlink: https://sg.run/JqPrR + semgrep.dev: + rule: + r_id: 291646 + rv_id: 1423385 + rule_id: oqUyJOb + version_id: BjTyRe5 + url: https://semgrep.dev/playground/r/BjTyRe5/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age + origin: community +- id: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + pattern-either: + - patterns: + - pattern-inside: "updates:\n ...\n" + - pattern: "- package-ecosystem: $ECOSYSTEM\n ...\n" + - pattern-not: "- package-ecosystem: $ECOSYSTEM\n ...\n cooldown:\n ...\n ...\n" + - patterns: + - pattern-inside: "updates:\n ...\n" + - pattern-regex: default-days\s*:\s*(?P\d+) + - metavariable-comparison: + metavariable: $DAYS + comparison: int($DAYS) < 7 + - focus-metavariable: $DAYS + - patterns: + - pattern-inside: "updates:\n ...\n" + - pattern: "cooldown:\n default-days: $DAYS\n" + - metavariable-regex: + metavariable: $DAYS + regex: ^\D + - focus-metavariable: $DAYS + message: 'This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. + Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before + proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown' + languages: + - yaml + severity: MEDIUM + paths: + include: + - '**/.github/dependabot.yml' + - '**/.github/dependabot.yaml' + metadata: + category: security + technology: + - dependabot + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + shortlink: https://sg.run/5WvGK + semgrep.dev: + rule: + r_id: 291647 + rv_id: 1423386 + rule_id: zdUArOL + version_id: DkTwEGl + url: https://semgrep.dev/playground/r/DkTwEGl/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + origin: community +- id: package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + pattern-either: + - patterns: + - pattern-regex: (?:(?:^---\n)(?:[^\n]*\n)|^)(?P(?:(?!\n---)[\s\S])*\S(?:(?!\n---)[\s\S])*) + - pattern-not-regex: min-release-age + - focus-metavariable: $TARGET + - patterns: + - pattern-regex: min-release-age\s*=\s*\d+ + - pattern-regex: =\s*(?P\d+) + - metavariable-comparison: + metavariable: $AGE + comparison: int($AGE) < 7 + - focus-metavariable: $AGE + - patterns: + - pattern-regex: (?m)min-release-age[ \t]*=[ \t]*(?P[^\s\d][^\n]*) + - focus-metavariable: $VAL + - patterns: + - pattern-regex: (?m)min-release-age\s*=\s*$ + message: 'This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or + unstable. Add `min-release-age = 7` to wait 7 days before resolving newly published package versions. Added in: v11.10 + Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/' + languages: + - generic + severity: MEDIUM + paths: + include: + - '**/.npmrc' + metadata: + category: security + technology: + - npm + - javascript + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/ + - https://github.com/npm/cli/pull/8965 + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + shortlink: https://sg.run/GRo1z + semgrep.dev: + rule: + r_id: 291648 + rv_id: 1423387 + rule_id: pKU6A82 + version_id: WrT7LdL + url: https://semgrep.dev/playground/r/WrT7LdL/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + origin: community +- id: package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age + message: 'This pnpm workspace configuration does not set a minimum release age. Newly published packages can be malicious + or unstable. Add `minimumReleaseAge: 10080` (minutes) to wait at least seven days before installing newly published package + versions. Added in: v10.16.0 Reference: https://pnpm.io/settings#minimumreleaseage' + languages: + - yaml + severity: MEDIUM + paths: + include: + - '**/pnpm-workspace.yaml' + pattern-either: + - patterns: + - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) + - focus-metavariable: $TARGET + - patterns: + - pattern-regex: ^\s*minimumReleaseAge\s*:\s*(?P\d+) + - metavariable-comparison: + metavariable: $AGE + comparison: int($AGE) < 10080 + - focus-metavariable: $AGE + - patterns: + - pattern: 'minimumReleaseAge: $AGE + + ' + - metavariable-regex: + metavariable: $AGE + regex: ^\D + - focus-metavariable: $AGE + - patterns: + - pattern-regex: (?m)^\s*minimumReleaseAge\s*:\s*$ + metadata: + category: security + technology: + - pnpm + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://pnpm.io/settings#minimumreleaseage + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age + shortlink: https://sg.run/Aj0o0 + semgrep.dev: + rule: + r_id: 291650 + rv_id: 1423389 + rule_id: X5Uwn1n + version_id: K3TgxrW + url: https://semgrep.dev/playground/r/K3TgxrW/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age + origin: community +- id: package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + pattern-either: + - patterns: + - pattern-inside: "\"packageRules\": [\n ...\n]\n" + - pattern-either: + - pattern: '{ ..., "matchPackageNames": [...], ... } + + ' + - pattern: '{ ..., "matchPackagePatterns": [...], ... } + + ' + - pattern: '{ ..., "matchDepTypes": [...], ... } + + ' + - pattern-not: "{\n ...,\n \"minimumReleaseAge\": $AGE,\n ...\n}\n" + - pattern-not: "{\n ...,\n \"minimumReleaseAge\": false,\n ...\n}\n" + - patterns: + - pattern-inside: "\"packageRules\": [\n ...\n]\n" + - pattern-regex: '"minimumReleaseAge":\s*"(?P\d+) days?"' + - metavariable-comparison: + metavariable: $AGE + comparison: int($AGE) < 7 + - focus-metavariable: $AGE + - patterns: + - pattern-inside: "\"packageRules\": [\n ...\n]\n" + - pattern: '"minimumReleaseAge": "$AGE" + + ' + - metavariable-regex: + metavariable: $AGE + regex: ^(?!\d+ days?$) + - focus-metavariable: $AGE + message: 'This Renovate configuration does not set a minimum release age. Newly published packages can be malicious or unstable. + Add `"minimumReleaseAge": "7 days"` within a `packageRules` entry to wait 7 days before proposing updates to newly published + package versions. Set `"minimumReleaseAge": false` to set an exception for minimal release age for the package rule. Added + in: v42' + languages: + - json + severity: MEDIUM + paths: + include: + - '**/renovate.json' + - '**/renovate.json5' + - '**/.renovaterc' + - '**/.renovaterc.json' + - '**/.renovaterc.json5' + metadata: + category: security + technology: + - renovate + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://docs.renovatebot.com/configuration-options/#minimumreleaseage + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + shortlink: https://sg.run/D8l2q + semgrep.dev: + rule: + r_id: 291652 + rv_id: 1443454 + rule_id: 10UbQrX + version_id: jQT1KAX + url: https://semgrep.dev/playground/r/jQT1KAX/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + origin: community +- id: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + pattern-either: + - patterns: + - pattern-regex: (?ms)\[tool\.uv\](?P[^\[]*?)(?=\[|\z) + - metavariable-regex: + metavariable: $TARGET + regex: ^(?![\s\S]*exclude-newer) + - focus-metavariable: $TARGET + - patterns: + - pattern-regex: exclude-newer\s*=\s*"(?P\d+)\s*d(?:ays?)?" + - metavariable-comparison: + metavariable: $DAYS + comparison: int($DAYS) < 7 + - focus-metavariable: $DAYS + - patterns: + - pattern-regex: exclude-newer\s*=\s*"(?P[^"]+)" + - metavariable-regex: + metavariable: $VAL + regex: (?i)^(?!\d+\s*d(?:ays?)?\b)(?!\d+\s*(?:weeks?|wks?|w|months?|mos?|mo|years?|yrs?|y)\b)(?!P[^Tt]*[WMY])(?!P(?:[7-9]|[1-9]\d+)D\b) + - focus-metavariable: $VAL + message: 'This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious + or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package + versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns' + languages: + - generic + severity: MEDIUM + paths: + include: + - '**/pyproject.toml' + - '**/uv.toml' + metadata: + category: security + technology: + - uv + - python + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + shortlink: https://sg.run/WeY0Z + semgrep.dev: + rule: + r_id: 291653 + rv_id: 1501839 + rule_id: 9AUo6vE + version_id: kbT3B1J + url: https://semgrep.dev/playground/r/kbT3B1J/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + origin: community +- id: package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + pattern-either: + - patterns: + - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?P^(?:nodeLinker|yarnPath|enableGlobalCache|npmScopes|npmRegistryServer)\s*:)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) + - focus-metavariable: $TARGET + - patterns: + - pattern-regex: (?m)npmMinimalAgeGate\s*:\s*['"]?(?P\d+)d['"]? + - metavariable-comparison: + metavariable: $DAYS + comparison: int($DAYS) < 7 + - focus-metavariable: $DAYS + - patterns: + - pattern-regex: (?m)npmMinimalAgeGate[ \t]*:[ \t]*(?P\S+) + - metavariable-regex: + metavariable: $VAL + regex: ^(?!['"]?\d+d['"]?$) + - focus-metavariable: $VAL + - patterns: + - pattern-regex: (?m)^npmMinimalAgeGate\s*:\s*$ + message: 'This .yarnrc.yml does not set a minimal age gate or sets it too low. Newly published packages can be malicious + or unstable. Add `npmMinimalAgeGate: "7d"` to wait 7 days before resolving newly published package versions. Added in: + 4.10 Reference: https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate' + languages: + - yaml + severity: MEDIUM + paths: + include: + - '**/.yarnrc.yml' + metadata: + category: security + technology: + - yarn + - javascript + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + owasp: + - A08:2021 - Software and Data Integrity Failures + confidence: HIGH + likelihood: LOW + impact: HIGH + subcategory: + - audit + vulnerability_class: + - Insecure Configuration + references: + - https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + shortlink: https://sg.run/0gvNq + semgrep.dev: + rule: + r_id: 291654 + rv_id: 1423393 + rule_id: yyUBeEz + version_id: JdTnXlj + url: https://semgrep.dev/playground/r/JdTnXlj/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + origin: community diff --git a/.semgrep/registry/python.yaml b/.semgrep/registry/python.yaml new file mode 100644 index 0000000..ea9a7e9 --- /dev/null +++ b/.semgrep/registry/python.yaml @@ -0,0 +1,16155 @@ +# GENERATED FILE - DO NOT EDIT. +# Snapshot of Semgrep registry config(s): p/python +# Rules are fetched from https://semgrep.dev/c/, deduplicated by rule id, +# and sorted. Refresh with: python3 .github/scripts/semgrep_registry.py sync +# (the semgrep-registry-update workflow does this on a schedule). +rules: +- id: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $CMD + - pattern-either: + - pattern: asyncio.create_subprocess_exec($PROG, $CMD, ...) + - pattern: asyncio.create_subprocess_exec($PROG, [$CMD, ...], ...) + - pattern: asyncio.subprocess.create_subprocess_exec($PROG, $CMD, ...) + - pattern: asyncio.subprocess.create_subprocess_exec($PROG, [$CMD, ...], ...) + - pattern: asyncio.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) + - pattern: asyncio.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) + - pattern: asyncio.subprocess.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) + - pattern: asyncio.subprocess.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) + message: Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled + by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable + by an external resource. You may consider using 'shlex.escape()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec + - https://docs.python.org/3/library/shlex.html + category: security + technology: + - python + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + shortlink: https://sg.run/oyv0 + semgrep.dev: + rule: + r_id: 18260 + rv_id: 1263331 + rule_id: EwUrX8 + version_id: rxTAKgo + url: https://semgrep.dev/playground/r/rxTAKgo/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + origin: community + languages: + - python + severity: ERROR +- id: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $CMD + - pattern-either: + - pattern: $LOOP.subprocess_exec($PROTOCOL, $CMD, ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, [$CMD, ...], ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) + message: Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can + be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it + is not controllable by an external resource. You may consider using 'shlex.escape()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec + - https://docs.python.org/3/library/shlex.html + category: security + technology: + - python + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + shortlink: https://sg.run/z14d + semgrep.dev: + rule: + r_id: 18261 + rv_id: 1263332 + rule_id: 7KUxXg + version_id: bZT53Ww + url: https://semgrep.dev/playground/r/bZT53Ww/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + origin: community + languages: + - python + severity: ERROR +- id: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $CMD + - pattern-either: + - pattern: $LOOP.subprocess_shell($PROTOCOL, $CMD) + - pattern: asyncio.subprocess.create_subprocess_shell($CMD, ...) + - pattern: asyncio.create_subprocess_shell($CMD, ...) + message: Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by + a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable + by an external resource. You may consider using 'shlex.escape()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://docs.python.org/3/library/asyncio-subprocess.html + - https://docs.python.org/3/library/shlex.html + category: security + technology: + - python + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell + shortlink: https://sg.run/p9vZ + semgrep.dev: + rule: + r_id: 18262 + rv_id: 1263333 + rule_id: L1UEl7 + version_id: NdTzyWA + url: https://semgrep.dev/playground/r/NdTzyWA/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell + origin: community + languages: + - python + severity: ERROR +- id: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process + mode: taint + message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this + function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + category: security + technology: + - python + - aws-lambda + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process + shortlink: https://sg.run/2AjL + semgrep.dev: + rule: + r_id: 18263 + rv_id: 1263334 + rule_id: 8GUGBq + version_id: kbTzGv8 + url: https://semgrep.dev/playground/r/kbTzGv8/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process + origin: community + languages: + - python + severity: ERROR + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $CMD + - pattern-either: + - patterns: + - pattern: os.$METHOD($MODE, $CMD, ...) + - metavariable-regex: + metavariable: $METHOD + regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) + - patterns: + - pattern-inside: os.$METHOD($MODE, $BASH, ["-c", $CMD,...],...) + - metavariable-regex: + metavariable: $METHOD + regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + - patterns: + - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) + - metavariable-regex: + metavariable: $METHOD + regex: (spawnl|spawnle|spawnlp|spawnlpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) +- id: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use + mode: taint + message: Detected subprocess function with argument tainted by an `event` object. If this data can be controlled by a malicious + actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. + Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the + command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for + this purpose. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://docs.python.org/3/library/subprocess.html + - https://docs.python.org/3/library/shlex.html + category: security + technology: + - python + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use + shortlink: https://sg.run/XZ7B + semgrep.dev: + rule: + r_id: 18264 + rv_id: 1263335 + rule_id: gxUyn1 + version_id: w8TRogj + url: https://semgrep.dev/playground/r/w8TRogj/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use + origin: community + languages: + - python + severity: ERROR + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - pattern: subprocess.$FUNC(..., shell=True, ...) + pattern-sanitizers: + - pattern: shlex.split(...) + - pattern: pipes.quote(...) + - pattern: shlex.quote(...) +- id: python.aws-lambda.security.dangerous-system-call.dangerous-system-call + mode: taint + message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this + function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier + to use without accidentally exposing a command injection vulnerability. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.2.4 Dyanmic Code Execution Features + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + version: '4' + category: security + technology: + - python + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call + shortlink: https://sg.run/jDvN + semgrep.dev: + rule: + r_id: 18265 + rv_id: 1263336 + rule_id: QrUkg6 + version_id: xyTjzbG + url: https://semgrep.dev/playground/r/xyTjzbG/python.aws-lambda.security.dangerous-system-call.dangerous-system-call + origin: community + languages: + - python + severity: ERROR + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $CMD + - pattern-either: + - pattern: os.system($CMD,...) + - pattern: os.popen($CMD,...) + - pattern: os.popen2($CMD,...) + - pattern: os.popen3($CMD,...) + - pattern: os.popen4($CMD,...) +- id: python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection + mode: taint + metadata: + cwe: + - 'CWE-943: Improper Neutralization of Special Elements in Data Query Logic' + owasp: + - A01:2017 - Injection + category: security + technology: + - python + - boto3 + - aws-lambda + - dynamodb + references: + - https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection + shortlink: https://sg.run/jjrl + semgrep.dev: + rule: + r_id: 21321 + rv_id: 946088 + rule_id: KxUJ2B + version_id: 9lTy1rQ + url: https://semgrep.dev/playground/r/9lTy1rQ/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection + origin: community + message: Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable + is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly + to DynamoDB client. + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sanitizers: + - patterns: + - pattern: '{...} + + ' + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern-either: + - pattern: $TABLE.scan(..., ScanFilter = $SINK, ...) + - pattern: $TABLE.query(..., QueryFilter = $SINK, ...) + - pattern-either: + - patterns: + - pattern-inside: '$TABLE = $DB.Table(...) + + ... + + ' + - pattern-inside: '$DB = boto3.resource(''dynamodb'', ...) + + ... + + ' + - pattern-inside: '$TABLE = boto3.client(''dynamodb'', ...) + + ... + + ' + severity: ERROR + languages: + - python +- id: python.aws-lambda.security.mysql-sqli.mysql-sqli + languages: + - python + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', (''active''))`' + mode: taint + metadata: + references: + - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html + - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - mysql + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli + shortlink: https://sg.run/1RjG + semgrep.dev: + rule: + r_id: 18266 + rv_id: 1263337 + rule_id: 3qU3eE + version_id: O9TpxLJ + url: https://semgrep.dev/playground/r/O9TpxLJ/python.aws-lambda.security.mysql-sqli.mysql-sqli + origin: community + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $CURSOR.execute($QUERY,...) + - pattern: $CURSOR.executemany($QUERY,...) + - pattern-either: + - pattern-inside: 'import mysql + + ... + + ' + - pattern-inside: 'import mysql.cursors + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: WARNING +- id: python.aws-lambda.security.psycopg-sqli.psycopg-sqli + languages: + - python + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', ''active'')`' + mode: taint + metadata: + references: + - https://www.psycopg.org/docs/cursor.html#cursor.execute + - https://www.psycopg.org/docs/cursor.html#cursor.executemany + - https://www.psycopg.org/docs/cursor.html#cursor.mogrify + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - psycopg + - psycopg2 + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli + shortlink: https://sg.run/9L8r + semgrep.dev: + rule: + r_id: 18267 + rv_id: 1263338 + rule_id: 4bUQG1 + version_id: e1TyjPZ + url: https://semgrep.dev/playground/r/e1TyjPZ/python.aws-lambda.security.psycopg-sqli.psycopg-sqli + origin: community + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern: $CURSOR.execute($QUERY,...) + - pattern: $CURSOR.executemany($QUERY,...) + - pattern: $CURSOR.mogrify($QUERY,...) + - pattern-inside: 'import psycopg2 + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: WARNING +- id: python.aws-lambda.security.pymssql-sqli.pymssql-sqli + languages: + - python + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', ''active'')`' + mode: taint + metadata: + references: + - https://pypi.org/project/pymssql/ + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - pymssql + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli + shortlink: https://sg.run/yXvP + semgrep.dev: + rule: + r_id: 18268 + rv_id: 1263339 + rule_id: PeUxO0 + version_id: vdT06bG + url: https://semgrep.dev/playground/r/vdT06bG/python.aws-lambda.security.pymssql-sqli.pymssql-sqli + origin: community + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern: $CURSOR.execute($QUERY,...) + - pattern-inside: 'import pymssql + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: WARNING +- id: python.aws-lambda.security.pymysql-sqli.pymysql-sqli + languages: + - python + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', (''active''))`' + mode: taint + metadata: + references: + - https://pypi.org/project/PyMySQL/#id4 + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - pymysql + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli + shortlink: https://sg.run/reve + semgrep.dev: + rule: + r_id: 18269 + rv_id: 1263340 + rule_id: JDUlel + version_id: d6TyxNA + url: https://semgrep.dev/playground/r/d6TyxNA/python.aws-lambda.security.pymysql-sqli.pymysql-sqli + origin: community + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern: $CURSOR.execute($QUERY,...) + - pattern-either: + - pattern-inside: 'import pymysql + + ... + + ' + - pattern-inside: 'import pymysql.cursors + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: WARNING +- id: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli + languages: + - python + message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = ?'', ''active'')`' + mode: taint + metadata: + references: + - https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + - sqlalchemy + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli + shortlink: https://sg.run/b48W + semgrep.dev: + rule: + r_id: 18270 + rv_id: 1263341 + rule_id: 5rUy3N + version_id: ZRTKARp + url: https://semgrep.dev/playground/r/ZRTKARp/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli + origin: community + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern: $CURSOR.execute($QUERY,...) + - pattern-inside: 'import sqlalchemy + + ... + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: WARNING +- id: python.aws-lambda.security.tainted-code-exec.tainted-code-exec + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - pattern-either: + - pattern: eval($CODE, ...) + - pattern: exec($CODE, ...) + message: Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can + be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable + by external sources. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.2.4 Dyanmic Code Execution Features + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + version: '4' + category: security + technology: + - python + references: + - https://owasp.org/Top10/A03_2021-Injection + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec + shortlink: https://sg.run/Ng7y + semgrep.dev: + rule: + r_id: 18271 + rv_id: 1263342 + rule_id: GdUDJP + version_id: nWT2LD2 + url: https://semgrep.dev/playground/r/nWT2LD2/python.aws-lambda.security.tainted-code-exec.tainted-code-exec + origin: community + languages: + - python + severity: WARNING +- id: python.aws-lambda.security.tainted-html-response.tainted-html-response + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - pattern: $BODY + - pattern-inside: '{..., "headers": {..., "Content-Type": "text/html", ...}, "body": $BODY, ... } + + ' + message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering + HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers + steal sensitive user data. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - aws-lambda + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response + shortlink: https://sg.run/k9vP + semgrep.dev: + rule: + r_id: 18272 + rv_id: 1263343 + rule_id: ReUKrk + version_id: ExTEx5o + url: https://semgrep.dev/playground/r/ExTEx5o/python.aws-lambda.security.tainted-html-response.tainted-html-response + origin: community + languages: + - python + severity: WARNING +- id: python.aws-lambda.security.tainted-html-string.tainted-html-string + languages: + - python + severity: WARNING + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use + templates which will safely render HTML instead. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - aws-lambda + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string + shortlink: https://sg.run/8zNy + semgrep.dev: + rule: + r_id: 18484 + rv_id: 1263344 + rule_id: JDUlwy + version_id: 7ZTE36K + url: https://semgrep.dev/playground/r/7ZTE36K/python.aws-lambda.security.tainted-html-string.tainted-html-string + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$HTMLSTR" % ...' + - pattern: '"$HTMLSTR".format(...)' + - pattern: '"$HTMLSTR" + ...' + - pattern: f"$HTMLSTR{...}..." + - patterns: + - pattern-inside: '$HTML = "$HTMLSTR" + + ... + + ' + - pattern-either: + - pattern: $HTML % ... + - pattern: $HTML.format(...) + - pattern: $HTML + ... + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... + - pattern-not-inside: 'print(...) + + ' +- id: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization + mode: taint + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern-either: + - pattern: pickle.load($SINK,...) + - pattern: pickle.loads($SINK,...) + - pattern: _pickle.load($SINK,...) + - pattern: _pickle.loads($SINK,...) + - pattern: cPickle.load($SINK,...) + - pattern: cPickle.loads($SINK,...) + - pattern: dill.load($SINK,...) + - pattern: dill.loads($SINK,...) + - pattern: shelve.open($SINK,...) + message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized + data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar + text-based serialization format. + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + references: + - https://docs.python.org/3/library/pickle.html + - https://davidhamann.de/2020/04/05/exploiting-python-pickle/ + category: security + technology: + - python + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization + shortlink: https://sg.run/JbjW + semgrep.dev: + rule: + r_id: 21602 + rv_id: 1263345 + rule_id: JDUDQg + version_id: LjTkgd9 + url: https://semgrep.dev/playground/r/LjTkgd9/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization + origin: community + languages: + - python + severity: WARNING +- id: python.aws-lambda.security.tainted-sql-string.tainted-sql-string + languages: + - python + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction + could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the + database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider + using an object-relational mapper (ORM) such as Sequelize which will protect your queries. + metadata: + references: + - https://owasp.org/www-community/attacks/SQL_Injection + category: security + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + technology: + - aws-lambda + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/wXvA + semgrep.dev: + rule: + r_id: 18273 + rv_id: 1263346 + rule_id: AbU3LX + version_id: 8KT5ron + url: https://semgrep.dev/playground/r/8KT5ron/python.aws-lambda.security.tainted-sql-string.tainted-sql-string + origin: community + mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '"$SQLSTR" + ... + + ' + - pattern: '"$SQLSTR" % ... + + ' + - pattern: '"$SQLSTR".format(...) + + ' + - pattern: 'f"$SQLSTR{...}..." + + ' + - metavariable-regex: + metavariable: $SQLSTR + regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*= + - pattern-not-inside: 'print(...) + + ' + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR +- id: python.boto3.security.hardcoded-token.hardcoded-token + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + - https://bento.dev/checks/boto3/hardcoded-access-token/ + - https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/ + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + category: security + technology: + - boto3 + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token + shortlink: https://sg.run/LwQ6 + semgrep.dev: + rule: + r_id: 9439 + rv_id: 1263347 + rule_id: 5rUOwK + version_id: gETB78n + url: https://semgrep.dev/playground/r/gETB78n/python.boto3.security.hardcoded-token.hardcoded-token + origin: community + languages: + - python + severity: WARNING + mode: taint + pattern-sources: + - pattern: '"..." + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $W(...,$TOKEN="$VALUE",...) + - pattern: $BOTO. ... .$W(...,$TOKEN="$VALUE",...) + - metavariable-regex: + metavariable: $TOKEN + regex: (aws_session_token|aws_access_key_id|aws_secret_access_key) + - metavariable-pattern: + language: generic + metavariable: $VALUE + patterns: + - pattern-either: + - pattern-regex: ^AKI + - pattern-regex: ^[A-Za-z0-9/+=]+$ + - metavariable-analysis: + metavariable: $VALUE + analyzer: entropy +- id: python.cryptography.security.empty-aes-key.empty-aes-key + message: Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may + allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption. + patterns: + - pattern: AES.new("",...) + languages: + - python + severity: WARNING + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + - 'CWE-310: Cryptographic Issues' + references: + - https://cwe.mitre.org/data/definitions/327.html + - https://cwe.mitre.org/data/definitions/310.html + category: security + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + owasp: A6:2017 misconfiguration + functional-categories: + - crypto::search::key-length::pycrypto + - crypto::search::key-length::pycryptodome + technology: + - python + - pycrypto + - pycryptodome + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key + shortlink: https://sg.run/zQ9G + semgrep.dev: + rule: + r_id: 44817 + rv_id: 946105 + rule_id: OrUADK + version_id: 8KTKjRg + url: https://semgrep.dev/playground/r/8KTKjRg/python.cryptography.security.empty-aes-key.empty-aes-key + origin: community +- id: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 + message: ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output. Its use is strongly + discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` + package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, + keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers + category: security + technology: + - cryptography + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 + shortlink: https://sg.run/xoZL + semgrep.dev: + rule: + r_id: 33630 + rv_id: 1263348 + rule_id: KxU8gK + version_id: QkTGq3Q + url: https://semgrep.dev/playground/r/QkTGq3Q/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 + origin: community + severity: WARNING + languages: + - python + patterns: + - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$ARC4($KEY) + - pattern-inside: cryptography.hazmat.primitives.ciphers.Cipher(...) + - metavariable-regex: + metavariable: $ARC4 + regex: ^(ARC4)$ + - focus-metavariable: $ARC4 + fix: AES +- id: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish + message: Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak + keys. The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` + package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, + keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers + - https://tools.ietf.org/html/rfc5469 + category: security + technology: + - cryptography + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish + shortlink: https://sg.run/OdzL + semgrep.dev: + rule: + r_id: 33631 + rv_id: 1263349 + rule_id: qNULvO + version_id: 3ZT4XK7 + url: https://semgrep.dev/playground/r/3ZT4XK7/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish + origin: community + severity: WARNING + languages: + - python + patterns: + - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$BLOWFISH($KEY) + - metavariable-regex: + metavariable: $BLOWFISH + regex: ^(Blowfish)$ + - focus-metavariable: $BLOWFISH + fix: AES +- id: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea + message: IDEA (International Data Encryption Algorithm) is a block cipher created in 1991. It is an optional component + of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys. It is recommended that you do not + use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package + it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, + keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://tools.ietf.org/html/rfc5469 + - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA + category: security + technology: + - cryptography + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea + shortlink: https://sg.run/3xyK + semgrep.dev: + rule: + r_id: 9443 + rv_id: 1263350 + rule_id: BYUNPg + version_id: 44TEjNJ + url: https://semgrep.dev/playground/r/44TEjNJ/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea + origin: community + severity: WARNING + languages: + - python + patterns: + - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$IDEA($KEY) + - metavariable-regex: + metavariable: $IDEA + regex: ^(IDEA)$ + - focus-metavariable: $IDEA + fix: AES +- id: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb + message: ECB (Electronic Code Book) is the simplest mode of operation for block ciphers. Each block of data is encrypted + in the same way. This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave + significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L101 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B305 + references: + - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes + - https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption + category: security + technology: + - cryptography + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: MEDIUM + functional-categories: + - crypto::search::mode::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb + shortlink: https://sg.run/4xr5 + semgrep.dev: + rule: + r_id: 9444 + rv_id: 1263351 + rule_id: DbUp5g + version_id: PkTR3w7 + url: https://semgrep.dev/playground/r/PkTR3w7/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb + origin: community + severity: WARNING + languages: + - python + pattern: cryptography.hazmat.primitives.ciphers.modes.ECB($IV) + fix: cryptography.hazmat.primitives.ciphers.modes.GCM($IV) +- id: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use SHA256 or SHA3 instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B303 + references: + - https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5 + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - cryptography + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + shortlink: https://sg.run/eY88 + semgrep.dev: + rule: + r_id: 33632 + rv_id: 1263352 + rule_id: lBUopp + version_id: JdTzxww + url: https://semgrep.dev/playground/r/JdTzxww/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + origin: community + severity: WARNING + languages: + - python + patterns: + - pattern: cryptography.hazmat.primitives.hashes.$MD5() + - metavariable-regex: + metavariable: $MD5 + regex: ^(MD5)$ + - focus-metavariable: $MD5 + fix: SHA256 +- id: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + patterns: + - pattern: cryptography.hazmat.primitives.hashes.$SHA(...) + - metavariable-pattern: + metavariable: $SHA + pattern: 'SHA1 + + ' + - focus-metavariable: $SHA + fix: 'SHA256 + + ' + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B303 + references: + - https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1 + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - cryptography + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + shortlink: https://sg.run/J9Qy + semgrep.dev: + rule: + r_id: 9446 + rv_id: 1263353 + rule_id: 0oU5dN + version_id: 5PTo1l0 + url: https://semgrep.dev/playground/r/5PTo1l0/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + origin: community + severity: WARNING + languages: + - python +- id: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size + patterns: + - pattern-either: + - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(..., key_size=$SIZE, ...) + - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key($SIZE, ...) + - metavariable-comparison: + metavariable: $SIZE + comparison: $SIZE < 2048 + - focus-metavariable: $SIZE + fix: '2048 + + ' + message: Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + references: + - https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf + - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/ + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf + category: security + technology: + - cryptography + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::key-length::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size + shortlink: https://sg.run/5Qb0 + semgrep.dev: + rule: + r_id: 9447 + rv_id: 1263354 + rule_id: KxUb0x + version_id: GxTkeOK + url: https://semgrep.dev/playground/r/GxTkeOK/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size + origin: community + languages: + - python + severity: WARNING +- id: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size + patterns: + - pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...) + - pattern: cryptography.hazmat.primitives.asymmetric.ec.$SIZE + - metavariable-pattern: + metavariable: $SIZE + pattern-either: + - pattern: SECP192R1 + - pattern: SECT163K1 + - pattern: SECT163R2 + - focus-metavariable: $SIZE + fix: 'SECP256R1 + + ' + message: Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf + - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves + category: security + technology: + - cryptography + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::key-length::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size + shortlink: https://sg.run/GeQq + semgrep.dev: + rule: + r_id: 9448 + rv_id: 1263355 + rule_id: qNUjZ3 + version_id: RGT0LW6 + url: https://semgrep.dev/playground/r/RGT0LW6/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size + origin: community + languages: + - python + severity: WARNING +- id: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size + patterns: + - pattern-either: + - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(..., key_size=$SIZE, ...) + - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key($EXP, $SIZE, ...) + - metavariable-comparison: + metavariable: $SIZE + comparison: $SIZE < 2048 + - focus-metavariable: $SIZE + fix: '2048 + + ' + message: Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + references: + - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/ + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf + category: security + technology: + - cryptography + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + functional-categories: + - crypto::search::key-length::cryptography + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size + shortlink: https://sg.run/RoQq + semgrep.dev: + rule: + r_id: 9449 + rv_id: 1263356 + rule_id: lBU9jn + version_id: A8TgdPK + url: https://semgrep.dev/playground/r/A8TgdPK/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size + origin: community + languages: + - python + severity: WARNING +- id: python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication + message: 'An encryption mode of operation is being used without proper message authentication. This can potentially result + in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ' + languages: + - python + severity: ERROR + metadata: + category: security + technology: + - cryptography + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication + shortlink: https://sg.run/N9JL + semgrep.dev: + rule: + r_id: 31871 + rv_id: 1263357 + rule_id: lBUpNZ + version_id: BjTkZj5 + url: https://semgrep.dev/playground/r/BjTkZj5/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication + origin: community + patterns: + - pattern-either: + - patterns: + - pattern: 'Cipher(..., $HAZMAT_MODE(...),...) + + ' + - pattern-not-inside: 'Cipher(..., $HAZMAT_MODE(...),...) + + ... + + HMAC(...) + + ' + - pattern-not-inside: 'Cipher(..., $HAZMAT_MODE(...),...) + + ... + + hmac.HMAC(...) + + ' + - metavariable-pattern: + metavariable: $HAZMAT_MODE + patterns: + - pattern-either: + - pattern: modes.CTR + - pattern: modes.CBC + - pattern: modes.CFB + - pattern: modes.OFB +- id: python.distributed.security.require-encryption + patterns: + - pattern: 'distributed.security.Security(..., require_encryption=$VAL, ...) + + ' + - metavariable-pattern: + metavariable: $VAL + pattern: 'False + + ' + - focus-metavariable: $VAL + fix: 'True + + ' + message: Initializing a security context for Dask (`distributed`) without "require_encryption" keyword argument may silently + fail to provide security. + severity: WARNING + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters + category: security + technology: + - distributed + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.distributed.security.require-encryption + shortlink: https://sg.run/AvQ2 + semgrep.dev: + rule: + r_id: 9450 + rv_id: 1263358 + rule_id: YGURy0 + version_id: DkTRbol + url: https://semgrep.dev/playground/r/DkTRbol/python.distributed.security.require-encryption + origin: community + languages: + - python +- id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + references: + - https://docs.python.org/3/library/pickle.html + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization + shortlink: https://sg.run/9oyr + semgrep.dev: + rule: + r_id: 9467 + rv_id: 1409400 + rule_id: OrU3e6 + version_id: GxTlb9e + url: https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization + origin: community + message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, + which are known to lead to remote code execution vulnerabilities. + languages: + - python + severity: ERROR + mode: taint + pattern-sources: + - pattern-either: + - patterns: + - pattern-inside: "def $INSIDE(..., $PARAM, ...):\n ...\n" + - pattern-either: + - pattern: request.$REQFUNC(...) + - pattern: request.$REQFUNC.get(...) + - pattern: request.$REQFUNC[...] + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern: 'pickle.$PICKLEFUNC(...) + + ' + - pattern: '_pickle.$PICKLEFUNC(...) + + ' + - pattern: 'cPickle.$PICKLEFUNC(...) + + ' + - pattern: 'shelve.$PICKLEFUNC(...) + + ' + - metavariable-regex: + metavariable: $PICKLEFUNC + regex: dumps|dump|load|loads + - patterns: + - pattern: dill.$DILLFUNC(...) + - metavariable-regex: + metavariable: $DILLFUNC + regex: dump|dump_session|dumps|load|load_session|loads + - patterns: + - pattern: yaml.$YAMLFUNC(...) + - pattern-not: yaml.$YAMLFUNC(..., Dumper=SafeDumper, ...) + - pattern-not: yaml.$YAMLFUNC(..., Dumper=yaml.SafeDumper, ...) + - pattern-not: yaml.$YAMLFUNC(..., Loader=SafeLoader, ...) + - pattern-not: yaml.$YAMLFUNC(..., Loader=yaml.SafeLoader, ...) + - metavariable-regex: + metavariable: $YAMLFUNC + regex: dump|dump_all|load|load_all +- id: python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid + patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-inside: "if $FORM.is_valid():\n ...\n" + - pattern-either: + - pattern: request.POST[...] + - pattern: request.POST.get(...) + message: Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized + data + languages: + - python + severity: WARNING + metadata: + category: security + cwe: 'CWE-20: Improper Input Validation' + references: + - https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data + confidence: MEDIUM + likelihood: MEDIUM + impact: MEDIUM + subcategory: + - audit + technology: + - django + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid + shortlink: https://sg.run/kJn7 + semgrep.dev: + rule: + r_id: 73472 + rv_id: 946161 + rule_id: JDUjqx + version_id: DkTNpEJ + url: https://semgrep.dev/playground/r/DkTNpEJ/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid + origin: community +- id: python.django.security.hashids-with-django-secret.hashids-with-django-secret + languages: + - python + message: The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, + the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through + the HashIDs. + metadata: + category: security + subcategory: + - vuln + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A02:2021 – Cryptographic Failures + references: + - https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY + - http://carnage.github.io/2015/08/cryptanalysis-of-hashids + technology: + - django + likelihood: LOW + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret + shortlink: https://sg.run/bxeZ + semgrep.dev: + rule: + r_id: 72426 + rv_id: 946163 + rule_id: 0oUXqy + version_id: 0bT15nn + url: https://semgrep.dev/playground/r/0bT15nn/python.django.security.hashids-with-django-secret.hashids-with-django-secret + origin: community + pattern-either: + - pattern: hashids.Hashids(..., salt=django.conf.settings.SECRET_KEY, ...) + - pattern: hashids.Hashids(django.conf.settings.SECRET_KEY, ...) + severity: ERROR +- id: python.django.security.injection.code.user-eval-format-string.user-eval-format-string + message: Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote + code. See https://owasp.org/www-community/attacks/Code_Injection for more information. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html + category: security + technology: + - django + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string + shortlink: https://sg.run/4x2z + semgrep.dev: + rule: + r_id: 9500 + rv_id: 1263383 + rule_id: BYUNw9 + version_id: vdT06xG + url: https://semgrep.dev/playground/r/vdT06xG/python.django.security.injection.code.user-eval-format-string.user-eval-format-string + origin: community + patterns: + - pattern-inside: "def $F(...):\n ...\n" + - pattern-either: + - pattern: eval(..., $STR % request.$W.get(...), ...) + - pattern: '$V = request.$W.get(...) + + ... + + eval(..., $STR % $V, ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + $S = $STR % $V + + ... + + eval(..., $S, ...) + + ' + - pattern: eval(..., "..." % request.$W(...), ...) + - pattern: '$V = request.$W(...) + + ... + + eval(..., $STR % $V, ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + $S = $STR % $V + + ... + + eval(..., $S, ...) + + ' + - pattern: eval(..., $STR % request.$W[...], ...) + - pattern: '$V = request.$W[...] + + ... + + eval(..., $STR % $V, ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + $S = $STR % $V + + ... + + eval(..., $S, ...) + + ' + - pattern: eval(..., $STR.format(..., request.$W.get(...), ...), ...) + - pattern: '$V = request.$W.get(...) + + ... + + eval(..., $STR.format(..., $V, ...), ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + $S = $STR.format(..., $V, ...) + + ... + + eval(..., $S, ...) + + ' + - pattern: eval(..., $STR.format(..., request.$W(...), ...), ...) + - pattern: '$V = request.$W(...) + + ... + + eval(..., $STR.format(..., $V, ...), ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + $S = $STR.format(..., $V, ...) + + ... + + eval(..., $S, ...) + + ' + - pattern: eval(..., $STR.format(..., request.$W[...], ...), ...) + - pattern: '$V = request.$W[...] + + ... + + eval(..., $STR.format(..., $V, ...), ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + $S = $STR.format(..., $V, ...) + + ... + + eval(..., $S, ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + eval(..., f"...{$V}...", ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + $S = f"...{$V}..." + + ... + + eval(..., $S, ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + eval(..., f"...{$V}...", ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + $S = f"...{$V}..." + + ... + + eval(..., $S, ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + eval(..., f"...{$V}...", ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + $S = f"...{$V}..." + + ... + + eval(..., $S, ...) + + ' + languages: + - python + severity: WARNING +- id: python.django.security.injection.code.user-eval.user-eval + message: Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary + remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific + functionality you need. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html + - https://owasp.org/www-community/attacks/Code_Injection + category: security + technology: + - django + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval + shortlink: https://sg.run/PJDW + semgrep.dev: + rule: + r_id: 9501 + rv_id: 1263384 + rule_id: DbUpDQ + version_id: d6Tyx2A + url: https://semgrep.dev/playground/r/d6Tyx2A/python.django.security.injection.code.user-eval.user-eval + origin: community + patterns: + - pattern-inside: "def $F(...):\n ...\n" + - pattern-either: + - pattern: eval(..., request.$W.get(...), ...) + - pattern: '$V = request.$W.get(...) + + ... + + eval(..., $V, ...) + + ' + - pattern: eval(..., request.$W(...), ...) + - pattern: '$V = request.$W(...) + + ... + + eval(..., $V, ...) + + ' + - pattern: eval(..., request.$W[...], ...) + - pattern: '$V = request.$W[...] + + ... + + eval(..., $V, ...) + + ' + languages: + - python + severity: WARNING +- id: python.django.security.injection.code.user-exec-format-string.user-exec-format-string + message: Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary + remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific + functionality you need. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - django + references: + - https://owasp.org/www-community/attacks/Code_Injection + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string + shortlink: https://sg.run/J9JW + semgrep.dev: + rule: + r_id: 9502 + rv_id: 1263385 + rule_id: WAUovx + version_id: ZRTKA1p + url: https://semgrep.dev/playground/r/ZRTKA1p/python.django.security.injection.code.user-exec-format-string.user-exec-format-string + origin: community + patterns: + - pattern-inside: "def $F(...):\n ...\n" + - pattern-either: + - pattern: exec(..., $STR % request.$W.get(...), ...) + - pattern: '$V = request.$W.get(...) + + ... + + exec(..., $STR % $V, ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + $S = $STR % $V + + ... + + exec(..., $S, ...) + + ' + - pattern: exec(..., "..." % request.$W(...), ...) + - pattern: '$V = request.$W(...) + + ... + + exec(..., $STR % $V, ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + $S = $STR % $V + + ... + + exec(..., $S, ...) + + ' + - pattern: exec(..., $STR % request.$W[...], ...) + - pattern: '$V = request.$W[...] + + ... + + exec(..., $STR % $V, ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + $S = $STR % $V + + ... + + exec(..., $S, ...) + + ' + - pattern: exec(..., $STR.format(..., request.$W.get(...), ...), ...) + - pattern: '$V = request.$W.get(...) + + ... + + exec(..., $STR.format(..., $V, ...), ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + $S = $STR.format(..., $V, ...) + + ... + + exec(..., $S, ...) + + ' + - pattern: exec(..., $STR.format(..., request.$W(...), ...), ...) + - pattern: '$V = request.$W(...) + + ... + + exec(..., $STR.format(..., $V, ...), ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + $S = $STR.format(..., $V, ...) + + ... + + exec(..., $S, ...) + + ' + - pattern: exec(..., $STR.format(..., request.$W[...], ...), ...) + - pattern: '$V = request.$W[...] + + ... + + exec(..., $STR.format(..., $V, ...), ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + $S = $STR.format(..., $V, ...) + + ... + + exec(..., $S, ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + exec(..., f"...{$V}...", ...) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + $S = f"...{$V}..." + + ... + + exec(..., $S, ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + exec(..., f"...{$V}...", ...) + + ' + - pattern: '$V = request.$W(...) + + ... + + $S = f"...{$V}..." + + ... + + exec(..., $S, ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + exec(..., f"...{$V}...", ...) + + ' + - pattern: '$V = request.$W[...] + + ... + + $S = f"...{$V}..." + + ... + + exec(..., $S, ...) + + ' + - pattern: exec(..., base64.decodestring($S.format(..., request.$W.get(...), ...), ...), ...) + - pattern: exec(..., base64.decodestring($S % request.$W.get(...), ...), ...) + - pattern: exec(..., base64.decodestring(f"...{request.$W.get(...)}...", ...), ...) + - pattern: exec(..., base64.decodestring(request.$W.get(...), ...), ...) + - pattern: exec(..., base64.decodestring(bytes($S.format(..., request.$W.get(...), ...), ...), ...), ...) + - pattern: exec(..., base64.decodestring(bytes($S % request.$W.get(...), ...), ...), ...) + - pattern: exec(..., base64.decodestring(bytes(f"...{request.$W.get(...)}...", ...), ...), ...) + - pattern: exec(..., base64.decodestring(bytes(request.$W.get(...), ...), ...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + exec(..., base64.decodestring($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = base64.decodestring($DATA, ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = base64.decodestring(bytes($DATA, ...), ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + exec(..., base64.decodestring($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = base64.decodestring($DATA, ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = base64.decodestring(bytes($DATA, ...), ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + exec(..., base64.decodestring($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = base64.decodestring($DATA, ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = base64.decodestring(bytes($DATA, ...), ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + exec(..., base64.decodestring($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = base64.decodestring($DATA, ...) + + ... + + exec(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = base64.decodestring(bytes($DATA, ...), ...) + + ... + + exec(..., $INTERM, ...) + + ' + languages: + - python + severity: WARNING +- id: python.django.security.injection.code.user-exec.user-exec + message: Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary + remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific + functionality you need. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - django + references: + - https://owasp.org/www-community/attacks/Code_Injection + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec + shortlink: https://sg.run/5Q3X + semgrep.dev: + rule: + r_id: 9503 + rv_id: 1263386 + rule_id: 0oU5AW + version_id: nWT2LA2 + url: https://semgrep.dev/playground/r/nWT2LA2/python.django.security.injection.code.user-exec.user-exec + origin: community + patterns: + - pattern-inside: "def $F(...):\n ...\n" + - pattern-either: + - pattern: exec(..., request.$W.get(...), ...) + - pattern: '$V = request.$W.get(...) + + ... + + exec(..., $V, ...) + + ' + - pattern: exec(..., request.$W(...), ...) + - pattern: '$V = request.$W(...) + + ... + + exec(..., $V, ...) + + ' + - pattern: exec(..., request.$W[...], ...) + - pattern: '$V = request.$W[...] + + ... + + exec(..., $V, ...) + + ' + - pattern: 'loop = asyncio.get_running_loop() + + ... + + await loop.run_in_executor(None, exec, request.$W[...]) + + ' + - pattern: '$V = request.$W[...] + + ... + + loop = asyncio.get_running_loop() + + ... + + await loop.run_in_executor(None, exec, $V) + + ' + - pattern: 'loop = asyncio.get_running_loop() + + ... + + await loop.run_in_executor(None, exec, request.$W.get(...)) + + ' + - pattern: '$V = request.$W.get(...) + + ... + + loop = asyncio.get_running_loop() + + ... + + await loop.run_in_executor(None, exec, $V) + + ' + languages: + - python + severity: WARNING +- id: python.django.security.injection.command.command-injection-os-system.command-injection-os-system + message: Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this + must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection + for more information. + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/Command_Injection + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system + shortlink: https://sg.run/Gen2 + semgrep.dev: + rule: + r_id: 9504 + rv_id: 1263387 + rule_id: KxUbp2 + version_id: ExTExPo + url: https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system + origin: community + languages: + - python + severity: ERROR + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: os.system(..., request.$W.get(...), ...) + - pattern: os.system(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: os.system(..., $S % request.$W.get(...), ...) + - pattern: os.system(..., f"...{request.$W.get(...)}...", ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + os.system(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + os.system(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + os.system(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + os.system(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + os.system(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: $A = os.system(..., request.$W.get(...), ...) + - pattern: $A = os.system(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: $A = os.system(..., $S % request.$W.get(...), ...) + - pattern: $A = os.system(..., f"...{request.$W.get(...)}...", ...) + - pattern: return os.system(..., request.$W.get(...), ...) + - pattern: return os.system(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: return os.system(..., $S % request.$W.get(...), ...) + - pattern: return os.system(..., f"...{request.$W.get(...)}...", ...) + - pattern: os.system(..., request.$W(...), ...) + - pattern: os.system(..., $S.format(..., request.$W(...), ...), ...) + - pattern: os.system(..., $S % request.$W(...), ...) + - pattern: os.system(..., f"...{request.$W(...)}...", ...) + - pattern: '$DATA = request.$W(...) + + ... + + os.system(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + os.system(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + os.system(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + os.system(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + os.system(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: $A = os.system(..., request.$W(...), ...) + - pattern: $A = os.system(..., $S.format(..., request.$W(...), ...), ...) + - pattern: $A = os.system(..., $S % request.$W(...), ...) + - pattern: $A = os.system(..., f"...{request.$W(...)}...", ...) + - pattern: return os.system(..., request.$W(...), ...) + - pattern: return os.system(..., $S.format(..., request.$W(...), ...), ...) + - pattern: return os.system(..., $S % request.$W(...), ...) + - pattern: return os.system(..., f"...{request.$W(...)}...", ...) + - pattern: os.system(..., request.$W[...], ...) + - pattern: os.system(..., $S.format(..., request.$W[...], ...), ...) + - pattern: os.system(..., $S % request.$W[...], ...) + - pattern: os.system(..., f"...{request.$W[...]}...", ...) + - pattern: '$DATA = request.$W[...] + + ... + + os.system(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + os.system(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + os.system(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + os.system(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + os.system(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: $A = os.system(..., request.$W[...], ...) + - pattern: $A = os.system(..., $S.format(..., request.$W[...], ...), ...) + - pattern: $A = os.system(..., $S % request.$W[...], ...) + - pattern: $A = os.system(..., f"...{request.$W[...]}...", ...) + - pattern: return os.system(..., request.$W[...], ...) + - pattern: return os.system(..., $S.format(..., request.$W[...], ...), ...) + - pattern: return os.system(..., $S % request.$W[...], ...) + - pattern: return os.system(..., f"...{request.$W[...]}...", ...) + - pattern: os.system(..., request.$W, ...) + - pattern: os.system(..., $S.format(..., request.$W, ...), ...) + - pattern: os.system(..., $S % request.$W, ...) + - pattern: os.system(..., f"...{request.$W}...", ...) + - pattern: '$DATA = request.$W + + ... + + os.system(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + os.system(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + os.system(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + os.system(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + os.system(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + os.system(..., $INTERM, ...) + + ' + - pattern: $A = os.system(..., request.$W, ...) + - pattern: $A = os.system(..., $S.format(..., request.$W, ...), ...) + - pattern: $A = os.system(..., $S % request.$W, ...) + - pattern: $A = os.system(..., f"...{request.$W}...", ...) + - pattern: return os.system(..., request.$W, ...) + - pattern: return os.system(..., $S.format(..., request.$W, ...), ...) + - pattern: return os.system(..., $S % request.$W, ...) + - pattern: return os.system(..., f"...{request.$W}...", ...) +- id: python.django.security.injection.command.subprocess-injection.subprocess-injection + languages: + - python + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-inside: "def $FUNC(..., $REQUEST, ...):\n ...\n" + - focus-metavariable: $REQUEST + - metavariable-pattern: + metavariable: $REQUEST + patterns: + - pattern: request + - pattern-not-inside: request.build_absolute_uri + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: subprocess.$FUNC(...) + - pattern-not: subprocess.$FUNC("...", ...) + - pattern-not: subprocess.$FUNC(["...", ...], ...) + - pattern-not-inside: '$CMD = ["...", ...] + + ... + + subprocess.$FUNC($CMD, ...) + + ' + - patterns: + - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...) + - metavariable-regex: + metavariable: $SHELL + regex: ^(sh|bash|ksh|csh|tcsh|zsh)$ + - patterns: + - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...) + - metavariable-regex: + metavariable: $INTERPRETER + regex: ^(python|python\d)$ + pattern-sanitizers: + - patterns: + - pattern: $DICT[$KEY] + - focus-metavariable: $KEY + severity: ERROR + message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. + An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, + scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, + prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set + of commands. + metadata: + category: security + technology: + - flask + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection + shortlink: https://sg.run/49BE + semgrep.dev: + rule: + r_id: 31144 + rv_id: 1263388 + rule_id: EwUepx + version_id: 7ZTE3qK + url: https://semgrep.dev/playground/r/7ZTE3qK/python.django.security.injection.command.subprocess-injection.subprocess-injection + origin: community +- id: python.django.security.injection.csv-writer-injection.csv-writer-injection + languages: + - python + message: Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate + the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet + application that runs an attacker script, which could steal data from the importing user or, at worst, install malware + on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula + injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs. + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-1236: Improper Neutralization of Formula Elements in a CSV File' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://github.com/raphaelm/defusedcsv + - https://owasp.org/www-community/attacks/CSV_Injection + - https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities + technology: + - django + - python + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.django.security.injection.csv-writer-injection.csv-writer-injection + shortlink: https://sg.run/Pw9q + semgrep.dev: + rule: + r_id: 31145 + rv_id: 1263389 + rule_id: 7KUK1y + version_id: LjTkgD9 + url: https://semgrep.dev/playground/r/LjTkgD9/python.django.security.injection.csv-writer-injection.csv-writer-injection + origin: community + mode: taint + pattern-sinks: + - patterns: + - pattern-inside: '$WRITER = csv.writer(...) + + + ... + + + $WRITER.$WRITE(...) + + ' + - pattern: $WRITER.$WRITE(...) + - metavariable-regex: + metavariable: $WRITE + regex: ^(writerow|writerows|writeheader)$ + pattern-sources: + - patterns: + - pattern-inside: "def $FUNC(..., $REQUEST, ...):\n ...\n" + - focus-metavariable: $REQUEST + - metavariable-pattern: + metavariable: $REQUEST + patterns: + - pattern: request + - pattern-not-inside: request.build_absolute_uri + severity: ERROR +- id: python.django.security.injection.email.xss-html-email-body.xss-html-email-body + message: Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible + to XSS. An attacker could inject data into this HTML email, causing XSS. + metadata: + cwe: + - 'CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (''Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://www.damonkohler.com/2008/12/email-injection.html + category: security + technology: + - django + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body + shortlink: https://sg.run/RoBe + semgrep.dev: + rule: + r_id: 9505 + rv_id: 1263390 + rule_id: qNUj02 + version_id: 8KT5rOn + url: https://semgrep.dev/playground/r/8KT5rOn/python.django.security.injection.email.xss-html-email-body.xss-html-email-body + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n $EMAIL.content_subtype = \"html\"\n ...\n" + - pattern-either: + - pattern: django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.EmailMessage($SUBJ, $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...) + - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...) + - pattern: django.core.mail.EmailMessage($SUBJ, request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.EmailMessage($SUBJ, $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W(...), ...) + - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W(...), ...) + - pattern: django.core.mail.EmailMessage($SUBJ, request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.EmailMessage($SUBJ, $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W[...], ...) + - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W[...], ...) + - pattern: django.core.mail.EmailMessage($SUBJ, request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + django.core.mail.EmailMessage($SUBJ, $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.EmailMessage($SUBJ, $INTERM, ...) + + ' + - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W, ...) + - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W, ...) +- id: python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message + message: Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible + to XSS. An attacker could inject data into this HTML email, causing XSS. + metadata: + cwe: + - 'CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (''Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://www.damonkohler.com/2008/12/email-injection.html + category: security + technology: + - django + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message + shortlink: https://sg.run/Avx8 + semgrep.dev: + rule: + r_id: 9506 + rv_id: 1263391 + rule_id: lBU9Ll + version_id: gETB7Gn + url: https://semgrep.dev/playground/r/gETB7Gn/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: django.core.mail.send_mail(..., html_message=request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.send_mail(..., html_message=$DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W.get(...), ...) + - pattern: return django.core.mail.send_mail(..., html_message=request.$W.get(...), ...) + - pattern: django.core.mail.send_mail(..., html_message=request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.send_mail(..., html_message=$DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W(...), ...) + - pattern: return django.core.mail.send_mail(..., html_message=request.$W(...), ...) + - pattern: django.core.mail.send_mail(..., html_message=request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.send_mail(..., html_message=$DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W[...], ...) + - pattern: return django.core.mail.send_mail(..., html_message=request.$W[...], ...) + - pattern: django.core.mail.send_mail(..., html_message=request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + django.core.mail.send_mail(..., html_message=$DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + django.core.mail.send_mail(..., html_message=$INTERM, ...) + + ' + - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W, ...) + - pattern: return django.core.mail.send_mail(..., html_message=request.$W, ...) +- id: python.django.security.injection.open-redirect.open-redirect + message: Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you + are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html + for more information. + metadata: + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/ + - https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231 + category: security + technology: + - django + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect + shortlink: https://sg.run/Ave2 + semgrep.dev: + rule: + r_id: 9494 + rv_id: 1263393 + rule_id: PeUZgr + version_id: 3ZT4XD7 + url: https://semgrep.dev/playground/r/3ZT4XD7/python.django.security.injection.open-redirect.open-redirect + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-not-inside: "def $FUNC(...):\n ...\n django.utils.http.is_safe_url(...)\n ...\n" + - pattern-not-inside: "def $FUNC(...):\n ...\n if <... django.utils.http.is_safe_url(...) ...>:\n ...\n" + - pattern-not-inside: "def $FUNC(...):\n ...\n django.utils.http.url_has_allowed_host_and_scheme(...)\n ...\n" + - pattern-not-inside: "def $FUNC(...):\n ...\n if <... django.utils.http.url_has_allowed_host_and_scheme(...) ...>:\n\ + \ ...\n" + - pattern-either: + - pattern: django.shortcuts.redirect(..., request.$W.get(...), ...) + - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: django.shortcuts.redirect(..., $S % request.$W.get(...), ...) + - pattern: django.shortcuts.redirect(..., f"...{request.$W.get(...)}...", ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.shortcuts.redirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.shortcuts.redirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.shortcuts.redirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.shortcuts.redirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: $A = django.shortcuts.redirect(..., request.$W.get(...), ...) + - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: $A = django.shortcuts.redirect(..., $S % request.$W.get(...), ...) + - pattern: $A = django.shortcuts.redirect(..., f"...{request.$W.get(...)}...", ...) + - pattern: return django.shortcuts.redirect(..., request.$W.get(...), ...) + - pattern: return django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: return django.shortcuts.redirect(..., $S % request.$W.get(...), ...) + - pattern: return django.shortcuts.redirect(..., f"...{request.$W.get(...)}...", ...) + - pattern: django.shortcuts.redirect(..., request.$W(...), ...) + - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...) + - pattern: django.shortcuts.redirect(..., $S % request.$W(...), ...) + - pattern: django.shortcuts.redirect(..., f"...{request.$W(...)}...", ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.shortcuts.redirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.shortcuts.redirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.shortcuts.redirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.shortcuts.redirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: $A = django.shortcuts.redirect(..., request.$W(...), ...) + - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...) + - pattern: $A = django.shortcuts.redirect(..., $S % request.$W(...), ...) + - pattern: $A = django.shortcuts.redirect(..., f"...{request.$W(...)}...", ...) + - pattern: return django.shortcuts.redirect(..., request.$W(...), ...) + - pattern: return django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...) + - pattern: return django.shortcuts.redirect(..., $S % request.$W(...), ...) + - pattern: return django.shortcuts.redirect(..., f"...{request.$W(...)}...", ...) + - pattern: django.shortcuts.redirect(..., request.$W[...], ...) + - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...) + - pattern: django.shortcuts.redirect(..., $S % request.$W[...], ...) + - pattern: django.shortcuts.redirect(..., f"...{request.$W[...]}...", ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.shortcuts.redirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.shortcuts.redirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.shortcuts.redirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.shortcuts.redirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: $A = django.shortcuts.redirect(..., request.$W[...], ...) + - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...) + - pattern: $A = django.shortcuts.redirect(..., $S % request.$W[...], ...) + - pattern: $A = django.shortcuts.redirect(..., f"...{request.$W[...]}...", ...) + - pattern: return django.shortcuts.redirect(..., request.$W[...], ...) + - pattern: return django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...) + - pattern: return django.shortcuts.redirect(..., $S % request.$W[...], ...) + - pattern: return django.shortcuts.redirect(..., f"...{request.$W[...]}...", ...) + - pattern: django.shortcuts.redirect(..., request.$W, ...) + - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...) + - pattern: django.shortcuts.redirect(..., $S % request.$W, ...) + - pattern: django.shortcuts.redirect(..., f"...{request.$W}...", ...) + - pattern: '$DATA = request.$W + + ... + + django.shortcuts.redirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.shortcuts.redirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.shortcuts.redirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.shortcuts.redirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + django.shortcuts.redirect(..., $INTERM, ...) + + ' + - pattern: $A = django.shortcuts.redirect(..., request.$W, ...) + - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...) + - pattern: $A = django.shortcuts.redirect(..., $S % request.$W, ...) + - pattern: $A = django.shortcuts.redirect(..., f"...{request.$W}...", ...) + - pattern: return django.shortcuts.redirect(..., request.$W, ...) + - pattern: return django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...) + - pattern: return django.shortcuts.redirect(..., $S % request.$W, ...) + - pattern: return django.shortcuts.redirect(..., f"...{request.$W}...", ...) + - pattern: django.http.HttpResponseRedirect(..., request.$W.get(...), ...) + - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...) + - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W.get(...)}...", ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseRedirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseRedirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseRedirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseRedirect(..., request.$W.get(...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., f"...{request.$W.get(...)}...", ...) + - pattern: return django.http.HttpResponseRedirect(..., request.$W.get(...), ...) + - pattern: return django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: return django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...) + - pattern: return django.http.HttpResponseRedirect(..., f"...{request.$W.get(...)}...", ...) + - pattern: django.http.HttpResponseRedirect(..., request.$W(...), ...) + - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...) + - pattern: django.http.HttpResponseRedirect(..., $S % request.$W(...), ...) + - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W(...)}...", ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseRedirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseRedirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseRedirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseRedirect(..., request.$W(...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W(...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., f"...{request.$W(...)}...", ...) + - pattern: return django.http.HttpResponseRedirect(..., request.$W(...), ...) + - pattern: return django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...) + - pattern: return django.http.HttpResponseRedirect(..., $S % request.$W(...), ...) + - pattern: return django.http.HttpResponseRedirect(..., f"...{request.$W(...)}...", ...) + - pattern: django.http.HttpResponseRedirect(..., request.$W[...], ...) + - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...) + - pattern: django.http.HttpResponseRedirect(..., $S % request.$W[...], ...) + - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W[...]}...", ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseRedirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseRedirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseRedirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseRedirect(..., request.$W[...], ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W[...], ...) + - pattern: $A = django.http.HttpResponseRedirect(..., f"...{request.$W[...]}...", ...) + - pattern: return django.http.HttpResponseRedirect(..., request.$W[...], ...) + - pattern: return django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...) + - pattern: return django.http.HttpResponseRedirect(..., $S % request.$W[...], ...) + - pattern: return django.http.HttpResponseRedirect(..., f"...{request.$W[...]}...", ...) + - pattern: django.http.HttpResponseRedirect(..., request.$W, ...) + - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...) + - pattern: django.http.HttpResponseRedirect(..., $S % request.$W, ...) + - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W}...", ...) + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseRedirect(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseRedirect(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseRedirect(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseRedirect(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseRedirect(..., request.$W, ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...) + - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W, ...) + - pattern: $A = django.http.HttpResponseRedirect(..., f"...{request.$W}...", ...) + - pattern: return django.http.HttpResponseRedirect(..., request.$W, ...) + - pattern: return django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...) + - pattern: return django.http.HttpResponseRedirect(..., $S % request.$W, ...) + - pattern: return django.http.HttpResponseRedirect(..., f"...{request.$W}...", ...) + - metavariable-regex: + metavariable: $W + regex: (?!get_full_path) +- id: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open + message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result + in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath + or the pathlib library. + metadata: + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/www-community/attacks/Path_Traversal + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open + shortlink: https://sg.run/W8qg + semgrep.dev: + rule: + r_id: 9509 + rv_id: 1263396 + rule_id: oqUe7z + version_id: JdTzxAw + url: https://semgrep.dev/playground/r/JdTzxAw/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: open(..., request.$W.get(...), ...) + - pattern: open(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: open(..., $S % request.$W.get(...), ...) + - pattern: open(..., f"...{request.$W.get(...)}...", ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + open(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W.get(...) + + ... + + open(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...)\ + \ as $FD:\n ...\n" + - pattern: '$DATA = request.$W.get(...) + + ... + + open(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W.get(...) + + ... + + open(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n\ + \ ...\n" + - pattern: '$DATA = request.$W.get(...) + + ... + + open(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: $A = open(..., request.$W.get(...), ...) + - pattern: $A = open(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: $A = open(..., $S % request.$W.get(...), ...) + - pattern: $A = open(..., f"...{request.$W.get(...)}...", ...) + - pattern: return open(..., request.$W.get(...), ...) + - pattern: return open(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: return open(..., $S % request.$W.get(...), ...) + - pattern: return open(..., f"...{request.$W.get(...)}...", ...) + - pattern: "$DATA = request.$W.get(...)\n...\nwith open(..., $DATA, ...) as $FD:\n ...\n" + - pattern: open(..., request.$W(...), ...) + - pattern: open(..., $S.format(..., request.$W(...), ...), ...) + - pattern: open(..., $S % request.$W(...), ...) + - pattern: open(..., f"...{request.$W(...)}...", ...) + - pattern: '$DATA = request.$W(...) + + ... + + open(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W(...) + + ... + + open(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as\ + \ $FD:\n ...\n" + - pattern: '$DATA = request.$W(...) + + ... + + open(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W(...) + + ... + + open(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W(...) + + ... + + open(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: $A = open(..., request.$W(...), ...) + - pattern: $A = open(..., $S.format(..., request.$W(...), ...), ...) + - pattern: $A = open(..., $S % request.$W(...), ...) + - pattern: $A = open(..., f"...{request.$W(...)}...", ...) + - pattern: return open(..., request.$W(...), ...) + - pattern: return open(..., $S.format(..., request.$W(...), ...), ...) + - pattern: return open(..., $S % request.$W(...), ...) + - pattern: return open(..., f"...{request.$W(...)}...", ...) + - pattern: "$DATA = request.$W(...)\n...\nwith open(..., $DATA, ...) as $FD:\n ...\n" + - pattern: open(..., request.$W[...], ...) + - pattern: open(..., $S.format(..., request.$W[...], ...), ...) + - pattern: open(..., $S % request.$W[...], ...) + - pattern: open(..., f"...{request.$W[...]}...", ...) + - pattern: '$DATA = request.$W[...] + + ... + + open(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W[...] + + ... + + open(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as\ + \ $FD:\n ...\n" + - pattern: '$DATA = request.$W[...] + + ... + + open(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W[...] + + ... + + open(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W[...] + + ... + + open(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: $A = open(..., request.$W[...], ...) + - pattern: $A = open(..., $S.format(..., request.$W[...], ...), ...) + - pattern: $A = open(..., $S % request.$W[...], ...) + - pattern: $A = open(..., f"...{request.$W[...]}...", ...) + - pattern: return open(..., request.$W[...], ...) + - pattern: return open(..., $S.format(..., request.$W[...], ...), ...) + - pattern: return open(..., $S % request.$W[...], ...) + - pattern: return open(..., f"...{request.$W[...]}...", ...) + - pattern: "$DATA = request.$W[...]\n...\nwith open(..., $DATA, ...) as $FD:\n ...\n" + - pattern: open(..., request.$W, ...) + - pattern: open(..., $S.format(..., request.$W, ...), ...) + - pattern: open(..., $S % request.$W, ...) + - pattern: open(..., f"...{request.$W}...", ...) + - pattern: '$DATA = request.$W + + ... + + open(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W + + ... + + open(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as $FD:\n\ + \ ...\n" + - pattern: '$DATA = request.$W + + ... + + open(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W + + ... + + open(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: '$DATA = request.$W + + ... + + open(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + open(..., $INTERM, ...) + + ' + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" + - pattern: $A = open(..., request.$W, ...) + - pattern: $A = open(..., $S.format(..., request.$W, ...), ...) + - pattern: $A = open(..., $S % request.$W, ...) + - pattern: $A = open(..., f"...{request.$W}...", ...) + - pattern: return open(..., request.$W, ...) + - pattern: return open(..., $S.format(..., request.$W, ...), ...) + - pattern: return open(..., $S % request.$W, ...) + - pattern: return open(..., f"...{request.$W}...", ...) + - pattern: "$DATA = request.$W\n...\nwith open(..., $DATA, ...) as $FD:\n ...\n" +- id: python.django.security.injection.raw-html-format.raw-html-format + languages: + - python + severity: WARNING + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use + templates (`django.shortcuts.render`) which will safely render HTML instead. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - django + references: + - https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render + - https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format + shortlink: https://sg.run/oYj1 + semgrep.dev: + rule: + r_id: 14360 + rv_id: 1263397 + rule_id: 2ZUPER + version_id: 5PTo100 + url: https://semgrep.dev/playground/r/5PTo100/python.django.security.injection.raw-html-format.raw-html-format + origin: community + mode: taint + pattern-sanitizers: + - pattern: django.utils.html.escape(...) + pattern-sources: + - patterns: + - pattern: request.$ANYTHING + - pattern-not: request.build_absolute_uri + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$HTMLSTR" % ...' + - pattern: '"$HTMLSTR".format(...)' + - pattern: '"$HTMLSTR" + ...' + - pattern: f"$HTMLSTR{...}..." + - patterns: + - pattern-inside: '$HTML = "$HTMLSTR" + + ... + + ' + - pattern-either: + - pattern: $HTML % ... + - pattern: $HTML.format(...) + - pattern: $HTML + ... + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... +- id: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse + message: Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers + gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse + shortlink: https://sg.run/BkvA + semgrep.dev: + rule: + r_id: 9495 + rv_id: 1263398 + rule_id: JDUydR + version_id: GxTke5K + url: https://semgrep.dev/playground/r/GxTke5K/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: django.http.HttpResponse(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: django.http.HttpResponse(..., $S % request.$W.get(...), ...) + - pattern: django.http.HttpResponse(..., f"...{request.$W.get(...)}...", ...) + - pattern: django.http.HttpResponse(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponse(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponse(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponse(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponse(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponse(..., request.$W.get(...), ...) + - pattern: return django.http.HttpResponse(..., request.$W.get(...), ...) + - pattern: django.http.HttpResponse(..., $S.format(..., request.$W(...), ...), ...) + - pattern: django.http.HttpResponse(..., $S % request.$W(...), ...) + - pattern: django.http.HttpResponse(..., f"...{request.$W(...)}...", ...) + - pattern: django.http.HttpResponse(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponse(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponse(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponse(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponse(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponse(..., request.$W(...), ...) + - pattern: return django.http.HttpResponse(..., request.$W(...), ...) + - pattern: django.http.HttpResponse(..., $S.format(..., request.$W[...], ...), ...) + - pattern: django.http.HttpResponse(..., $S % request.$W[...], ...) + - pattern: django.http.HttpResponse(..., f"...{request.$W[...]}...", ...) + - pattern: django.http.HttpResponse(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponse(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponse(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponse(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponse(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponse(..., request.$W[...], ...) + - pattern: return django.http.HttpResponse(..., request.$W[...], ...) + - pattern: django.http.HttpResponse(..., $S.format(..., request.$W, ...), ...) + - pattern: django.http.HttpResponse(..., $S % request.$W, ...) + - pattern: django.http.HttpResponse(..., f"...{request.$W}...", ...) + - pattern: django.http.HttpResponse(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponse(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponse(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponse(..., f"...{$DATA}...", ...) + + ' + - pattern: $A = django.http.HttpResponse(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + $A = django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: return django.http.HttpResponse(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponse(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponse(..., $INTERM, ...) + + ' +- id: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest + message: Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading + to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped + or sanitzed. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest + shortlink: https://sg.run/DoZP + semgrep.dev: + rule: + r_id: 9496 + rv_id: 1263399 + rule_id: 5rUOX1 + version_id: RGT0LY6 + url: https://semgrep.dev/playground/r/RGT0LY6/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W.get(...), ...) + - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W.get(...)}...", ...) + - pattern: django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseBadRequest(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) + - pattern: return django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) + - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W(...), ...), ...) + - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W(...), ...) + - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W(...)}...", ...) + - pattern: django.http.HttpResponseBadRequest(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseBadRequest(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W(...), ...) + - pattern: return django.http.HttpResponseBadRequest(..., request.$W(...), ...) + - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W[...], ...), ...) + - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W[...], ...) + - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W[...]}...", ...) + - pattern: django.http.HttpResponseBadRequest(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseBadRequest(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W[...], ...) + - pattern: return django.http.HttpResponseBadRequest(..., request.$W[...], ...) + - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W, ...), ...) + - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W, ...) + - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W}...", ...) + - pattern: django.http.HttpResponseBadRequest(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseBadRequest(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + django.http.HttpResponseBadRequest(..., $INTERM, ...) + + ' + - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W, ...) + - pattern: return django.http.HttpResponseBadRequest(..., request.$W, ...) +- id: python.django.security.injection.request-data-fileresponse.request-data-fileresponse + message: Found user-controlled request data being passed into a file open, which is them passed as an argument into the + FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking + important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse. + metadata: + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse + shortlink: https://sg.run/W862 + semgrep.dev: + rule: + r_id: 9497 + rv_id: 1263400 + rule_id: GdU7QR + version_id: A8Tgd1K + url: https://semgrep.dev/playground/r/A8Tgd1K/python.django.security.injection.request-data-fileresponse.request-data-fileresponse + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: django.http.FileResponse(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.http.FileResponse(..., open($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = open($DATA, ...) + + ... + + django.http.FileResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.FileResponse(..., request.$W.get(...), ...) + - pattern: return django.http.FileResponse(..., request.$W.get(...), ...) + - pattern: django.http.FileResponse(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.http.FileResponse(..., open($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = open($DATA, ...) + + ... + + django.http.FileResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.FileResponse(..., request.$W(...), ...) + - pattern: return django.http.FileResponse(..., request.$W(...), ...) + - pattern: django.http.FileResponse(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.http.FileResponse(..., open($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = open($DATA, ...) + + ... + + django.http.FileResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.FileResponse(..., request.$W[...], ...) + - pattern: return django.http.FileResponse(..., request.$W[...], ...) + - pattern: django.http.FileResponse(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + django.http.FileResponse(..., open($DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = open($DATA, ...) + + ... + + django.http.FileResponse(..., $INTERM, ...) + + ' + - pattern: $A = django.http.FileResponse(..., request.$W, ...) + - pattern: return django.http.FileResponse(..., request.$W, ...) +- id: python.django.security.injection.request-data-write.request-data-write + message: Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able + to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause + a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized. + metadata: + cwe: + - 'CWE-93: Improper Neutralization of CRLF Sequences (''CRLF Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - django + references: + - https://owasp.org/Top10/A03_2021-Injection + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write + shortlink: https://sg.run/0Q6j + semgrep.dev: + rule: + r_id: 9498 + rv_id: 1263401 + rule_id: ReUg5z + version_id: BjTkZO5 + url: https://semgrep.dev/playground/r/BjTkZO5/python.django.security.injection.request-data-write.request-data-write + origin: community + languages: + - python + severity: WARNING + pattern-either: + - pattern: $F.write(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $F.write(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $F.write(..., $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $F.write(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $F.write(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: $A = $F.write(..., request.$W.get(...), ...) + - pattern: return $F.write(..., request.$W.get(...), ...) + - pattern: $F.write(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + $F.write(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $F.write(..., $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $F.write(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $F.write(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: $A = $F.write(..., request.$W(...), ...) + - pattern: return $F.write(..., request.$W(...), ...) + - pattern: $F.write(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + $F.write(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $F.write(..., $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $F.write(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $F.write(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: $A = $F.write(..., request.$W[...], ...) + - pattern: return $F.write(..., request.$W[...], ...) + - pattern: $F.write(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + $F.write(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $F.write(..., $B.$C(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $B.$C(..., $DATA, ...) + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $F.write(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $F.write(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $F.write(..., $INTERM, ...) + + ' + - pattern: $A = $F.write(..., request.$W, ...) + - pattern: return $F.write(..., request.$W, ...) +- id: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where + message: User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected + information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and + not using quote placeholders in the SQL string. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where + shortlink: https://sg.run/0Ql5 + semgrep.dev: + rule: + r_id: 9510 + rv_id: 1263402 + rule_id: zdUkx1 + version_id: DkTRb4l + url: https://semgrep.dev/playground/r/DkTRb4l/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W.get(...), ...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W.get(...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W.get(...)}...", ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) + - pattern: return $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W(...), ...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W(...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W(...)}...", ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) + - pattern: return $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W[...], ...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W[...], ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W[...]}...", ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) + - pattern: return $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W, ...), ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W, ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W}...", ...], ...) + - pattern: $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) + - pattern: return $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) + + ' +- id: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql + message: User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected + information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and + not using quote placeholders in the SQL string. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql + shortlink: https://sg.run/Kl4X + semgrep.dev: + rule: + r_id: 9511 + rv_id: 1263403 + rule_id: pKUOBp + version_id: WrTqK2L + url: https://semgrep.dev/playground/r/WrTqK2L/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W.get(...), ...) + - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W.get(...)}...", ...) + - pattern: django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.db.models.expressions.RawSQL(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) + - pattern: return django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) + - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W(...), ...), ...) + - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W(...), ...) + - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W(...)}...", ...) + - pattern: django.db.models.expressions.RawSQL(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + django.db.models.expressions.RawSQL(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W(...), ...) + - pattern: return django.db.models.expressions.RawSQL(..., request.$W(...), ...) + - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W[...], ...), ...) + - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W[...], ...) + - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W[...]}...", ...) + - pattern: django.db.models.expressions.RawSQL(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + django.db.models.expressions.RawSQL(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W[...], ...) + - pattern: return django.db.models.expressions.RawSQL(..., request.$W[...], ...) + - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W, ...), ...) + - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W, ...) + - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W}...", ...) + - pattern: django.db.models.expressions.RawSQL(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + django.db.models.expressions.RawSQL(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + django.db.models.expressions.RawSQL(..., $INTERM, ...) + + ' + - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W, ...) + - pattern: return django.db.models.expressions.RawSQL(..., request.$W, ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL($INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL($INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL($INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + django.db.models.expressions.RawSQL($INTERM, ...) + + ' +- id: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute + message: User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore + protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and + therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute + shortlink: https://sg.run/qx7y + semgrep.dev: + rule: + r_id: 9512 + rv_id: 1263404 + rule_id: 2ZUbDL + version_id: 0bTKzRj + url: https://semgrep.dev/playground/r/0bTKzRj/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: $CURSOR.execute(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: $CURSOR.execute(..., $S % request.$W.get(...), ...) + - pattern: $CURSOR.execute(..., f"...{request.$W.get(...)}...", ...) + - pattern: $CURSOR.execute(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $CURSOR.execute(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $CURSOR.execute(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $CURSOR.execute(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $CURSOR.execute(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: $A = $CURSOR.execute(..., request.$W.get(...), ...) + - pattern: return $CURSOR.execute(..., request.$W.get(...), ...) + - pattern: $CURSOR.execute(..., $S.format(..., request.$W(...), ...), ...) + - pattern: $CURSOR.execute(..., $S % request.$W(...), ...) + - pattern: $CURSOR.execute(..., f"...{request.$W(...)}...", ...) + - pattern: $CURSOR.execute(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + $CURSOR.execute(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $CURSOR.execute(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $CURSOR.execute(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $CURSOR.execute(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: $A = $CURSOR.execute(..., request.$W(...), ...) + - pattern: return $CURSOR.execute(..., request.$W(...), ...) + - pattern: $CURSOR.execute(..., $S.format(..., request.$W[...], ...), ...) + - pattern: $CURSOR.execute(..., $S % request.$W[...], ...) + - pattern: $CURSOR.execute(..., f"...{request.$W[...]}...", ...) + - pattern: $CURSOR.execute(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + $CURSOR.execute(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $CURSOR.execute(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $CURSOR.execute(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $CURSOR.execute(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: $A = $CURSOR.execute(..., request.$W[...], ...) + - pattern: return $CURSOR.execute(..., request.$W[...], ...) + - pattern: $CURSOR.execute(..., $S.format(..., request.$W, ...), ...) + - pattern: $CURSOR.execute(..., $S % request.$W, ...) + - pattern: $CURSOR.execute(..., f"...{request.$W}...", ...) + - pattern: $CURSOR.execute(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + $CURSOR.execute(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $CURSOR.execute(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $CURSOR.execute(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $CURSOR.execute(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + $CURSOR.execute(..., $INTERM, ...) + + ' + - pattern: $A = $CURSOR.execute(..., request.$W, ...) + - pattern: return $CURSOR.execute(..., request.$W, ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $CURSOR.execute($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $CURSOR.execute($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $CURSOR.execute($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $CURSOR.execute($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $CURSOR.execute($INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $CURSOR.execute($INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $CURSOR.execute($INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $CURSOR.execute($INTERM, ...)' +- id: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw + message: Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection + and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization + and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`. + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw + shortlink: https://sg.run/l2v9 + semgrep.dev: + rule: + r_id: 9513 + rv_id: 1263405 + rule_id: X5U8v5 + version_id: K3TKkBW + url: https://semgrep.dev/playground/r/K3TKkBW/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: $MODEL.objects.raw(..., $S % request.$W.get(...), ...) + - pattern: $MODEL.objects.raw(..., f"...{request.$W.get(...)}...", ...) + - pattern: $MODEL.objects.raw(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.raw(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.raw(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.raw(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.raw(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: $A = $MODEL.objects.raw(..., request.$W.get(...), ...) + - pattern: return $MODEL.objects.raw(..., request.$W.get(...), ...) + - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W(...), ...), ...) + - pattern: $MODEL.objects.raw(..., $S % request.$W(...), ...) + - pattern: $MODEL.objects.raw(..., f"...{request.$W(...)}...", ...) + - pattern: $MODEL.objects.raw(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.raw(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.raw(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.raw(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.raw(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: $A = $MODEL.objects.raw(..., request.$W(...), ...) + - pattern: return $MODEL.objects.raw(..., request.$W(...), ...) + - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W[...], ...), ...) + - pattern: $MODEL.objects.raw(..., $S % request.$W[...], ...) + - pattern: $MODEL.objects.raw(..., f"...{request.$W[...]}...", ...) + - pattern: $MODEL.objects.raw(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.raw(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.raw(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.raw(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.raw(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: $A = $MODEL.objects.raw(..., request.$W[...], ...) + - pattern: return $MODEL.objects.raw(..., request.$W[...], ...) + - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W, ...), ...) + - pattern: $MODEL.objects.raw(..., $S % request.$W, ...) + - pattern: $MODEL.objects.raw(..., f"...{request.$W}...", ...) + - pattern: $MODEL.objects.raw(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.raw(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.raw(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.raw(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.raw(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + $MODEL.objects.raw(..., $INTERM, ...) + + ' + - pattern: $A = $MODEL.objects.raw(..., request.$W, ...) + - pattern: return $MODEL.objects.raw(..., request.$W, ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + $MODEL.objects.raw($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $MODEL.objects.raw($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $MODEL.objects.raw($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $MODEL.objects.raw($STR % (..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.raw($INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.raw($INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.raw($INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % (..., $DATA, ...) + + ... + + $MODEL.objects.raw($INTERM, ...) + + ' +- id: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests + message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery + (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to + the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery + to learn more about SSRF vulnerabilities. + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests + shortlink: https://sg.run/YvY4 + semgrep.dev: + rule: + r_id: 9514 + rv_id: 1263406 + rule_id: j2UvEw + version_id: qkTR7zn + url: https://semgrep.dev/playground/r/qkTR7zn/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests + origin: community + languages: + - python + severity: ERROR + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: requests.$METHOD(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: requests.$METHOD(..., $S % request.$W.get(...), ...) + - pattern: requests.$METHOD(..., f"...{request.$W.get(...)}...", ...) + - pattern: requests.$METHOD(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + requests.$METHOD(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + requests.$METHOD(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + requests.$METHOD(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + requests.$METHOD(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: $A = requests.$METHOD(..., request.$W.get(...), ...) + - pattern: return requests.$METHOD(..., request.$W.get(...), ...) + - pattern: requests.$METHOD(..., $S.format(..., request.$W(...), ...), ...) + - pattern: requests.$METHOD(..., $S % request.$W(...), ...) + - pattern: requests.$METHOD(..., f"...{request.$W(...)}...", ...) + - pattern: requests.$METHOD(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + requests.$METHOD(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + requests.$METHOD(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + requests.$METHOD(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + requests.$METHOD(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: $A = requests.$METHOD(..., request.$W(...), ...) + - pattern: return requests.$METHOD(..., request.$W(...), ...) + - pattern: requests.$METHOD(..., $S.format(..., request.$W[...], ...), ...) + - pattern: requests.$METHOD(..., $S % request.$W[...], ...) + - pattern: requests.$METHOD(..., f"...{request.$W[...]}...", ...) + - pattern: requests.$METHOD(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + requests.$METHOD(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + requests.$METHOD(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + requests.$METHOD(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + requests.$METHOD(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: $A = requests.$METHOD(..., request.$W[...], ...) + - pattern: return requests.$METHOD(..., request.$W[...], ...) + - pattern: requests.$METHOD(..., $S.format(..., request.$W, ...), ...) + - pattern: requests.$METHOD(..., $S % request.$W, ...) + - pattern: requests.$METHOD(..., f"...{request.$W}...", ...) + - pattern: requests.$METHOD(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + requests.$METHOD(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + requests.$METHOD(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + requests.$METHOD(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + requests.$METHOD(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + requests.$METHOD(..., $INTERM, ...) + + ' + - pattern: $A = requests.$METHOD(..., request.$W, ...) + - pattern: return requests.$METHOD(..., request.$W, ...) +- id: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib + message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery + (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes + and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication + and transport-layer security in the proxied request. + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery + category: security + technology: + - django + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib + shortlink: https://sg.run/6n2B + semgrep.dev: + rule: + r_id: 9515 + rv_id: 1263407 + rule_id: 10UKDo + version_id: l4TJRwD + url: https://semgrep.dev/playground/r/l4TJRwD/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib + origin: community + languages: + - python + severity: ERROR + patterns: + - pattern-inside: "def $FUNC(...):\n ...\n" + - pattern-either: + - pattern: urllib.request.urlopen(..., $S.format(..., request.$W.get(...), ...), ...) + - pattern: urllib.request.urlopen(..., $S % request.$W.get(...), ...) + - pattern: urllib.request.urlopen(..., f"...{request.$W.get(...)}...", ...) + - pattern: urllib.request.urlopen(..., request.$W.get(...), ...) + - pattern: '$DATA = request.$W.get(...) + + ... + + urllib.request.urlopen(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + urllib.request.urlopen(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR % $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + urllib.request.urlopen(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + urllib.request.urlopen(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W.get(...) + + ... + + $INTERM = $STR + $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: $A = urllib.request.urlopen(..., request.$W.get(...), ...) + - pattern: return urllib.request.urlopen(..., request.$W.get(...), ...) + - pattern: urllib.request.urlopen(..., $S.format(..., request.$W(...), ...), ...) + - pattern: urllib.request.urlopen(..., $S % request.$W(...), ...) + - pattern: urllib.request.urlopen(..., f"...{request.$W(...)}...", ...) + - pattern: urllib.request.urlopen(..., request.$W(...), ...) + - pattern: '$DATA = request.$W(...) + + ... + + urllib.request.urlopen(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + urllib.request.urlopen(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR % $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + urllib.request.urlopen(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = f"...{$DATA}..." + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + urllib.request.urlopen(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W(...) + + ... + + $INTERM = $STR + $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: $A = urllib.request.urlopen(..., request.$W(...), ...) + - pattern: return urllib.request.urlopen(..., request.$W(...), ...) + - pattern: urllib.request.urlopen(..., $S.format(..., request.$W[...], ...), ...) + - pattern: urllib.request.urlopen(..., $S % request.$W[...], ...) + - pattern: urllib.request.urlopen(..., f"...{request.$W[...]}...", ...) + - pattern: urllib.request.urlopen(..., request.$W[...], ...) + - pattern: '$DATA = request.$W[...] + + ... + + urllib.request.urlopen(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + urllib.request.urlopen(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR % $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + urllib.request.urlopen(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = f"...{$DATA}..." + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + urllib.request.urlopen(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W[...] + + ... + + $INTERM = $STR + $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: $A = urllib.request.urlopen(..., request.$W[...], ...) + - pattern: return urllib.request.urlopen(..., request.$W[...], ...) + - pattern: urllib.request.urlopen(..., $S.format(..., request.$W, ...), ...) + - pattern: urllib.request.urlopen(..., $S % request.$W, ...) + - pattern: urllib.request.urlopen(..., f"...{request.$W}...", ...) + - pattern: urllib.request.urlopen(..., request.$W, ...) + - pattern: '$DATA = request.$W + + ... + + urllib.request.urlopen(..., $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR.format(..., $DATA, ...) + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + urllib.request.urlopen(..., $STR % $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR % $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + urllib.request.urlopen(..., f"...{$DATA}...", ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = f"...{$DATA}..." + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + urllib.request.urlopen(..., $STR + $DATA, ...) + + ' + - pattern: '$DATA = request.$W + + ... + + $INTERM = $STR + $DATA + + ... + + urllib.request.urlopen(..., $INTERM, ...) + + ' + - pattern: $A = urllib.request.urlopen(..., request.$W, ...) + - pattern: return urllib.request.urlopen(..., request.$W, ...) +- id: python.django.security.nan-injection.nan-injection + message: Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject + Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. + Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'. + languages: + - python + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + pattern-sinks: + - patterns: + - pattern-either: + - pattern: float(...) + - pattern: bool(...) + - pattern: complex(...) + - pattern-not-inside: "if $COND:\n ...\n...\n" + pattern-sanitizers: + - pattern: $ANYTHING(...) + not_conflicting: true + metadata: + references: + - https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868 + - https://blog.bitdiscovery.com/2021/12/python-nan-injection/ + category: security + cwe: + - 'CWE-704: Incorrect Type Conversion or Cast' + technology: + - django + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.django.security.nan-injection.nan-injection + shortlink: https://sg.run/Og7L + semgrep.dev: + rule: + r_id: 18275 + rv_id: 946193 + rule_id: DbUGvk + version_id: NdTqk7G + url: https://semgrep.dev/playground/r/NdTqk7G/python.django.security.nan-injection.nan-injection + origin: community +- id: python.django.security.passwords.password-empty-string.password-empty-string + message: '''$VAR'' is the empty string and is being used to set the password on ''$MODEL''. If you meant to set an unusable + password, set the password to None or call ''set_unusable_password()''.' + metadata: + cwe: + - 'CWE-521: Weak Password Requirements' + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password + category: security + technology: + - django + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string + shortlink: https://sg.run/oxnR + semgrep.dev: + rule: + r_id: 9516 + rv_id: 1263411 + rule_id: 9AU1jW + version_id: GxTke5Q + url: https://semgrep.dev/playground/r/GxTke5Q/python.django.security.passwords.password-empty-string.password-empty-string + origin: community + patterns: + - pattern-either: + - pattern: '$MODEL.set_password($EMPTY) + + ... + + $MODEL.save() + + ' + - pattern: '$VAR = $EMPTY + + ... + + $MODEL.set_password($VAR) + + ... + + $MODEL.save() + + ' + - metavariable-regex: + metavariable: $EMPTY + regex: (\'\'|\"\") + languages: + - python + severity: ERROR +- id: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default + message: '''$VAR'' is using the empty string as its default and is being used to set the password on ''$MODEL''. If you + meant to set an unusable password, set the default value to ''None'' or call ''set_unusable_password()''.' + metadata: + cwe: + - 'CWE-521: Weak Password Requirements' + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password + category: security + technology: + - django + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default + shortlink: https://sg.run/zvBW + semgrep.dev: + rule: + r_id: 9517 + rv_id: 1263412 + rule_id: yyUn6Z + version_id: RGT0LYX + url: https://semgrep.dev/playground/r/RGT0LYX/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default + origin: community + languages: + - python + severity: ERROR + patterns: + - pattern-either: + - pattern: '$VAR = request.$W.get($X, $EMPTY) + + ... + + $MODEL.set_password($VAR) + + ... + + $MODEL.save(...) + + ' + - pattern: "def $F(..., $VAR=$EMPTY, ...):\n ...\n $MODEL.set_password($VAR)\n" + - metavariable-pattern: + metavariable: $EMPTY + pattern: '""' + - focus-metavariable: $EMPTY + fix: 'None + + ' +- id: python.fastapi.security.wildcard-cors.wildcard-cors + languages: + - python + message: CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided. + mode: taint + pattern-sources: + - pattern: '[..., "*", ...]' + pattern-sinks: + - patterns: + - pattern: "$APP.add_middleware(\n CORSMiddleware,\n allow_origins=$ORIGIN,\n ...);\n" + - focus-metavariable: $ORIGIN + severity: WARNING + metadata: + cwe: + - 'CWE-942: Permissive Cross-domain Policy with Untrusted Domains' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - python + - fastapi + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + - https://cwe.mitre.org/data/definitions/942.html + likelihood: HIGH + impact: LOW + confidence: MEDIUM + vulnerability_class: + - Configuration + subcategory: + - vuln + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + source: https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors + shortlink: https://sg.run/KxApY + semgrep.dev: + rule: + r_id: 112311 + rv_id: 1263413 + rule_id: lBU4JQ3 + version_id: A8Tgd1R + url: https://semgrep.dev/playground/r/A8Tgd1R/python.fastapi.security.wildcard-cors.wildcard-cors + origin: community +- id: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host + message: Running flask app with host 0.0.0.0 could expose the server publicly. + metadata: + cwe: + - 'CWE-668: Exposure of Resource to Wrong Sphere' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - flask + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host + shortlink: https://sg.run/eLby + semgrep.dev: + rule: + r_id: 9532 + rv_id: 1263414 + rule_id: L1Uy1n + version_id: BjTkZOY + url: https://semgrep.dev/playground/r/BjTkZOY/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host + origin: community + languages: + - python + severity: WARNING + pattern-either: + - pattern: app.run(..., host="0.0.0.0", ...) + - pattern: app.run(..., "0.0.0.0", ...) +- id: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly + patterns: + - pattern-not-inside: "if __name__ == '__main__':\n ...\n" + - pattern-not-inside: "def $X(...):\n ...\n" + - pattern: app.run(...) + message: top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function + metadata: + cwe: + - 'CWE-668: Exposure of Resource to Wrong Sphere' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - flask + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly + shortlink: https://sg.run/vz5b + semgrep.dev: + rule: + r_id: 9533 + rv_id: 1263415 + rule_id: 8GUjdX + version_id: DkTRb4z + url: https://semgrep.dev/playground/r/DkTRb4z/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly + origin: community + languages: + - python + severity: WARNING +- id: python.flask.security.audit.debug-enabled.debug-enabled + patterns: + - pattern-inside: 'import flask + + ... + + ' + - pattern: $APP.run(..., debug=True, ...) + message: Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive + information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables. + metadata: + cwe: + - 'CWE-489: Active Debug Code' + owasp: A06:2017 - Security Misconfiguration + references: + - https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/ + category: security + technology: + - flask + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Active Debug Code + source: https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled + shortlink: https://sg.run/dKrd + semgrep.dev: + rule: + r_id: 9534 + rv_id: 946206 + rule_id: gxU1bd + version_id: 8KTKjwR + url: https://semgrep.dev/playground/r/8KTKjwR/python.flask.security.audit.debug-enabled.debug-enabled + origin: community + severity: WARNING + languages: + - python +- id: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string + message: Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input + can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - flask + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string + shortlink: https://sg.run/Zv6o + semgrep.dev: + rule: + r_id: 9535 + rv_id: 1263416 + rule_id: QrUz49 + version_id: WrTqKAz + url: https://semgrep.dev/playground/r/WrTqKAz/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string + origin: community + languages: + - python + severity: WARNING + mode: taint + pattern-sources: + - pattern-either: + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $PARAM, ...):\n ...\n" + - pattern: $PARAM + - pattern: 'request.$FUNC.get(...) + + ' + - pattern: 'request.$FUNC(...) + + ' + - pattern: request.$FUNC[...] + pattern-sinks: + - patterns: + - pattern-not-inside: return "..." + - pattern-either: + - pattern: return "...".format(...) + - pattern: return "..." % ... + - pattern: return "..." + ... + - pattern: return ... + "..." + - pattern: return f"...{...}..." + - patterns: + - pattern: return $X + - pattern-either: + - pattern-inside: '$X = "...".format(...) + + ... + + ' + - pattern-inside: '$X = "..." % ... + + ... + + ' + - pattern-inside: '$X = "..." + ... + + ... + + ' + - pattern-inside: '$X = ... + "..." + + ... + + ' + - pattern-inside: '$X = f"...{...}..." + + ... + + ' + - pattern-not-inside: '$X = "..." + + ... + + ' +- id: python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true + message: Function `flask.url_for` with `_external=True` argument will generate URLs using the `Host` header of the HTTP + request, which may lead to security risks such as Host header injection + metadata: + cwe: + - 'CWE-673: External Influence of Sphere Definition' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - flask + references: + - https://flask.palletsprojects.com/en/latest/api/#flask.url_for + - https://portswigger.net/kb/issues/00500300_host-header-injection + subcategory: + - audit + likelihood: MEDIUM + impact: LOW + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true + shortlink: https://sg.run/gEGeR + semgrep.dev: + rule: + r_id: 191541 + rv_id: 1263418 + rule_id: JDU5oql + version_id: K3TKk6n + url: https://semgrep.dev/playground/r/K3TKk6n/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-not: flask.url_for(..., _external=False, ...) + - pattern-not: url_for(..., _external=False, ...) + - pattern-either: + - pattern: flask.url_for(..., _external=$VAR, ...) + - pattern: url_for(..., _external=$VAR, ...) +- id: python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret + languages: + - python + message: The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, + the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through + the HashIDs. + metadata: + category: security + subcategory: + - vuln + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A02:2021 – Cryptographic Failures + references: + - https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY + - http://carnage.github.io/2015/08/cryptanalysis-of-hashids + technology: + - flask + likelihood: LOW + impact: HIGH + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret + shortlink: https://sg.run/N0Rx + semgrep.dev: + rule: + r_id: 72427 + rv_id: 946220 + rule_id: KxUX3z + version_id: 0bT15Px + url: https://semgrep.dev/playground/r/0bT15Px/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret + origin: community + pattern-either: + - pattern: hashids.Hashids(..., salt=flask.current_app.config['SECRET_KEY'], ...) + - pattern: hashids.Hashids(flask.current_app.config['SECRET_KEY'], ...) + - patterns: + - pattern-inside: '$APP = flask.Flask(...) + + ... + + ' + - pattern-either: + - pattern: hashids.Hashids(..., salt=$APP.config['SECRET_KEY'], ...) + - pattern: hashids.Hashids($APP.config['SECRET_KEY'], ...) + severity: ERROR +- id: python.flask.security.injection.csv-writer-injection.csv-writer-injection + languages: + - python + message: Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate + the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet + application that runs an attacker script, which could steal data from the importing user or, at worst, install malware + on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula + injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs. + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-1236: Improper Neutralization of Formula Elements in a CSV File' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://github.com/raphaelm/defusedcsv + - https://owasp.org/www-community/attacks/CSV_Injection + - https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities + technology: + - python + - flask + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.flask.security.injection.csv-writer-injection.csv-writer-injection + shortlink: https://sg.run/JzqQ + semgrep.dev: + rule: + r_id: 31146 + rv_id: 1263428 + rule_id: L1UR2K + version_id: jQTn50Y + url: https://semgrep.dev/playground/r/jQTn50Y/python.flask.security.injection.csv-writer-injection.csv-writer-injection + origin: community + mode: taint + pattern-sinks: + - patterns: + - pattern-inside: '$WRITER = csv.writer(...) + + + ... + + + $WRITER.$WRITE(...) + + ' + - pattern: $WRITER.$WRITE(...) + - metavariable-regex: + metavariable: $WRITE + regex: ^(writerow|writerows|writeheader)$ + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + severity: ERROR +- id: python.flask.security.injection.nan-injection.nan-injection + message: Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject + Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. + Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'. + languages: + - python + severity: ERROR + mode: taint + pattern-sources: + - pattern-either: + - pattern: flask.request.$SOMETHING.get(...) + - pattern: flask.request.$SOMETHING[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - pattern: $ROUTEVAR + pattern-sinks: + - pattern-either: + - pattern: float(...) + - pattern: bool(...) + - pattern: complex(...) + pattern-sanitizers: + - not_conflicting: true + pattern: $ANYTHING(...) + metadata: + references: + - https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868 + - https://blog.bitdiscovery.com/2021/12/python-nan-injection/ + category: security + cwe: + - 'CWE-704: Incorrect Type Conversion or Cast' + technology: + - flask + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection + shortlink: https://sg.run/e598 + semgrep.dev: + rule: + r_id: 18276 + rv_id: 946222 + rule_id: WAUdj7 + version_id: qkT4j85 + url: https://semgrep.dev/playground/r/qkT4j85/python.flask.security.injection.nan-injection.nan-injection + origin: community +- id: python.flask.security.injection.os-system-injection.os-system-injection + languages: + - python + severity: ERROR + message: User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this + must be done, use the 'subprocess' module instead and pass the arguments as a list. + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/Command_Injection + category: security + technology: + - flask + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection + shortlink: https://sg.run/4xzz + semgrep.dev: + rule: + r_id: 9544 + rv_id: 1263429 + rule_id: BYUN99 + version_id: 1QTypw7 + url: https://semgrep.dev/playground/r/1QTypw7/python.flask.security.injection.os-system-injection.os-system-injection + origin: community + pattern-either: + - patterns: + - pattern: os.system(...) + - pattern-either: + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n os.system(..., <... $ROUTEVAR\ + \ ...>, ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ + \ ...\n os.system(..., <... $INTERM ...>, ...)\n" + - pattern: os.system(..., <... flask.request.$W.get(...) ...>, ...) + - pattern: os.system(..., <... flask.request.$W[...] ...>, ...) + - pattern: os.system(..., <... flask.request.$W(...) ...>, ...) + - pattern: os.system(..., <... flask.request.$W ...>, ...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> + + ... + + os.system(<... $INTERM ...>) + + ' + - pattern: os.system(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> + + ... + + os.system(<... $INTERM ...>) + + ' + - pattern: os.system(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> + + ... + + os.system(<... $INTERM ...>) + + ' + - pattern: os.system(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W ...> + + ... + + os.system(<... $INTERM ...>) + + ' + - pattern: os.system(...) +- id: python.flask.security.injection.path-traversal-open.path-traversal-open + languages: + - python + severity: ERROR + message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result + in path traversal attacks. + metadata: + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/www-community/attacks/Path_Traversal + category: security + technology: + - flask + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open + shortlink: https://sg.run/PJRW + semgrep.dev: + rule: + r_id: 9545 + rv_id: 1263430 + rule_id: DbUpOQ + version_id: 9lT4b94 + url: https://semgrep.dev/playground/r/9lT4b94/python.flask.security.injection.path-traversal-open.path-traversal-open + origin: community + pattern-either: + - patterns: + - pattern: open(...) + - pattern-either: + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n open(..., <... $ROUTEVAR ...>,\ + \ ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n with open(..., <... $ROUTEVAR\ + \ ...>, ...) as $FD:\n ...\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ + \ ...\n open(..., <... $INTERM ...>, ...)\n" + - pattern: open(..., <... flask.request.$W.get(...) ...>, ...) + - pattern: open(..., <... flask.request.$W[...] ...>, ...) + - pattern: open(..., <... flask.request.$W(...) ...>, ...) + - pattern: open(..., <... flask.request.$W ...>, ...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> + + ... + + open(<... $INTERM ...>, ...) + + ' + - pattern: open(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> + + ... + + open(<... $INTERM ...>, ...) + + ' + - pattern: open(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> + + ... + + open(<... $INTERM ...>, ...) + + ' + - pattern: open(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W ...> + + ... + + open(<... $INTERM ...>, ...) + + ' + - pattern: open(...) + - patterns: + - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n ...\n" + - pattern: open(...) + - patterns: + - pattern-inside: "$INTERM = <... flask.request.$W[...] ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n ...\n" + - pattern: open(...) + - patterns: + - pattern-inside: "$INTERM = <... flask.request.$W(...) ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n ...\n" + - pattern: open(...) + - patterns: + - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n ...\n" + - pattern: open(...) +- id: python.flask.security.injection.raw-html-concat.raw-html-format + languages: + - python + severity: WARNING + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods + of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use + templates (`flask.render_template`) which will safely render HTML instead. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - flask + references: + - https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format + shortlink: https://sg.run/Pb7e + semgrep.dev: + rule: + r_id: 14389 + rv_id: 1409401 + rule_id: GdUrJv + version_id: RGTEN1l + url: https://semgrep.dev/playground/r/RGTEN1l/python.flask.security.injection.raw-html-concat.raw-html-format + origin: community + mode: taint + pattern-sanitizers: + - pattern: jinja2.escape(...) + - pattern: flask.escape(...) + - patterns: + - pattern: flask.render_template($TPL, ...) + - metavariable-regex: + metavariable: $TPL + regex: .*\.html + pattern-sources: + - patterns: + - pattern-either: + - pattern: flask.request.$ANYTHING + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - pattern: $ROUTEVAR + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$HTMLSTR" % ...' + - pattern: '"$HTMLSTR".format(...)' + - pattern: '"$HTMLSTR" + ...' + - pattern: f"$HTMLSTR{...}..." + - patterns: + - pattern-inside: '$HTML = "$HTMLSTR" + + ... + + ' + - pattern-either: + - pattern: $HTML % ... + - pattern: $HTML.format(...) + - pattern: $HTML + ... + - metavariable-pattern: + metavariable: $HTMLSTR + language: generic + pattern: <$TAG ... +- id: python.flask.security.injection.ssrf-requests.ssrf-requests + languages: + - python + severity: ERROR + message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery + (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to + the user, and ensure proper authentication and transport-layer security in the proxied request. + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery + category: security + technology: + - flask + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests + shortlink: https://sg.run/J9LW + semgrep.dev: + rule: + r_id: 9546 + rv_id: 1263432 + rule_id: WAUoRx + version_id: rxTAKJn + url: https://semgrep.dev/playground/r/rxTAKJn/python.flask.security.injection.ssrf-requests.ssrf-requests + origin: community + pattern-either: + - patterns: + - pattern: requests.$FUNC(...) + - pattern-either: + - pattern-inside: "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n ...\n requests.$FUNC(...,\ + \ <... $ROUTEVAR ...>, ...)\n" + - pattern-inside: "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <...\ + \ $ROUTEVAR ...>\n ...\n requests.$FUNC(..., <... $INTERM ...>, ...)\n" + - metavariable-regex: + metavariable: $ROUTE_METHOD + regex: ^(route|get|post|put|delete|patch)$ + - pattern: requests.$FUNC(..., <... flask.request.$W.get(...) ...>, ...) + - pattern: requests.$FUNC(..., <... flask.request.$W[...] ...>, ...) + - pattern: requests.$FUNC(..., <... flask.request.$W(...) ...>, ...) + - pattern: requests.$FUNC(..., <... flask.request.$W ...>, ...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> + + ... + + requests.$FUNC(<... $INTERM ...>, ...) + + ' + - pattern: requests.$FUNC(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> + + ... + + requests.$FUNC(<... $INTERM ...>, ...) + + ' + - pattern: requests.$FUNC(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> + + ... + + requests.$FUNC(<... $INTERM ...>, ...) + + ' + - pattern: requests.$FUNC(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W ...> + + ... + + requests.$FUNC(<... $INTERM ...>, ...) + + ' + - pattern: requests.$FUNC(...) +- id: python.flask.security.injection.subprocess-injection.subprocess-injection + languages: + - python + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: subprocess.$FUNC(...) + - pattern-not: subprocess.$FUNC("...", ...) + - pattern-not: subprocess.$FUNC(["...", ...], ...) + - pattern-not-inside: '$CMD = ["...", ...] + + ... + + subprocess.$FUNC($CMD, ...) + + ' + - patterns: + - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...) + - metavariable-regex: + metavariable: $SHELL + regex: ^(sh|bash|ksh|csh|tcsh|zsh)$ + - patterns: + - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...) + - metavariable-regex: + metavariable: $INTERPRETER + regex: ^(python|python\d)$ + pattern-sanitizers: + - patterns: + - pattern: $DICT[$KEY] + - focus-metavariable: $KEY + severity: ERROR + message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. + An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, + scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, + prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set + of commands. + metadata: + category: security + technology: + - flask + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + confidence: HIGH + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection + shortlink: https://sg.run/5gW3 + semgrep.dev: + rule: + r_id: 31147 + rv_id: 1263433 + rule_id: 8GU3qp + version_id: bZT53gQ + url: https://semgrep.dev/playground/r/bZT53gQ/python.flask.security.injection.subprocess-injection.subprocess-injection + origin: community +- id: python.flask.security.injection.tainted-sql-string.tainted-sql-string + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction + could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the + database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider + using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries. + metadata: + cwe: + - 'CWE-704: Incorrect Type Conversion or Cast' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql + - https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm + - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column + category: security + technology: + - sqlalchemy + - flask + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string + shortlink: https://sg.run/JxZj + semgrep.dev: + rule: + r_id: 14702 + rv_id: 1409402 + rule_id: YGUDKQ + version_id: A8TEvb4 + url: https://semgrep.dev/playground/r/A8TEvb4/python.flask.security.injection.tainted-sql-string.tainted-sql-string + origin: community + severity: ERROR + languages: + - python + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: flask.request.$ANYTHING + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - pattern: $ROUTEVAR + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '"$SQLSTR" + ... + + ' + - pattern: '"$SQLSTR" % ... + + ' + - pattern: '"$SQLSTR".format(...) + + ' + - pattern: 'f"$SQLSTR{...}..." + + ' + - metavariable-regex: + metavariable: $SQLSTR + regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.* +- id: python.flask.security.injection.tainted-url-host.tainted-url-host + languages: + - python + message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data + to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. + They could also probe internal servers or other resources that the server running this code can access. (This is called + server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, + or hardcode the correct host. + metadata: + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html + category: security + technology: + - flask + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + impact: MEDIUM + likelihood: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Server-Side Request Forgery (SSRF) + source: https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host + shortlink: https://sg.run/RXpK + semgrep.dev: + rule: + r_id: 14649 + rv_id: 1409403 + rule_id: ReU3Wb + version_id: BjTy42w + url: https://semgrep.dev/playground/r/BjTy42w/python.flask.security.injection.tainted-url-host.tainted-url-host + origin: community + mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: '"$URLSTR" % ...' + - metavariable-pattern: + metavariable: $URLSTR + language: generic + patterns: + - pattern-either: + - pattern: $SCHEME://%s + - pattern: $SCHEME://%r + - patterns: + - pattern: '"$URLSTR".format(...)' + - metavariable-pattern: + metavariable: $URLSTR + language: generic + pattern: $SCHEME:// { ... } + - patterns: + - pattern: '"$URLSTR" + ...' + - metavariable-regex: + metavariable: $URLSTR + regex: .*://$ + - patterns: + - pattern: f"$URLSTR{...}..." + - metavariable-regex: + metavariable: $URLSTR + regex: .*://$ + - patterns: + - pattern-inside: '$URL = "$URLSTR" + + ... + + ' + - pattern: $URL += ... + - metavariable-regex: + metavariable: $URLSTR + regex: .*://$ + pattern-sources: + - patterns: + - pattern-either: + - pattern: flask.request.$ANYTHING + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - pattern: $ROUTEVAR + severity: WARNING +- id: python.flask.security.injection.user-eval.eval-injection + languages: + - python + severity: ERROR + message: Detected user data flowing into eval. This is code injection and should be avoided. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html + category: security + technology: + - flask + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection + shortlink: https://sg.run/5QpX + semgrep.dev: + rule: + r_id: 9547 + rv_id: 1263436 + rule_id: 0oU54W + version_id: w8TRoB0 + url: https://semgrep.dev/playground/r/w8TRoB0/python.flask.security.injection.user-eval.eval-injection + origin: community + pattern-either: + - patterns: + - pattern: eval(...) + - pattern-either: + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n eval(..., <... $ROUTEVAR ...>,\ + \ ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ + \ ...\n eval(..., <... $INTERM ...>, ...)\n" + - pattern: eval(..., <... flask.request.$W.get(...) ...>, ...) + - pattern: eval(..., <... flask.request.$W[...] ...>, ...) + - pattern: eval(..., <... flask.request.$W(...) ...>, ...) + - pattern: eval(..., <... flask.request.$W ...>, ...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> + + ... + + eval(..., <... $INTERM ...>, ...) + + ' + - pattern: eval(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> + + ... + + eval(..., <... $INTERM ...>, ...) + + ' + - pattern: eval(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> + + ... + + eval(..., <... $INTERM ...>, ...) + + ' + - pattern: eval(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W ...> + + ... + + eval(..., <... $INTERM ...>, ...) + + ' + - pattern: eval(...) +- id: python.flask.security.injection.user-exec.exec-injection + languages: + - python + severity: ERROR + message: Detected user data flowing into exec. This is code injection and should be avoided. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html + category: security + technology: + - flask + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection + shortlink: https://sg.run/Ge42 + semgrep.dev: + rule: + r_id: 9548 + rv_id: 1263437 + rule_id: KxUbl2 + version_id: xyTjzD9 + url: https://semgrep.dev/playground/r/xyTjzD9/python.flask.security.injection.user-exec.exec-injection + origin: community + pattern-either: + - patterns: + - pattern: exec(...) + - pattern-either: + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n exec(..., <... $ROUTEVAR ...>,\ + \ ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ + \ ...\n exec(..., <... $INTERM ...>, ...)\n" + - pattern: exec(..., <... flask.request.$W.get(...) ...>, ...) + - pattern: exec(..., <... flask.request.$W[...] ...>, ...) + - pattern: exec(..., <... flask.request.$W(...) ...>, ...) + - pattern: exec(..., <... flask.request.$W ...>, ...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> + + ... + + exec(..., <... $INTERM ...>, ...) + + ' + - pattern: exec(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> + + ... + + exec(..., <... $INTERM ...>, ...) + + ' + - pattern: exec(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> + + ... + + exec(..., <... $INTERM ...>, ...) + + ' + - pattern: exec(...) + - patterns: + - pattern-inside: '$INTERM = <... flask.request.$W ...> + + ... + + exec(..., <... $INTERM ...>, ...) + + ' + - pattern: exec(...) +- id: python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled + patterns: + - pattern: jinja2.Environment(... , autoescape=$VAL, ...) + - pattern-not: jinja2.Environment(... , autoescape=True, ...) + - pattern-not: jinja2.Environment(... , autoescape=jinja2.select_autoescape(...), ...) + - focus-metavariable: $VAL + fix: 'True + + ' + message: Detected a Jinja2 environment with 'autoescaping' disabled. This is dangerous if you are rendering to a browser + because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable 'autoescaping' by setting + 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain + file extensions. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html + cwe: + - 'CWE-116: Improper Encoding or Escaping of Output' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://jinja.palletsprojects.com/en/2.11.x/api/#basics + category: security + technology: + - jinja2 + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Encoding + source: https://semgrep.dev/r/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled + shortlink: https://sg.run/L2L7 + semgrep.dev: + rule: + r_id: 20039 + rv_id: 1263448 + rule_id: QrU1Xg + version_id: gETB7oN + url: https://semgrep.dev/playground/r/gETB7oN/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled + origin: community + languages: + - python + severity: WARNING +- id: python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled + patterns: + - pattern-not: jinja2.Environment(..., autoescape=$VAL, ...) + - pattern: jinja2.Environment(...) + fix-regex: + regex: (.*)\) + replacement: \1, autoescape=True) + message: Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous if + you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, + enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable + automatic escaping for certain file extensions. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html + cwe: + - 'CWE-116: Improper Encoding or Escaping of Output' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://jinja.palletsprojects.com/en/2.11.x/api/#basics + category: security + technology: + - jinja2 + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Encoding + source: https://semgrep.dev/r/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled + shortlink: https://sg.run/8kY4 + semgrep.dev: + rule: + r_id: 20040 + rv_id: 1263449 + rule_id: 3qULRx + version_id: QkTGqje + url: https://semgrep.dev/playground/r/QkTGqje/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled + origin: community + languages: + - python + severity: WARNING +- id: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret + message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html + Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' + metadata: + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + references: + - https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + category: security + technology: + - jwt + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret + shortlink: https://sg.run/l2E9 + semgrep.dev: + rule: + r_id: 9557 + rv_id: 1263452 + rule_id: X5U8P5 + version_id: PkTR3X3 + url: https://semgrep.dev/playground/r/PkTR3X3/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret + origin: community + patterns: + - pattern: 'jwt.encode($_, "...", ...) + + ' + languages: + - python + severity: ERROR +- id: python.jwt.security.jwt-none-alg.jwt-python-none-alg + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has + already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do + not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + category: security + technology: + - jwt + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg + shortlink: https://sg.run/Yvp4 + semgrep.dev: + rule: + r_id: 9558 + rv_id: 1263453 + rule_id: j2UvKw + version_id: JdTzxYj + url: https://semgrep.dev/playground/r/JdTzxYj/python.jwt.security.jwt-none-alg.jwt-python-none-alg + origin: community + languages: + - python + severity: ERROR + pattern-either: + - pattern: 'jwt.encode(...,algorithm="none",...) + + ' + - pattern: jwt.decode(...,algorithms=[...,"none",...],...) +- id: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode + patterns: + - pattern-either: + - patterns: + - pattern: 'jwt.decode(..., options={..., "verify_signature": $BOOL, ...}, ...) + + ' + - metavariable-pattern: + metavariable: $BOOL + pattern: 'False + + ' + - focus-metavariable: $BOOL + - patterns: + - pattern: '$OPTS = {..., "verify_signature": $BOOL, ...} + + ... + + jwt.decode(..., options=$OPTS, ...) + + ' + - metavariable-pattern: + metavariable: $BOOL + pattern: 'False + + ' + - focus-metavariable: $BOOL + message: Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the + token could be tampered with by malicious actors. Ensure that the JWT token is verified. + metadata: + owasp: + - A02:2017 - Broken Authentication + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe: + - 'CWE-287: Improper Authentication' + references: + - https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96 + category: security + technology: + - jwt + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode + shortlink: https://sg.run/6nyB + semgrep.dev: + rule: + r_id: 9559 + rv_id: 1263454 + rule_id: 10UKjo + version_id: 5PTo12w + url: https://semgrep.dev/playground/r/5PTo12w/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode + origin: community + fix: 'True + + ' + severity: ERROR + languages: + - python +- id: python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - pattern-either: + - patterns: + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "...", ...) + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["...",...], ...) + - pattern: $LOOP.subprocess_exec(...) + - patterns: + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c",...) + - patterns: + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...], ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", ...], ...) + message: Detected subprocess function '$LOOP.subprocess_exec' with user controlled data. You may consider using 'shlex.escape()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args + shortlink: https://sg.run/Apjp + semgrep.dev: + rule: + r_id: 27250 + rv_id: 1263460 + rule_id: 7KUE1E + version_id: WrTqKXz + url: https://semgrep.dev/playground/r/WrTqKXz/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: $LOOP.subprocess_shell($PROTOCOL, $CMD) + - pattern-inside: asyncio.subprocess.create_subprocess_shell($CMD, ...) + - pattern-inside: asyncio.create_subprocess_shell($CMD, ...) + - focus-metavariable: $CMD + - pattern-not-inside: '$CMD = "..." + + ... + + ' + - pattern-not: $LOOP.subprocess_shell($PROTOCOL, "...") + - pattern-not: asyncio.subprocess.create_subprocess_shell("...", ...) + - pattern-not: asyncio.create_subprocess_shell("...", ...) + message: Detected asyncio subprocess function with user controlled data. You may consider using 'shlex.escape()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://docs.python.org/3/library/asyncio-subprocess.html + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + shortlink: https://sg.run/Dx8Y + semgrep.dev: + rule: + r_id: 27252 + rv_id: 1263462 + rule_id: 8GU5q3 + version_id: K3TKkDn + url: https://semgrep.dev/playground/r/K3TKkDn/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$X = code.InteractiveConsole(...) + + ... + + ' + - pattern-inside: '$X = code.InteractiveInterpreter(...) + + ... + + ' + - pattern-either: + - pattern-inside: '$X.push($PAYLOAD,...) + + ' + - pattern-inside: '$X.runsource($PAYLOAD,...) + + ' + - pattern-inside: '$X.runcode(code.compile_command($PAYLOAD),...) + + ' + - pattern-inside: '$PL = code.compile_command($PAYLOAD,...) + + ... + + $X.runcode($PL,...) + + ' + - pattern: $PAYLOAD + - pattern-not: '$X.push("...",...) + + ' + - pattern-not: '$X.runsource("...",...) + + ' + - pattern-not: '$X.runcode(code.compile_command("..."),...) + + ' + - pattern-not: '$PL = code.compile_command("...",...) + + ... + + $X.runcode($PL,...) + + ' + message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external + data can reach this function call because it allows a malicious actor to run arbitrary Python code. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args + shortlink: https://sg.run/0Bgv + semgrep.dev: + rule: + r_id: 27254 + rv_id: 1263464 + rule_id: QrUG72 + version_id: l4TJRK9 + url: https://semgrep.dev/playground/r/l4TJRK9/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: os.$METHOD("...", ...) + - pattern: os.$METHOD(...) + - metavariable-regex: + metavariable: $METHOD + regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe) + - patterns: + - pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...) + - pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (execv|execve|execvp|execvpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + - patterns: + - pattern-not: os.$METHOD("...", $PATH, "...", "...",...) + - pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (execl|execle|execlp|execlpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to + execute commands. + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + confidence: MEDIUM + category: security + technology: + - python + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + shortlink: https://sg.run/qL6z + semgrep.dev: + rule: + r_id: 27256 + rv_id: 1263466 + rule_id: 4bUEAY + version_id: 6xT29l6 + url: https://semgrep.dev/playground/r/6xT29l6/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: os.$METHOD($MODE, "...", ...) + - pattern-inside: os.$METHOD($MODE, $CMD, ...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) + - patterns: + - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...) + - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + - patterns: + - pattern-not: os.$METHOD($MODE, "...", "...", "...", ...) + - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (spawnl|spawnle|spawnlp|spawnlpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to + execute commands. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args + shortlink: https://sg.run/Y3Ke + semgrep.dev: + rule: + r_id: 27258 + rv_id: 1263468 + rule_id: JDUz34 + version_id: zyTb2wn + url: https://semgrep.dev/playground/r/zyTb2wn/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-inside: '_xxsubinterpreters.run_string($ID, $PAYLOAD, ...) + + ' + - pattern-not: '_xxsubinterpreters.run_string($ID, "...", ...) + + ' + - pattern: $PAYLOAD + message: Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary + Python code. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://bugs.python.org/issue43472 + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args + shortlink: https://sg.run/oLl9 + semgrep.dev: + rule: + r_id: 27260 + rv_id: 1409404 + rule_id: GdUkxO + version_id: DkTwBzO + url: https://semgrep.dev/playground/r/DkTwBzO/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sanitizers: + - pattern: shlex.quote(...) + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: subprocess.$FUNC("...", ...) + - pattern-not: subprocess.$FUNC(["...",...], ...) + - pattern-not: subprocess.$FUNC(("...",...), ...) + - pattern-not: subprocess.CalledProcessError(...) + - pattern-not: subprocess.SubprocessError(...) + - pattern: subprocess.$FUNC($CMD, ...) + - patterns: + - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...) + - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD) + - patterns: + - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...) + - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...) + - pattern-either: + - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD], ...) + - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD), ...) + - patterns: + - pattern-not: subprocess.$FUNC("=~/(python)/","...",...) + - pattern: subprocess.$FUNC("=~/(python)/", $CMD) + - patterns: + - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...) + - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...) + - pattern-either: + - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...) + - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...) + - focus-metavariable: $CMD + message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform + command injection. You may consider using 'shlex.quote()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess + - https://docs.python.org/3/library/subprocess.html + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + shortlink: https://sg.run/pLGg + semgrep.dev: + rule: + r_id: 27262 + rv_id: 1263472 + rule_id: AbUgrZ + version_id: jQTn54Y + url: https://semgrep.dev/playground/r/jQTn54Y/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-not: os.$W("...", ...) + - pattern-either: + - pattern: os.system(...) + - pattern: '$X = __import__("os") + + ... + + $X.system(...) + + ' + - pattern: '$X = __import__("os") + + ... + + getattr($X, "system")(...) + + ' + - pattern: '$X = getattr(os, "system") + + ... + + $X(...) + + ' + - pattern: '$X = __import__("os") + + ... + + $Y = getattr($X, "system") + + ... + + $Y(...) + + ' + - pattern: os.popen(...) + - pattern: os.popen2(...) + - pattern: os.popen3(...) + - pattern: os.popen4(...) + message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the + 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.2.4 Dyanmic Code Execution Features + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + version: '4' + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args + shortlink: https://sg.run/XR2K + semgrep.dev: + rule: + r_id: 27264 + rv_id: 1263474 + rule_id: DbUR9g + version_id: 9lT4bG4 + url: https://semgrep.dev/playground/r/9lT4bG4/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '_testcapi.run_in_subinterp($PAYLOAD, ...) + + ' + - pattern-inside: 'test.support.run_in_subinterp($PAYLOAD, ...) + + ' + - pattern: $PAYLOAD + - pattern-not: '_testcapi.run_in_subinterp("...", ...) + + ' + - pattern-not: 'test.support.run_in_subinterp("...", ...) + + ' + message: Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run + arbitrary Python code. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args + shortlink: https://sg.run/1DLw + semgrep.dev: + rule: + r_id: 27266 + rv_id: 1263476 + rule_id: 0oUK7N + version_id: rxTAKpn + url: https://semgrep.dev/playground/r/rxTAKpn/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions + languages: + - python + severity: WARNING + metadata: + category: security + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-276: Incorrect Default Permissions' + technology: + - python + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions + shortlink: https://sg.run/AXY4 + semgrep.dev: + rule: + r_id: 13594 + rv_id: 1263482 + rule_id: zdUYqR + version_id: O9Tpxqr + url: https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions + origin: community + message: These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default + is `0o644` which gives read and write access to yourself and read access to everyone else. + patterns: + - pattern-inside: os.$METHOD(...) + - metavariable-pattern: + metavariable: $METHOD + patterns: + - pattern-either: + - pattern: chmod + - pattern: lchmod + - pattern: fchmod + - pattern-either: + - patterns: + - pattern: os.$METHOD($FILE, $BITS, ...) + - metavariable-comparison: + metavariable: $BITS + comparison: $BITS >= 0o650 and $BITS < 0o100000 + - patterns: + - pattern: os.$METHOD($FILE, $BITS) + - metavariable-comparison: + metavariable: $BITS + comparison: $BITS >= 0o100650 + - patterns: + - pattern: os.$METHOD($FILE, $BITS, ...) + - metavariable-pattern: + metavariable: $BITS + patterns: + - pattern-either: + - pattern: <... stat.S_IWGRP ...> + - pattern: <... stat.S_IXGRP ...> + - pattern: <... stat.S_IWOTH ...> + - pattern: <... stat.S_IXOTH ...> + - pattern: <... stat.S_IRWXO ...> + - pattern: <... stat.S_IRWXG ...> + - patterns: + - pattern: os.$METHOD($FILE, $EXPR | $MOD, ...) + - metavariable-comparison: + metavariable: $MOD + comparison: $MOD == 0o111 +- id: python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + options: + symbolic_propagation: true + mode: taint + pattern-sources: + - patterns: + - pattern: '"$URL" + + ' + - metavariable-pattern: + metavariable: $URL + language: regex + patterns: + - pattern-regex: http:// + - pattern-not-regex: .*://localhost + - pattern-not-regex: .*://127\.0\.0\.1 + pattern-sinks: + - patterns: + - pattern-inside: "with requests.Session(...) as $SESSION:\n ...\n" + - pattern-either: + - pattern: $SESSION.$W($SINK, ...) + - pattern: $SESSION.request($METHOD, $SINK, ...) + - focus-metavariable: $SINK + fix-regex: + regex: '[Hh][Tt][Tt][Pp]://' + replacement: https:// + count: 1 + message: Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead. + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + asvs: + section: V9 Communications Verification Requirements + control_id: 9.2.1 Weak TLS + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements + version: '4' + category: security + technology: + - requests + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + shortlink: https://sg.run/Bk5W + semgrep.dev: + rule: + r_id: 9651 + rv_id: 1263484 + rule_id: lBU9BZ + version_id: vdT06wb + url: https://semgrep.dev/playground/r/vdT06wb/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + origin: community + languages: + - python + severity: INFO +- id: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http + options: + symbolic_propagation: true + mode: taint + pattern-sources: + - patterns: + - pattern: '"$URL" + + ' + - metavariable-pattern: + metavariable: $URL + language: regex + patterns: + - pattern-regex: http:// + - pattern-not-regex: .*://localhost + - pattern-not-regex: .*://127\.0\.0\.1 + pattern-sinks: + - patterns: + - pattern-either: + - pattern: requests.Session(...).$W($SINK, ...) + - pattern: requests.Session(...).request($METHOD, $SINK, ...) + - focus-metavariable: $SINK + fix-regex: + regex: '[Hh][Tt][Tt][Pp]://' + replacement: https:// + count: 1 + message: Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead. + languages: + - python + severity: INFO + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + asvs: + section: V9 Communications Verification Requirements + control_id: 9.1.1 Weak TLS + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements + version: '4' + category: security + technology: + - requests + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http + shortlink: https://sg.run/DoBY + semgrep.dev: + rule: + r_id: 9652 + rv_id: 1263485 + rule_id: YGURXw + version_id: d6Tyx02 + url: https://semgrep.dev/playground/r/d6Tyx02/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http + origin: community +- id: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http + fix-regex: + regex: '[Hh][Tt][Tt][Pp]://' + replacement: https:// + count: 1 + message: Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on + the network and be able to obtain sensitive information. Use 'https://' instead. + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + asvs: + section: V9 Communications Verification Requirements + control_id: 9.1.1 Weak TLS + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements + version: '4' + category: security + technology: + - requests + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http + shortlink: https://sg.run/W8J4 + semgrep.dev: + rule: + r_id: 9653 + rv_id: 1263486 + rule_id: 6JUjpG + version_id: ZRTKA9v + url: https://semgrep.dev/playground/r/ZRTKA9v/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http + origin: community + languages: + - python + severity: INFO + options: + symbolic_propagation: true + mode: taint + pattern-sources: + - patterns: + - pattern: '"$URL" + + ' + - metavariable-pattern: + metavariable: $URL + language: regex + patterns: + - pattern-regex: http:// + - pattern-not-regex: .*://localhost + - pattern-not-regex: .*://127\.0\.0\.1 + pattern-sinks: + - patterns: + - pattern-either: + - pattern: requests.$W($SINK, ...) + - pattern: requests.request($METHOD, $SINK, ...) + - pattern: requests.Request($METHOD, $SINK, ...) + - focus-metavariable: $SINK +- id: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure + patterns: + - pattern: '$LOGGER_OBJ.$LOGGER_CALL($FORMAT_STRING,...) + + ' + - metavariable-regex: + metavariable: $LOGGER_OBJ + regex: (?i)(_logger|logger|self.logger|log) + - metavariable-regex: + metavariable: $LOGGER_CALL + regex: (debug|info|warn|warning|error|exception|critical) + - metavariable-regex: + metavariable: $FORMAT_STRING + regex: (?i).*(api.key|secret|credential|token|password).*\%s.* + message: Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret + credentials being exposed. Make sure that the logger is not logging sensitive information. + severity: WARNING + languages: + - python + metadata: + cwe: + - 'CWE-532: Insertion of Sensitive Information into Log File' + category: security + technology: + - python + owasp: + - A09:2021 - Security Logging and Monitoring Failures + - A09:2025 - Security Logging & Alerting Failures + references: + - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure + shortlink: https://sg.run/ydNx + semgrep.dev: + rule: + r_id: 9668 + rv_id: 1263501 + rule_id: x8UnJk + version_id: A8TgdOR + url: https://semgrep.dev/playground/r/A8TgdOR/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure + origin: community +- id: python.lang.security.audit.md5-used-as-password.md5-used-as-password + severity: WARNING + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked + by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`. + languages: + - python + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://tools.ietf.org/html/rfc6151 + - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords + - https://github.com/returntocorp/semgrep-rules/issues/1609 + - https://docs.python.org/3/library/hashlib.html#hashlib.scrypt + category: security + technology: + - pycryptodome + - hashlib + - md5 + subcategory: + - vuln + likelihood: HIGH + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password + shortlink: https://sg.run/5DwD + semgrep.dev: + rule: + r_id: 14703 + rv_id: 1263504 + rule_id: 6JU1w1 + version_id: WrTqKDz + url: https://semgrep.dev/playground/r/WrTqKDz/python.lang.security.audit.md5-used-as-password.md5-used-as-password + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: hashlib.md5 + - pattern: hashlib.new(..., name="MD5", ...) + - pattern: Cryptodome.Hash.MD5 + - pattern: Crypto.Hash.MD5 + - pattern: cryptography.hazmat.primitives.hashes.MD5 + pattern-sinks: + - patterns: + - pattern: $FUNCTION(...) + - metavariable-regex: + metavariable: $FUNCTION + regex: (?i)(.*password.*) +- id: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces + message: Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to + all available interfaces. Consider instead getting correct address from an environment variable or configuration file. + metadata: + cwe: + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - python + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces + shortlink: https://sg.run/rdln + semgrep.dev: + rule: + r_id: 9669 + rv_id: 1263505 + rule_id: OrU3og + version_id: 0bTKzDL + url: https://semgrep.dev/playground/r/0bTKzDL/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces + origin: community + languages: + - python + severity: INFO + pattern-either: + - pattern: '$S = socket.socket(...) + + ... + + $S.bind(("0.0.0.0", ...)) + + ' + - pattern: '$S = socket.socket(...) + + ... + + $S.bind(("::", ...)) + + ' + - pattern: '$S = socket.socket(...) + + ... + + $S.bind(("", ...)) + + ' +- id: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation + patterns: + - pattern-either: + - pattern: urllib3.PoolManager(..., cert_reqs=$REQS, ...) + - pattern: urllib3.ProxyManager(..., cert_reqs=$REQS, ...) + - pattern: urllib3.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) + - pattern: urllib3.connectionpool.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) + - pattern: urllib3.connection_from_url(..., cert_reqs=$REQS, ...) + - pattern: urllib3.proxy_from_url(..., cert_reqs=$REQS, ...) + - pattern: $CONTEXT.wrap_socket(..., cert_reqs=$REQS, ...) + - pattern: ssl.wrap_socket(..., cert_reqs=$REQS, ...) + - metavariable-regex: + metavariable: $REQS + regex: (NONE|CERT_NONE|CERT_OPTIONAL|ssl\.CERT_NONE|ssl\.CERT_OPTIONAL|\'NONE\'|\"NONE\"|\'OPTIONAL\'|\"OPTIONAL\") + message: certificate verification explicitly disabled, insecure connections possible + metadata: + cwe: + - 'CWE-295: Improper Certificate Validation' + owasp: + - A03:2017 - Sensitive Data Exposure + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + category: security + technology: + - python + references: + - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation + shortlink: https://sg.run/b7yp + semgrep.dev: + rule: + r_id: 9670 + rv_id: 1263506 + rule_id: eqU87k + version_id: K3TKkZn + url: https://semgrep.dev/playground/r/K3TKkZn/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection + message: Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool + instead for to encrypt communications. + metadata: + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool + category: security + technology: + - python + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Mishandled Sensitive Information + source: https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection + shortlink: https://sg.run/N4Np + semgrep.dev: + rule: + r_id: 9671 + rv_id: 1263507 + rule_id: v8UnWQ + version_id: qkTR7E1 + url: https://semgrep.dev/playground/r/qkTR7E1/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection + origin: community + languages: + - python + severity: ERROR + pattern-either: + - pattern: urllib3.HTTPConnectionPool(...) + - pattern: urllib3.connectionpool.HTTPConnectionPool(...) +- id: python.lang.security.audit.sha224-hash.sha224-hash + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating + to a stronger hash function such as SHA-384 or higher to ensure compliance and security. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf + - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography + category: security + technology: + - python + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.audit.sha224-hash.sha224-hash + shortlink: https://sg.run/Db1Yv + semgrep.dev: + rule: + r_id: 151752 + rv_id: 1263511 + rule_id: BYUX0y9 + version_id: 5PTo1QL + url: https://semgrep.dev/playground/r/5PTo1QL/python.lang.security.audit.sha224-hash.sha224-hash + origin: community + severity: WARNING + languages: + - python + pattern-either: + - pattern: hashlib.sha224(...) + - pattern: hashlib.sha3_224(...) +- id: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated + pattern: ssl.wrap_socket(...) + message: '''ssl.wrap_socket()'' is deprecated. This function creates an insecure socket without server name indication or + hostname matching. Instead, create an SSL context using ''ssl.SSLContext()'' and use that to wrap a socket.' + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://docs.python.org/3/library/ssl.html#ssl.wrap_socket + - https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket + category: security + technology: + - python + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated + shortlink: https://sg.run/PJOY + semgrep.dev: + rule: + r_id: 9645 + rv_id: 1263516 + rule_id: BYUN2e + version_id: DkTRbgn + url: https://semgrep.dev/playground/r/DkTRbgn/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated + origin: community + languages: + - python + severity: WARNING +- id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true + patterns: + - pattern: subprocess.$FUNC(..., shell=$TRUE, ...) + - metavariable-pattern: + metavariable: $TRUE + pattern: "True \n" + - pattern-not: subprocess.$FUNC("...", shell=True, ...) + - focus-metavariable: $TRUE + message: Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command + using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious + actor to execute commands. Use 'shell=False' instead. + fix: 'False + + ' + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + references: + - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess + - https://docs.python.org/3/library/subprocess.html + category: security + technology: + - python + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - secure default + likelihood: HIGH + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true + shortlink: https://sg.run/J92w + semgrep.dev: + rule: + r_id: 9646 + rv_id: 1263518 + rule_id: DbUpz2 + version_id: 0bTKzDK + url: https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.audit.weak-ssl-version.weak-ssl-version + message: An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption + and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/insecure_ssl_tls.py#L30 + asvs: + section: V9 Communications Verification Requirements + control_id: 9.1.3 Weak TLS + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements + version: '4' + references: + - https://tools.ietf.org/html/rfc7568 + - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html + - https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2 + category: security + technology: + - python + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version + shortlink: https://sg.run/RoZO + semgrep.dev: + rule: + r_id: 9649 + rv_id: 1263520 + rule_id: KxUbNG + version_id: qkTR7Ev + url: https://semgrep.dev/playground/r/qkTR7Ev/python.lang.security.audit.weak-ssl-version.weak-ssl-version + origin: community + languages: + - python + severity: WARNING + pattern-either: + - pattern: ssl.PROTOCOL_SSLv2 + - pattern: ssl.PROTOCOL_SSLv3 + - pattern: ssl.PROTOCOL_TLSv1 + - pattern: ssl.PROTOCOL_TLSv1_1 + - pattern: pyOpenSSL.SSL.SSLv2_METHOD + - pattern: pyOpenSSL.SSL.SSLv23_METHOD + - pattern: pyOpenSSL.SSL.SSLv3_METHOD + - pattern: pyOpenSSL.SSL.TLSv1_METHOD + - pattern: pyOpenSSL.SSL.TLSv1_1_METHOD +- id: python.lang.security.dangerous-code-run.dangerous-interactive-code-run + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$X = code.InteractiveConsole(...) + + ... + + ' + - pattern-inside: '$X = code.InteractiveInterpreter(...) + + ... + + ' + - pattern-either: + - pattern: '$X.push($PAYLOAD,...) + + ' + - pattern: '$X.runsource($PAYLOAD,...) + + ' + - pattern: '$X.runcode(code.compile_command($PAYLOAD),...) + + ' + - pattern: '$PL = code.compile_command($PAYLOAD,...) + + ... + + $X.runcode($PL,...) + + ' + - focus-metavariable: $PAYLOAD + - pattern-not: '$X.push("...",...) + + ' + - pattern-not: '$X.runsource("...",...) + + ' + - pattern-not: '$X.runcode(code.compile_command("..."),...) + + ' + - pattern-not: '$PL = code.compile_command("...",...) + + ... + + $X.runcode($PL,...) + + ' + message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external + data can reach this function call because it allows a malicious actor to run arbitrary Python code. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run + shortlink: https://sg.run/9pRY + semgrep.dev: + rule: + r_id: 27267 + rv_id: 1263521 + rule_id: KxUKzx + version_id: l4TJRgo + url: https://semgrep.dev/playground/r/l4TJRgo/python.lang.security.dangerous-code-run.dangerous-interactive-code-run + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.dangerous-os-exec.dangerous-os-exec + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: os.$METHOD("...", ...) + - pattern: os.$METHOD(...) + - metavariable-regex: + metavariable: $METHOD + regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe) + - patterns: + - pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...) + - pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (execv|execve|execvp|execvpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + - patterns: + - pattern-not: os.$METHOD("...", $PATH, "...", "...",...) + - pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (execl|execle|execlp|execlpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to + execute commands. + metadata: + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + confidence: MEDIUM + category: security + technology: + - python + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec + shortlink: https://sg.run/yL9x + semgrep.dev: + rule: + r_id: 27268 + rv_id: 1263523 + rule_id: qNUR13 + version_id: 6xT29rz + url: https://semgrep.dev/playground/r/6xT29rz/python.lang.security.dangerous-os-exec.dangerous-os-exec + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.dangerous-spawn-process.dangerous-spawn-process + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - pattern: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + - patterns: + - pattern-either: + - pattern: os.environ['$ANYTHING'] + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb['$ANYTHING'] + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv[...] + - pattern: sys.orig_argv[...] + - patterns: + - pattern-inside: '$PARSER = argparse.ArgumentParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: '$PARSER = optparse.OptionParser(...) + + ... + + ' + - pattern-inside: '$ARGS = $PARSER.parse_args() + + ' + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) + + ... + + ' + - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) + + ... + + ' + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: os.$METHOD($MODE, "...", ...) + - pattern-inside: os.$METHOD($MODE, $CMD, ...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) + - patterns: + - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...) + - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + - patterns: + - pattern-not: os.$METHOD($MODE, "...", "...", "...", ...) + - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (spawnl|spawnle|spawnlp|spawnlpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to + execute commands. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process + shortlink: https://sg.run/r8Zn + semgrep.dev: + rule: + r_id: 27269 + rv_id: 1263524 + rule_id: lBUJrn + version_id: o5TbDO5 + url: https://semgrep.dev/playground/r/o5TbDO5/python.lang.security.dangerous-spawn-process.dangerous-spawn-process + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern: '_xxsubinterpreters.run_string($ID, $PAYLOAD, ...) + + ' + - pattern-not: '_xxsubinterpreters.run_string($ID, "...", ...) + + ' + - focus-metavariable: $PAYLOAD + message: Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary + Python code. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://bugs.python.org/issue43472 + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + shortlink: https://sg.run/bPop + semgrep.dev: + rule: + r_id: 27270 + rv_id: 1263525 + rule_id: PeURWr + version_id: zyTb2OX + url: https://semgrep.dev/playground/r/zyTb2OX/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: subprocess.$FUNC("...", ...) + - pattern-not: subprocess.$FUNC(["...",...], ...) + - pattern-not: subprocess.$FUNC(("...",...), ...) + - pattern-not: subprocess.CalledProcessError(...) + - pattern-not: subprocess.SubprocessError(...) + - pattern: subprocess.$FUNC($CMD, ...) + - patterns: + - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...) + - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD) + - patterns: + - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...) + - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...) + - pattern-either: + - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD], ...) + - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD), ...) + - patterns: + - pattern-not: subprocess.$FUNC("=~/(python)/","...",...) + - pattern: subprocess.$FUNC("=~/(python)/", $CMD) + - patterns: + - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...) + - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...) + - pattern-either: + - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...) + - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...) + - focus-metavariable: $CMD + message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform + command injection. You may consider using 'shlex.escape()'. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.3.8 OS Command Injection + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + version: '4' + references: + - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess + - https://docs.python.org/3/library/subprocess.html + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + shortlink: https://sg.run/NWxp + semgrep.dev: + rule: + r_id: 27271 + rv_id: 1263526 + rule_id: JDUz3R + version_id: pZT038J + url: https://semgrep.dev/playground/r/pZT038J/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.dangerous-system-call.dangerous-system-call + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-not: os.$W("...", ...) + - pattern-either: + - pattern: os.system(...) + - pattern: getattr(os, "system")(...) + - pattern: __import__("os").system(...) + - pattern: getattr(__import__("os"), "system")(...) + - pattern: '$X = __import__("os") + + ... + + $X.system(...) + + ' + - pattern: '$X = __import__("os") + + ... + + getattr($X, "system")(...) + + ' + - pattern: '$X = getattr(os, "system") + + ... + + $X(...) + + ' + - pattern: '$X = __import__("os") + + ... + + $Y = getattr($X, "system") + + ... + + $Y(...) + + ' + - pattern: os.popen(...) + - pattern: os.popen2(...) + - pattern: os.popen3(...) + - pattern: os.popen4(...) + message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the + 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. + metadata: + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + cwe: + - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + asvs: + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + control_id: 5.2.4 Dyanmic Code Execution Features + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + version: '4' + category: security + technology: + - python + confidence: MEDIUM + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Command Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call + shortlink: https://sg.run/k0W7 + semgrep.dev: + rule: + r_id: 27272 + rv_id: 1263527 + rule_id: 5rUoP1 + version_id: 2KTv2Zn + url: https://semgrep.dev/playground/r/2KTv2Zn/python.lang.security.dangerous-system-call.dangerous-system-call + origin: community + languages: + - python + severity: ERROR +- id: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + mode: taint + options: + symbolic_propagation: true + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: flask.request.form.get(...) + - pattern: flask.request.form[...] + - pattern: flask.request.args.get(...) + - pattern: flask.request.args[...] + - pattern: flask.request.values.get(...) + - pattern: flask.request.values[...] + - pattern: flask.request.cookies.get(...) + - pattern: flask.request.cookies[...] + - pattern: flask.request.stream + - pattern: flask.request.headers.get(...) + - pattern: flask.request.headers[...] + - pattern: flask.request.data + - pattern: flask.request.full_path + - pattern: flask.request.url + - pattern: flask.request.json + - pattern: flask.request.get_json() + - pattern: flask.request.view_args.get(...) + - pattern: flask.request.view_args[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - focus-metavariable: $ROUTEVAR + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + - patterns: + - pattern-either: + - pattern-inside: "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n ...\n" + - patterns: + - pattern-either: + - pattern-inside: "class $VIEW(..., rest_framework.views.APIView, ...):\n ...\n" + - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \ + \ \n" + - pattern-inside: "def $METHOD(self, $REQ, ...):\n ...\n" + - metavariable-regex: + metavariable: $METHOD + regex: (get|post|put|patch|delete|head) + - pattern-either: + - pattern: $REQ.POST.get(...) + - pattern: $REQ.POST[...] + - pattern: $REQ.FILES.get(...) + - pattern: $REQ.FILES[...] + - pattern: $REQ.DATA.get(...) + - pattern: $REQ.DATA[...] + - pattern: $REQ.QUERY_PARAMS.get(...) + - pattern: $REQ.QUERY_PARAMS[...] + - pattern: $REQ.data.get(...) + - pattern: $REQ.data[...] + - pattern: $REQ.query_params.get(...) + - pattern: $REQ.query_params[...] + - pattern: $REQ.content_type + - pattern: $REQ.content_type + - pattern: $REQ.stream + - pattern: $REQ.stream + - patterns: + - pattern-either: + - pattern-inside: "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.StreamRequestHandler, ...):\n ...\n" + - pattern-inside: "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n ...\n" + - pattern-either: + - pattern: self.requestline + - pattern: self.path + - pattern: self.headers[...] + - pattern: self.headers.get(...) + - pattern: self.rfile + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '_testcapi.run_in_subinterp($PAYLOAD, ...) + + ' + - pattern: 'test.support.run_in_subinterp($PAYLOAD, ...) + + ' + - focus-metavariable: $PAYLOAD + - pattern-not: '_testcapi.run_in_subinterp("...", ...) + + ' + - pattern-not: 'test.support.run_in_subinterp("...", ...) + + ' + message: Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run + arbitrary Python code. + metadata: + cwe: + - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + category: security + technology: + - python + confidence: MEDIUM + subcategory: + - vuln + likelihood: HIGH + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + shortlink: https://sg.run/wLpY + semgrep.dev: + rule: + r_id: 27273 + rv_id: 1263528 + rule_id: GdUkxR + version_id: X0Tzy1e + url: https://semgrep.dev/playground/r/X0Tzy1e/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + references: + - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation + - https://nvd.nist.gov/vuln/detail/CVE-2017-18342 + category: security + technology: + - pyyaml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load + shortlink: https://sg.run/we9Y + semgrep.dev: + rule: + r_id: 9673 + rv_id: 1263530 + rule_id: ZqU5jZ + version_id: 1QTyprw + url: https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load + origin: community + languages: + - python + message: Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and + `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input + could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to + steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` + instead. + fix-regex: + regex: unsafe_load + replacement: safe_load + count: 1 + severity: ERROR + patterns: + - pattern-inside: 'import yaml + + ... + + ' + - pattern-not-inside: '$YAML = ruamel.yaml.YAML(...) + + ... + + ' + - pattern-either: + - pattern: yaml.unsafe_load(...) + - pattern: yaml.load(..., Loader=yaml.Loader, ...) + - pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...) + - pattern: yaml.load(..., Loader=yaml.CLoader, ...) + - pattern: yaml.load_all(..., Loader=yaml.Loader, ...) + - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...) + - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...) +- id: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + references: + - https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ + category: security + technology: + - ruamel.yaml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel + shortlink: https://sg.run/x1rz + semgrep.dev: + rule: + r_id: 9674 + rv_id: 1263531 + rule_id: nJUzqK + version_id: 9lT4bvG + url: https://semgrep.dev/playground/r/9lT4bvG/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel + origin: community + languages: + - python + message: Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor + could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead. + severity: ERROR + pattern-either: + - pattern: ruamel.yaml.YAML(..., typ='unsafe', ...) + - pattern: ruamel.yaml.YAML(..., typ='base', ...) +- id: python.lang.security.deserialization.pickle.avoid-shelve + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + references: + - https://docs.python.org/3/library/pickle.html + category: security + technology: + - python + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve + shortlink: https://sg.run/dKkZ + semgrep.dev: + rule: + r_id: 9678 + rv_id: 1263535 + rule_id: 8GUje2 + version_id: NdTzyb4 + url: https://semgrep.dev/playground/r/NdTzyb4/python.lang.security.deserialization.pickle.avoid-shelve + origin: community + languages: + - python + message: Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, + the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON + or a similar text-based serialization format. + severity: WARNING + pattern: shelve.$FUNC(...) +- id: python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + patterns: + - pattern: hashlib.md5(...) + - pattern-not: hashlib.md5(..., usedforsecurity=False, ...) + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use SHA256 or SHA3 instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B303 + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.2 Insecure Custom Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + references: + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - python + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + shortlink: https://sg.run/vYrY + semgrep.dev: + rule: + r_id: 33633 + rv_id: 1263536 + rule_id: PeU2e2 + version_id: kbTzGE1 + url: https://semgrep.dev/playground/r/kbTzGE1/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + pattern: hashlib.sha1(...) + fix-regex: + regex: sha1 + replacement: sha256 + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B303 + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.2 Insecure Custom Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + references: + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - python + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + shortlink: https://sg.run/ydYx + semgrep.dev: + rule: + r_id: 9624 + rv_id: 1263537 + rule_id: x8UnBk + version_id: w8TRoE7 + url: https://semgrep.dev/playground/r/w8TRoE7/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + origin: community + severity: WARNING + languages: + - python +- id: python.lang.security.insecure-hash-function.insecure-hash-function + message: Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered + deprecated. Consider using 'SHA256' or a similar function instead. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/hashlib_new_insecure_functions.py + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.2.2 Insecure Custom Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + version: '4' + references: + - https://tools.ietf.org/html/rfc6151 + - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - python + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function + shortlink: https://sg.run/rdBn + semgrep.dev: + rule: + r_id: 9625 + rv_id: 1501841 + rule_id: OrU30g + version_id: xyT0gk7 + url: https://semgrep.dev/playground/r/xyT0gk7/python.lang.security.insecure-hash-function.insecure-hash-function + origin: community + languages: + - python + severity: WARNING + patterns: + - pattern-either: + - pattern: hashlib.new("=~/[M|m][D|d][4|5]/", ...) + - pattern: hashlib.new(..., name="=~/[M|m][D|d][4|5]/", ...) + - pattern-not: hashlib.new(..., usedforsecurity=False, ...) +- id: python.lang.security.insecure-uuid-version.insecure-uuid-version + patterns: + - pattern: uuid.uuid1(...) + message: Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, + timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better + randomness and security. + metadata: + references: + - https://www.landh.tech/blog/20230811-sandwich-attack/ + cwe: + - 'CWE-330: Use of Insufficiently Random Values' + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + asvs: + section: V6 Stored Cryptography Verification Requirements + control_id: 6.3.2 Insecure UUID Generation + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v63-random-values + version: '4' + category: security + technology: + - python + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version + shortlink: https://sg.run/BYBgW + semgrep.dev: + rule: + r_id: 148295 + rv_id: 1263539 + rule_id: kxUd1yD + version_id: O9Tpx97 + url: https://semgrep.dev/playground/r/O9Tpx97/python.lang.security.insecure-uuid-version.insecure-uuid-version + origin: community + languages: + - python + severity: WARNING + fix-regex: + regex: uuid1 + replacement: uuid4 +- id: python.lang.security.unverified-ssl-context.unverified-ssl-context + patterns: + - pattern-either: + - pattern: ssl._create_unverified_context(...) + - pattern: ssl._create_default_https_context = ssl._create_unverified_context + fix-regex: + regex: _create_unverified_context + replacement: create_default_context + message: Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use + 'ssl.create_default_context' instead. + metadata: + owasp: + - A03:2017 - Sensitive Data Exposure + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + cwe: + - 'CWE-295: Improper Certificate Validation' + references: + - https://docs.python.org/3/library/ssl.html#ssl-security + - https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection + category: security + technology: + - python + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context + shortlink: https://sg.run/N4lp + semgrep.dev: + rule: + r_id: 9627 + rv_id: 1263540 + rule_id: v8UnkQ + version_id: e1Tyjlj + url: https://semgrep.dev/playground/r/e1Tyjlj/python.lang.security.unverified-ssl-context.unverified-ssl-context + origin: community + severity: ERROR + languages: + - python +- id: python.lang.security.use-defused-xml-parse.use-defused-xml-parse + metadata: + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + references: + - https://docs.python.org/3/library/xml.html + - https://github.com/tiran/defusedxml + - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing + category: security + technology: + - python + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse + shortlink: https://sg.run/n3jG + semgrep.dev: + rule: + r_id: 72436 + rv_id: 1263541 + rule_id: X5Uqnx + version_id: vdT06ER + url: https://semgrep.dev/playground/r/vdT06ER/python.lang.security.use-defused-xml-parse.use-defused-xml-parse + origin: community + message: The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential + data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python + documentation recommends using `defusedxml`. + languages: + - python + severity: ERROR + patterns: + - pattern: xml.etree.ElementTree.parse($...ARGS) + - pattern-not: xml.etree.ElementTree.parse("...") + fix: defusedxml.etree.ElementTree.parse($...ARGS) +- id: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish + message: Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure + and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such + as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, + such as GCM. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption + - https://www.pycryptodome.org/src/cipher/cipher + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish + shortlink: https://sg.run/dlOE + semgrep.dev: + rule: + r_id: 33634 + rv_id: 1263545 + rule_id: JDUGnK + version_id: ExTExln + url: https://semgrep.dev/playground/r/ExTExln/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish + origin: community + options: + symbolic_propagation: true + severity: WARNING + languages: + - python + pattern-either: + - pattern: Cryptodome.Cipher.Blowfish.new(...) + - pattern: Crypto.Cipher.Blowfish.new(...) +- id: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des + message: Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically + secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream + ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using + a block cipher, use a modern mode of operation that also provides authentication, such as GCM. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://cwe.mitre.org/data/definitions/326.html + - https://www.pycryptodome.org/src/cipher/cipher + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des + shortlink: https://sg.run/Z5bw + semgrep.dev: + rule: + r_id: 33635 + rv_id: 1263546 + rule_id: 5rUr73 + version_id: 7ZTE3G7 + url: https://semgrep.dev/playground/r/7ZTE3G7/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des + origin: community + options: + symbolic_propagation: true + severity: WARNING + languages: + - python + pattern-either: + - pattern: Cryptodome.Cipher.DES.new(...) + - pattern: Crypto.Cipher.DES.new(...) + - pattern: Cryptodome.Cipher.DES3.new(...) + - pattern: Crypto.Cipher.DES3.new(...) +- id: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 + message: Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and + can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES + with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, + such as GCM. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://cwe.mitre.org/data/definitions/326.html + - https://www.pycryptodome.org/src/cipher/cipher + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 + shortlink: https://sg.run/nAbY + semgrep.dev: + rule: + r_id: 33636 + rv_id: 1263547 + rule_id: GdUYlW + version_id: LjTkgn6 + url: https://semgrep.dev/playground/r/LjTkgn6/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 + origin: community + options: + symbolic_propagation: true + severity: WARNING + languages: + - python + pattern-either: + - pattern: Cryptodome.Cipher.ARC2.new(...) + - pattern: Crypto.Cipher.ARC2.new(...) +- id: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 + message: Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and + can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES + with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, + such as GCM. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://cwe.mitre.org/data/definitions/326.html + - https://www.pycryptodome.org/src/cipher/cipher + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 + shortlink: https://sg.run/Eo6N + semgrep.dev: + rule: + r_id: 33637 + rv_id: 1263548 + rule_id: ReUnEB + version_id: 8KT5rXY + url: https://semgrep.dev/playground/r/8KT5rXY/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 + origin: community + severity: WARNING + languages: + - python + pattern-either: + - pattern: Cryptodome.Cipher.ARC4.new(...) + - pattern: Crypto.Cipher.ARC4.new(...) +- id: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor + message: Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and + can be reversed easily. Use AES instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + bandit-code: B304 + references: + - https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor + shortlink: https://sg.run/L0yr + semgrep.dev: + rule: + r_id: 9683 + rv_id: 1263549 + rule_id: PeUk5W + version_id: gETB7j3 + url: https://semgrep.dev/playground/r/gETB7j3/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor + origin: community + severity: WARNING + languages: + - python + pattern-either: + - pattern: Cryptodome.Cipher.XOR.new(...) + - pattern: Crypto.Cipher.XOR.new(...) +- id: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 + message: Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::hash-algorithm::pycryptodome + - crypto::search::hash-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 + shortlink: https://sg.run/7JP2 + semgrep.dev: + rule: + r_id: 33638 + rv_id: 1263550 + rule_id: AbU0Ex + version_id: QkTGqD8 + url: https://semgrep.dev/playground/r/QkTGqD8/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 + origin: community + options: + symbolic_propagation: true + severity: WARNING + languages: + - python + pattern-either: + - pattern: Crypto.Hash.MD2.new(...) + - pattern: Cryptodome.Hash.MD2.new (...) +- id: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 + message: Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::hash-algorithm::pycryptodome + - crypto::search::hash-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 + shortlink: https://sg.run/Lve6 + semgrep.dev: + rule: + r_id: 33639 + rv_id: 1263551 + rule_id: BYUJy4 + version_id: 3ZT4Xnp + url: https://semgrep.dev/playground/r/3ZT4Xnp/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 + origin: community + options: + symbolic_propagation: true + severity: WARNING + languages: + - python + pattern-either: + - pattern: Crypto.Hash.MD4.new(...) + - pattern: Cryptodome.Hash.MD4.new (...) +- id: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable + as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::hash-algorithm::pycryptodome + - crypto::search::hash-algorithm::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 + shortlink: https://sg.run/85JN + semgrep.dev: + rule: + r_id: 33640 + rv_id: 1263552 + rule_id: DbUXwo + version_id: 44TEjpk + url: https://semgrep.dev/playground/r/44TEjpk/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 + origin: community + options: + symbolic_propagation: true + severity: WARNING + languages: + - python + pattern-either: + - pattern: Crypto.Hash.MD5.new(...) + - pattern: Cryptodome.Hash.MD5.new (...) +- id: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + metadata: + source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html + - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability + - http://2012.sharcs.org/slides/stevens.pdf + - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 + shortlink: https://sg.run/3ALr + semgrep.dev: + rule: + r_id: 9687 + rv_id: 1263553 + rule_id: ReUPO3 + version_id: PkTR3vk + url: https://semgrep.dev/playground/r/PkTR3vk/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 + origin: community + severity: WARNING + languages: + - python + pattern-either: + - pattern: Crypto.Hash.SHA.new(...) + - pattern: Cryptodome.Hash.SHA.new (...) +- id: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size + message: Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + references: + - https://www.pycryptodome.org/src/public_key/dsa + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::key-length::pycryptodome + - crypto::search::key-length::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size + shortlink: https://sg.run/4y8l + semgrep.dev: + rule: + r_id: 9688 + rv_id: 1263554 + rule_id: AbUWje + version_id: JdTzxbQ + url: https://semgrep.dev/playground/r/JdTzxbQ/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size + origin: community + options: + symbolic_propagation: true + languages: + - python + severity: WARNING + patterns: + - pattern-either: + - pattern: Crypto.PublicKey.DSA.generate(..., bits=$SIZE, ...) + - pattern: Crypto.PublicKey.DSA.generate($SIZE, ...) + - pattern: Cryptodome.PublicKey.DSA.generate(..., bits=$SIZE, ...) + - pattern: Cryptodome.PublicKey.DSA.generate($SIZE, ...) + - metavariable-comparison: + metavariable: $SIZE + comparison: $SIZE < 2048 +- id: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size + message: Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher. + metadata: + cwe: + - 'CWE-326: Inadequate Encryption Strength' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + references: + - https://www.pycryptodome.org/src/public_key/rsa#rsa + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf + category: security + technology: + - pycryptodome + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: HIGH + functional-categories: + - crypto::search::key-length::pycryptodome + - crypto::search::key-length::pycryptodomex + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size + shortlink: https://sg.run/PprY + semgrep.dev: + rule: + r_id: 9689 + rv_id: 1263555 + rule_id: BYUBWe + version_id: 5PTo1jL + url: https://semgrep.dev/playground/r/5PTo1jL/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size + origin: community + options: + symbolic_propagation: true + languages: + - python + severity: WARNING + patterns: + - pattern-either: + - pattern: Crypto.PublicKey.RSA.generate(..., bits=$SIZE, ...) + - pattern: Crypto.PublicKey.RSA.generate($SIZE, ...) + - pattern: Cryptodome.PublicKey.RSA.generate(..., bits=$SIZE, ...) + - pattern: Cryptodome.PublicKey.RSA.generate($SIZE, ...) + - metavariable-comparison: + metavariable: $SIZE + comparison: $SIZE < 3072 +- id: python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication + message: 'An encryption mode of operation is being used without proper message authentication. This can potentially result + in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ' + languages: + - python + severity: ERROR + metadata: + category: security + technology: + - cryptography + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication + shortlink: https://sg.run/k1K1 + semgrep.dev: + rule: + r_id: 31872 + rv_id: 1263556 + rule_id: YGUw8w + version_id: GxTkeyz + url: https://semgrep.dev/playground/r/GxTkeyz/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication + origin: community + patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: 'AES.new(..., $PYCRYPTODOME_MODE) + + ' + - pattern-not-inside: 'AES.new(..., $PYCRYPTODOME_MODE) + + ... + + HMAC.new + + ' + - metavariable-pattern: + metavariable: $PYCRYPTODOME_MODE + patterns: + - pattern-either: + - pattern: AES.MODE_CBC + - pattern: AES.MODE_CTR + - pattern: AES.MODE_CFB + - pattern: AES.MODE_OFB +- id: python.pymongo.security.mongodb.mongo-client-bad-auth + pattern: 'pymongo.MongoClient(..., authMechanism=''MONGODB-CR'') + + ' + message: Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see + https://api.mongodb.com/python/current/examples/authentication.html for details). + fix-regex: + regex: MONGODB-CR + replacement: SCRAM-SHA-256 + severity: WARNING + languages: + - python + metadata: + cwe: + - 'CWE-477: Use of Obsolete Function' + category: security + technology: + - pymongo + references: + - https://cwe.mitre.org/data/definitions/477.html + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Dangerous Method or Function + source: https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth + shortlink: https://sg.run/YXRd + semgrep.dev: + rule: + r_id: 12658 + rv_id: 946422 + rule_id: d8UlOX + version_id: 0bT15XY + url: https://semgrep.dev/playground/r/0bT15XY/python.pymongo.security.mongodb.mongo-client-bad-auth + origin: community +- id: python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + patterns: + - pattern: pyramid.authentication.$FUNC($...PARAMS) + - metavariable-pattern: + metavariable: $FUNC + pattern-either: + - pattern: AuthTktCookieHelper + - pattern: AuthTktAuthenticationPolicy + - pattern-not: pyramid.authentication.$FUNC(..., httponly=$HTTPONLY, ...) + - pattern-not: pyramid.authentication.$FUNC(..., **$PARAMS, ...) + - focus-metavariable: $...PARAMS + fix: '$...PARAMS, httponly=True + + ' + message: Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should + be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected + and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + shortlink: https://sg.run/EprB + semgrep.dev: + rule: + r_id: 21437 + rv_id: 1263557 + rule_id: bwUXKB + version_id: RGT0L7K + url: https://semgrep.dev/playground/r/RGT0L7K/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value + patterns: + - pattern-either: + - patterns: + - pattern-not: pyramid.authentication.AuthTktCookieHelper(..., **$PARAMS) + - pattern: pyramid.authentication.AuthTktCookieHelper(..., httponly=$HTTPONLY, ...) + - patterns: + - pattern-not: pyramid.authentication.AuthTktAuthenticationPolicy(..., **$PARAMS) + - pattern: pyramid.authentication.AuthTktAuthenticationPolicy(..., httponly=$HTTPONLY, ...) + - pattern: $HTTPONLY + - metavariable-pattern: + metavariable: $HTTPONLY + pattern: 'False + + ' + fix: 'True + + ' + message: Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should + be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected + and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value + shortlink: https://sg.run/7DgQ + semgrep.dev: + rule: + r_id: 21438 + rv_id: 1263558 + rule_id: NbUq9e + version_id: A8Tgd8N + url: https://semgrep.dev/playground/r/A8Tgd8N/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite + patterns: + - pattern-either: + - pattern: pyramid.authentication.AuthTktCookieHelper(..., samesite=$SAMESITE, ...) + - pattern: pyramid.authentication.AuthTktAuthenticationPolicy(..., samesite=$SAMESITE, ...) + - pattern: $SAMESITE + - metavariable-regex: + metavariable: $SAMESITE + regex: (?!'Lax') + fix: '''Lax'' + + ' + message: Found a Pyramid Authentication Ticket without the samesite option correctly set. Pyramid cookies should be handled + securely by setting samesite='Lax'. If this parameter is not properly set, your cookies are not properly protected and + are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite + shortlink: https://sg.run/LYrY + semgrep.dev: + rule: + r_id: 21439 + rv_id: 1263559 + rule_id: kxUYjY + version_id: BjTkZ51 + url: https://semgrep.dev/playground/r/BjTkZ51/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default + patterns: + - pattern-either: + - patterns: + - pattern-not: pyramid.authentication.AuthTktCookieHelper(..., secure=$SECURE, ...) + - pattern-not: pyramid.authentication.AuthTktCookieHelper(..., **$PARAMS) + - pattern: pyramid.authentication.AuthTktCookieHelper(...) + - patterns: + - pattern-not: pyramid.authentication.AuthTktAuthenticationPolicy(..., secure=$SECURE, ...) + - pattern-not: pyramid.authentication.AuthTktAuthenticationPolicy(..., **$PARAMS) + - pattern: pyramid.authentication.AuthTktAuthenticationPolicy(...) + fix-regex: + regex: (.*)\) + replacement: \1, secure=True) + message: Found a Pyramid Authentication Ticket cookie using an unsafe default for the secure option. Pyramid cookies should + be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected + and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default + shortlink: https://sg.run/8WxQ + semgrep.dev: + rule: + r_id: 21440 + rv_id: 1263560 + rule_id: wdUKzn + version_id: DkTRbJn + url: https://semgrep.dev/playground/r/DkTRbJn/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value + patterns: + - pattern-either: + - patterns: + - pattern-not: pyramid.authentication.AuthTktCookieHelper(..., **$PARAMS) + - pattern: pyramid.authentication.AuthTktCookieHelper(..., secure=$SECURE, ...) + - patterns: + - pattern-not: pyramid.authentication.AuthTktAuthenticationPolicy(..., **$PARAMS) + - pattern: pyramid.authentication.AuthTktAuthenticationPolicy(..., secure=$SECURE, ...) + - pattern: $SECURE + - metavariable-pattern: + metavariable: $SECURE + pattern: 'False + + ' + fix: 'True + + ' + message: Found a Pyramid Authentication Ticket cookie without the secure option correctly set. Pyramid cookies should be + handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected + and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value + shortlink: https://sg.run/gjp5 + semgrep.dev: + rule: + r_id: 21441 + rv_id: 1263561 + rule_id: x8UqAp + version_id: WrTqK93 + url: https://semgrep.dev/playground/r/WrTqK93/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally + patterns: + - pattern-inside: '$CONFIG.set_default_csrf_options(..., check_origin=$CHECK_ORIGIN, ...) + + ' + - pattern: $CHECK_ORIGIN + - metavariable-comparison: + metavariable: $CHECK_ORIGIN + comparison: $CHECK_ORIGIN == False + message: Automatic check of the referrer for cross-site request forgery tokens has been explicitly disabled globally, which + might leave views unprotected when an unsafe CSRF storage policy is used. Use 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)' + to turn the automatic check for all unsafe methods (per RFC2616). + languages: + - python + severity: ERROR + fix: 'True + + ' + metadata: + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally + shortlink: https://sg.run/3GeW + semgrep.dev: + rule: + r_id: 21443 + rv_id: 1263563 + rule_id: eqU9Le + version_id: K3TKkeo + url: https://semgrep.dev/playground/r/K3TKkeo/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally + origin: community +- id: python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled + message: Origin check for the CSRF token is disabled for this view. This might represent a security risk if the CSRF storage + policy is not known to be secure. + metadata: + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + asvs: + section: V4 Access Control + control_id: 4.2.2 CSRF + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control + version: '4' + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled + shortlink: https://sg.run/4RB9 + semgrep.dev: + rule: + r_id: 21444 + rv_id: 1263564 + rule_id: v8UGpL + version_id: qkTR7Gv + url: https://semgrep.dev/playground/r/qkTR7Gv/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled + origin: community + severity: WARNING + languages: + - python + patterns: + - pattern-inside: "from pyramid.view import view_config\n...\n@view_config(..., check_origin=$CHECK_ORIGIN, ...)\ndef $VIEW(...):\n\ + \ ...\n" + - pattern: $CHECK_ORIGIN + - metavariable-comparison: + metavariable: $CHECK_ORIGIN + comparison: $CHECK_ORIGIN == False + fix: 'True + + ' +- id: python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default + patterns: + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...) + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(...) + fix-regex: + regex: (.*)\) + replacement: \1, httponly=True) + message: Found a Pyramid cookie using an unsafe default for the httponly option. Pyramid cookies should be handled securely + by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default + shortlink: https://sg.run/P19v + semgrep.dev: + rule: + r_id: 21445 + rv_id: 1263565 + rule_id: d8UPQ7 + version_id: l4TJRbo + url: https://semgrep.dev/playground/r/l4TJRbo/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value + patterns: + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...) + - pattern: $HTTPONLY + - metavariable-pattern: + metavariable: $HTTPONLY + pattern: 'False + + ' + fix: 'True + + ' + message: Found a Pyramid cookie without the httponly option correctly set. Pyramid cookies should be handled securely by + setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://owasp.org/www-community/controls/SecureCookieAttribute + - https://owasp.org/www-community/HttpOnly + - https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#httponly-attribute + category: security + technology: + - pyramid + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value + shortlink: https://sg.run/JbqP + semgrep.dev: + rule: + r_id: 21446 + rv_id: 1263566 + rule_id: ZqU37W + version_id: YDTZe54 + url: https://semgrep.dev/playground/r/YDTZe54/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default + patterns: + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., samesite=$SAMESITE, ...) + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(...) + fix-regex: + regex: (.*)\) + replacement: \1, samesite='Lax') + message: Found a Pyramid cookie using an unsafe value for the samesite option. Pyramid cookies should be handled securely + by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default + shortlink: https://sg.run/5AWj + semgrep.dev: + rule: + r_id: 21447 + rv_id: 1263567 + rule_id: nJUp80 + version_id: 6xT293z + url: https://semgrep.dev/playground/r/6xT293z/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value + patterns: + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(..., samesite=$SAMESITE, ...) + - pattern: $SAMESITE + - metavariable-regex: + metavariable: $SAMESITE + regex: (?!'Lax') + fix: '''Lax'' + + ' + message: Found a Pyramid cookie without the samesite option correctly set. Pyramid cookies should be handled securely by + setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value + shortlink: https://sg.run/GXR6 + semgrep.dev: + rule: + r_id: 21448 + rv_id: 1263568 + rule_id: EwUgpY + version_id: o5TbDv5 + url: https://semgrep.dev/playground/r/o5TbDv5/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default + patterns: + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., secure=$SECURE, ...) + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(...) + fix-regex: + regex: (.*)\) + replacement: \1, secure=True) + message: Found a Pyramid cookie using an unsafe default for the secure option. Pyramid cookies should be handled securely + by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default + shortlink: https://sg.run/RbrN + semgrep.dev: + rule: + r_id: 21449 + rv_id: 1263569 + rule_id: 7KUr15 + version_id: zyTb2dX + url: https://semgrep.dev/playground/r/zyTb2dX/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value + patterns: + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(..., secure=$SECURE, ...) + - pattern: $SECURE + - metavariable-pattern: + metavariable: $SECURE + pattern: 'False + + ' + fix: 'True + + ' + message: Found a Pyramid cookie without the secure option correctly set. Pyramid cookies should be handled securely by setting + secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected + and are at risk of being stolen by an attacker. + metadata: + cwe: + - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cookie Security + source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value + shortlink: https://sg.run/AzjB + semgrep.dev: + rule: + r_id: 21450 + rv_id: 1263570 + rule_id: L1UX2J + version_id: pZT03oJ + url: https://semgrep.dev/playground/r/pZT03oJ/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value + origin: community + languages: + - python + severity: WARNING +- id: python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally + patterns: + - pattern-inside: '$CONFIG.set_default_csrf_options(..., require_csrf=$REQUIRE_CSRF, ...) + + ' + - pattern: $REQUIRE_CSRF + - metavariable-comparison: + metavariable: $REQUIRE_CSRF + comparison: $REQUIRE_CSRF == False + message: Automatic check of cross-site request forgery tokens has been explicitly disabled globally, which might leave views + unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)' to turn the automatic check + for all unsafe methods (per RFC2616). + languages: + - python + severity: ERROR + fix: 'True + + ' + metadata: + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: LOW + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + source: https://semgrep.dev/r/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally + shortlink: https://sg.run/Bx2R + semgrep.dev: + rule: + r_id: 21451 + rv_id: 1263571 + rule_id: 8GUKqP + version_id: 2KTv2en + url: https://semgrep.dev/playground/r/2KTv2en/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally + origin: community +- id: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response + message: Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting + (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - pyramid + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response + shortlink: https://sg.run/DX8G + semgrep.dev: + rule: + r_id: 21452 + rv_id: 1263572 + rule_id: gxUeA8 + version_id: X0TzyEe + url: https://semgrep.dev/playground/r/X0TzyEe/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response + origin: community + languages: + - python + severity: ERROR + mode: taint + pattern-sources: + - patterns: + - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-either: + - pattern: 'pyramid.request.Response.text($SINK) + + ' + - pattern: 'pyramid.request.Response($SINK) + + ' + - pattern: '$REQ.response.body = $SINK + + ' + - pattern: '$REQ.response.text = $SINK + + ' + - pattern: '$REQ.response.ubody = $SINK + + ' + - pattern: '$REQ.response.unicode_body = $SINK + + ' + - pattern: $SINK +- id: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection + message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs + raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL + into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function + besides "bindparams". Use bindParams to securely bind user-input to SQL statements. + languages: + - python + severity: ERROR + metadata: + category: security + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data + technology: + - pyramid + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection + shortlink: https://sg.run/W7eE + semgrep.dev: + rule: + r_id: 21453 + rv_id: 1263573 + rule_id: QrUZ7l + version_id: jQTn5WA + url: https://semgrep.dev/playground/r/jQTn5WA/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection + origin: community + mode: taint + pattern-sources: + - patterns: + - pattern-inside: "from pyramid.view import view_config\n...\n@view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + pattern-sinks: + - patterns: + - pattern-inside: '$QUERY = $REQ.dbsession.query(...) + + ... + + ' + - pattern-either: + - pattern: '$QUERY.$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...)) + + ' + - pattern: '$QUERY.join(...).$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...)) + + ' + - pattern: $SINK + - metavariable-regex: + metavariable: $SQLFUNC + regex: (group_by|order_by|distinct|having|filter) + - metavariable-regex: + metavariable: $FORMATFUNC + regex: (?!bindparams) + fix-regex: + regex: format + replacement: bindparams +- id: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text + mode: taint + pattern-sinks: + - pattern: 'sqlalchemy.text(...) + + ' + pattern-sources: + - patterns: + - pattern: '$X + $Y + + ' + - metavariable-type: + metavariable: $X + type: string + - patterns: + - pattern: '$X + $Y + + ' + - metavariable-type: + metavariable: $Y + type: string + - patterns: + - pattern: 'f"..." + + ' + - patterns: + - pattern: '$X.format(...) + + ' + - metavariable-type: + metavariable: $X + type: string + - patterns: + - pattern: '$X % $Y + + ' + - metavariable-type: + metavariable: $X + type: string + message: sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual + SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. + Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL. + metadata: + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + category: security + technology: + - sqlalchemy + confidence: MEDIUM + references: + - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text + shortlink: https://sg.run/yP1O + semgrep.dev: + rule: + r_id: 15824 + rv_id: 1263577 + rule_id: r6U2wE + version_id: rxTAKqq + url: https://semgrep.dev/playground/r/rxTAKqq/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text + origin: community + languages: + - python + severity: ERROR +- id: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + patterns: + - pattern-either: + - pattern: "def $FUNC(...,$VAR,...):\n ...\n $SESSION.query(...).$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n" + - pattern: "def $FUNC(...,$VAR,...):\n ...\n $SESSION.query.join(...).$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n" + - pattern: "def $FUNC(...,$VAR,...):\n ...\n $SESSION.query.$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n" + - pattern: "def $FUNC(...,$VAR,...):\n ...\n query.$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n" + - metavariable-regex: + metavariable: $SQLFUNC + regex: (group_by|order_by|distinct|having|filter) + - metavariable-regex: + metavariable: $FORMATFUNC + regex: (?!bindparams) + message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs + raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL + into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function + besides "bindparams". Use bindParams to securely bind user-input to SQL statements. + fix-regex: + regex: format + replacement: bindparams + languages: + - python + severity: WARNING + metadata: + cwe: + - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + category: security + technology: + - sqlalchemy + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - SQL Injection + source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + shortlink: https://sg.run/J3Xo + semgrep.dev: + rule: + r_id: 9702 + rv_id: 1263579 + rule_id: BYUBWo + version_id: NdTzyL4 + url: https://semgrep.dev/playground/r/NdTzyL4/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + origin: community +- id: python.twilio.security.twiml-injection.twiml-injection + languages: + - python + severity: WARNING + message: Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the + injection of additional TwiML commands + metadata: + cwe: + - 'CWE-91: XML Injection' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + category: security + technology: + - python + - twilio + - twiml + confidence: MEDIUM + likelihood: HIGH + impact: MEDIUM + subcategory: + - vuln + references: + - https://codeberg.org/fennix/funjection + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection + shortlink: https://sg.run/GdEEy + semgrep.dev: + rule: + r_id: 134692 + rv_id: 1263580 + rule_id: oqUgjj2 + version_id: kbTzGp1 + url: https://semgrep.dev/playground/r/kbTzGp1/python.twilio.security.twiml-injection.twiml-injection + origin: community + mode: taint + pattern-sources: + - pattern: 'f"..." + + ' + - pattern: '"..." % ... + + ' + - pattern: '"...".format(...) + + ' + - patterns: + - pattern: $ARG + - pattern-inside: "def $F(..., $ARG, ...):\n ...\n" + pattern-sanitizers: + - pattern: xml.sax.saxutils.escape(...) + - pattern: html.escape(...) + pattern-sinks: + - patterns: + - pattern: '$CLIENT.calls.create(..., twiml=$SINK, ...) + + ' + - focus-metavariable: $SINK diff --git a/.semgrep/registry/rust-lang-security.yaml b/.semgrep/registry/rust-lang-security.yaml new file mode 100644 index 0000000..0f15f57 --- /dev/null +++ b/.semgrep/registry/rust-lang-security.yaml @@ -0,0 +1,375 @@ +# GENERATED FILE - DO NOT EDIT. +# Snapshot of Semgrep registry config(s): r/rust.lang.security +# Rules are fetched from https://semgrep.dev/c/, deduplicated by rule id, +# and sorted. Refresh with: python3 .github/scripts/semgrep_registry.py sync +# (the semgrep-registry-update workflow does this on a schedule). +rules: +- id: rust.lang.security.args-os.args-os + message: 'args_os should not be used for security operations. From the docs: "The first element is traditionally the path + of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not + be relied upon for security purposes."' + pattern: std::env::args_os() + metadata: + references: + - https://doc.rust-lang.org/stable/std/env/fn.args_os.html + technology: + - rust + category: security + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' + confidence: HIGH + likelihood: LOW + impact: LOW + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/rust.lang.security.args-os.args-os + shortlink: https://sg.run/G6k6 + semgrep.dev: + rule: + r_id: 40104 + rv_id: 946547 + rule_id: DbUeEe + version_id: d6TPjBp + url: https://semgrep.dev/playground/r/d6TPjBp/rust.lang.security.args-os.args-os + origin: community + languages: + - rust + severity: INFO +- id: rust.lang.security.args.args + message: 'args should not be used for security operations. From the docs: "The first element is traditionally the path of + the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be + relied upon for security purposes."' + pattern: std::env::args() + metadata: + references: + - https://doc.rust-lang.org/stable/std/env/fn.args.html + technology: + - rust + category: security + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' + confidence: HIGH + likelihood: LOW + impact: LOW + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/rust.lang.security.args.args + shortlink: https://sg.run/RADN + semgrep.dev: + rule: + r_id: 40105 + rv_id: 946548 + rule_id: WAU6Lk + version_id: ZRT35Ly + url: https://semgrep.dev/playground/r/ZRT35Ly/rust.lang.security.args.args + origin: community + languages: + - rust + severity: INFO +- id: rust.lang.security.current-exe.current-exe + message: 'current_exe should not be used for security operations. From the docs: "The output of this function should not + be trusted for anything that might have security implications. Basically, if users can run the executable, they can change + the output arbitrarily."' + pattern: std::env::current_exe() + metadata: + references: + - https://doc.rust-lang.org/stable/std/env/fn.current_exe.html#security + technology: + - rust + category: security + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' + confidence: HIGH + likelihood: LOW + impact: LOW + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/rust.lang.security.current-exe.current-exe + shortlink: https://sg.run/AW1B + semgrep.dev: + rule: + r_id: 40106 + rv_id: 946549 + rule_id: 0oU6nZ + version_id: nWTpz6d + url: https://semgrep.dev/playground/r/nWTpz6d/rust.lang.security.current-exe.current-exe + origin: community + languages: + - rust + severity: INFO +- id: rust.lang.security.insecure-hashes.insecure-hashes + message: Detected cryptographically insecure hashing function + pattern-either: + - pattern: md2::Md2::new(...) + - pattern: md4::Md4::new(...) + - pattern: md5::Md5::new(...) + - pattern: sha1::Sha1::new(...) + metadata: + references: + - https://github.com/RustCrypto/hashes + - https://docs.rs/md2/latest/md2/ + - https://docs.rs/md4/latest/md4/ + - https://docs.rs/md5/latest/md5/ + - https://docs.rs/sha-1/latest/sha1/ + technology: + - rust + category: security + cwe: 'CWE-328: Use of Weak Hash' + confidence: HIGH + likelihood: LOW + impact: MEDIUM + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/rust.lang.security.insecure-hashes.insecure-hashes + shortlink: https://sg.run/B09R + semgrep.dev: + rule: + r_id: 40107 + rv_id: 946550 + rule_id: KxUOxA + version_id: ExTg29b + url: https://semgrep.dev/playground/r/ExTg29b/rust.lang.security.insecure-hashes.insecure-hashes + origin: community + languages: + - rust + severity: WARNING +- id: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid + message: Dangerously accepting invalid TLS information + pattern-either: + - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_hostnames(true) + - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_certs(true) + metadata: + references: + - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames + - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs + technology: + - reqwest + category: security + cwe: 'CWE-295: Improper Certificate Validation' + confidence: HIGH + likelihood: LOW + impact: MEDIUM + subcategory: vuln + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid + shortlink: https://sg.run/DqrG + semgrep.dev: + rule: + r_id: 40108 + rv_id: 946551 + rule_id: qNUKDg + version_id: 7ZTrQLJ + url: https://semgrep.dev/playground/r/7ZTrQLJ/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid + origin: community + languages: + - rust + severity: WARNING +- id: rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive + message: Set sensitive flag on security headers with 'set_sensitive' to treat data with special care + patterns: + - pattern: 'let mut $HEADERS = header::HeaderMap::new(); + + ... + + let $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) ...>; + + ... + + $HEADERS.insert($HEADER, $HEADER_VALUE); + + ' + - pattern-not: 'let mut $HEADERS = header::HeaderMap::new(); + + ... + + let $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) ...>; + + ... + + $HEADER_VALUE.set_sensitive(true); + + ... + + $HEADERS.insert($HEADER, $HEADER_VALUE); + + ' + - metavariable-pattern: + metavariable: $FROM_FUNC + pattern-either: + - pattern: from_static + - pattern: from_str + - pattern: from_name + - pattern: from_bytes + - pattern: from_maybe_shared + - metavariable-pattern: + metavariable: $HEADER + pattern-either: + - pattern: header::AUTHORIZATION + - pattern: '"Authorization"' + metadata: + references: + - https://docs.rs/reqwest/latest/reqwest/header/struct.HeaderValue.html#method.set_sensitive + technology: + - reqwest + category: security + cwe: 'CWE-921: Storage of Sensitive Data in a Mechanism without Access Control' + confidence: MEDIUM + likelihood: LOW + impact: LOW + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive + shortlink: https://sg.run/WKlE + semgrep.dev: + rule: + r_id: 40109 + rv_id: 946552 + rule_id: lBUNEw + version_id: LjTXy1d + url: https://semgrep.dev/playground/r/LjTXy1d/rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive + origin: community + languages: + - rust + severity: INFO +- id: rust.lang.security.rustls-dangerous.rustls-dangerous + message: Dangerous client config used, ensure SSL verification + pattern-either: + - pattern: rustls::client::DangerousClientConfig + - pattern: $CLIENT.dangerous().set_certificate_verifier(...) + - pattern: 'let $CLIENT = rustls::client::ClientConfig::dangerous(...); + + ... + + $CLIENT.set_certificate_verifier(...); + + ' + metadata: + references: + - https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html + - https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous + technology: + - rustls + category: security + cwe: 'CWE-295: Improper Certificate Validation' + confidence: HIGH + likelihood: LOW + impact: MEDIUM + subcategory: vuln + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous + shortlink: https://sg.run/01Rw + semgrep.dev: + rule: + r_id: 40110 + rv_id: 946553 + rule_id: YGU8LK + version_id: 8KTKjdO + url: https://semgrep.dev/playground/r/8KTKjdO/rust.lang.security.rustls-dangerous.rustls-dangerous + origin: community + languages: + - rust + severity: WARNING +- id: rust.lang.security.ssl-verify-none.ssl-verify-none + message: SSL verification disabled, this allows for MitM attacks + pattern: $BUILDER.set_verify(openssl::ssl::SSL_VERIFY_NONE) + metadata: + references: + - https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify + technology: + - openssl + category: security + cwe: 'CWE-295: Improper Certificate Validation' + confidence: HIGH + likelihood: LOW + impact: MEDIUM + subcategory: vuln + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none + shortlink: https://sg.run/K2Pn + semgrep.dev: + rule: + r_id: 40111 + rv_id: 946554 + rule_id: 6JU0Bl + version_id: gETe1bo + url: https://semgrep.dev/playground/r/gETe1bo/rust.lang.security.ssl-verify-none.ssl-verify-none + origin: community + languages: + - rust + severity: WARNING +- id: rust.lang.security.temp-dir.temp-dir + message: 'temp_dir should not be used for security operations. From the docs: ''The temporary directory may be shared among + users, or between processes with different privileges; thus, the creation of any files or directories in the temporary + directory must use a secure method to create a uniquely named file. Creating a file or directory with a fixed or predictable + name may result in “insecure temporary file” security vulnerabilities.''' + pattern: std::env::temp_dir() + metadata: + references: + - https://doc.rust-lang.org/stable/std/env/fn.temp_dir.html + technology: + - rust + category: security + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' + confidence: HIGH + likelihood: LOW + impact: LOW + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/rust.lang.security.temp-dir.temp-dir + shortlink: https://sg.run/qzEO + semgrep.dev: + rule: + r_id: 40112 + rv_id: 946555 + rule_id: oqU5AO + version_id: QkTZz4Y + url: https://semgrep.dev/playground/r/QkTZz4Y/rust.lang.security.temp-dir.temp-dir + origin: community + languages: + - rust + severity: INFO +- id: rust.lang.security.unsafe-usage.unsafe-usage + message: Detected 'unsafe' usage, please audit for secure usage + pattern: unsafe { ... } + metadata: + references: + - https://doc.rust-lang.org/std/keyword.unsafe.html + technology: + - rust + category: security + cwe: 'CWE-242: Use of Inherently Dangerous Function' + confidence: HIGH + likelihood: LOW + impact: LOW + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Dangerous Method or Function + source: https://semgrep.dev/r/rust.lang.security.unsafe-usage.unsafe-usage + shortlink: https://sg.run/lqgo + semgrep.dev: + rule: + r_id: 40113 + rv_id: 946556 + rule_id: zdUezd + version_id: 3ZTOPoZ + url: https://semgrep.dev/playground/r/3ZTOPoZ/rust.lang.security.unsafe-usage.unsafe-usage + origin: community + languages: + - rust + severity: INFO diff --git a/.semgrep/registry/rust.yaml b/.semgrep/registry/rust.yaml new file mode 100644 index 0000000..38023b6 --- /dev/null +++ b/.semgrep/registry/rust.yaml @@ -0,0 +1,441 @@ +# GENERATED FILE - DO NOT EDIT. +# Snapshot of Semgrep registry config(s): p/rust +# Rules are fetched from https://semgrep.dev/c/, deduplicated by rule id, +# and sorted. Refresh with: python3 .github/scripts/semgrep_registry.py sync +# (the semgrep-registry-update workflow does this on a schedule). +rules: +- id: generic.unicode.security.bidi.contains-bidirectional-characters + patterns: + - pattern-either: + - pattern-regex: ‪ + - pattern-regex: ‫ + - pattern-regex: ‭ + - pattern-regex: ‮ + - pattern-regex: ⁦ + - pattern-regex: ⁧ + - pattern-regex: ⁨ + - pattern-regex: ‬ + - pattern-regex: ⁩ + message: This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages + such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different + from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this + code in an editor that can reveal hidden Unicode characters. + metadata: + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + category: security + technology: + - unicode + references: + - https://trojansource.codes/ + confidence: LOW + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + cwe2022-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters + shortlink: https://sg.run/nK4r + semgrep.dev: + rule: + r_id: 14880 + rv_id: 1262904 + rule_id: d8UeX4 + version_id: JdTzxzn + url: https://semgrep.dev/playground/r/JdTzxzn/generic.unicode.security.bidi.contains-bidirectional-characters + origin: community + languages: + - bash + - c + - csharp + - go + - java + - javascript + - json + - kotlin + - lua + - ocaml + - php + - python + - ruby + - rust + - scala + - sh + - typescript + - yaml + severity: WARNING +- id: rust.lang.security.args-os.args-os + message: 'args_os should not be used for security operations. From the docs: "The first element is traditionally the path + of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not + be relied upon for security purposes."' + pattern: std::env::args_os() + metadata: + references: + - https://doc.rust-lang.org/stable/std/env/fn.args_os.html + technology: + - rust + category: security + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' + confidence: HIGH + likelihood: LOW + impact: LOW + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/rust.lang.security.args-os.args-os + shortlink: https://sg.run/G6k6 + semgrep.dev: + rule: + r_id: 40104 + rv_id: 946547 + rule_id: DbUeEe + version_id: d6TPjBp + url: https://semgrep.dev/playground/r/d6TPjBp/rust.lang.security.args-os.args-os + origin: community + languages: + - rust + severity: INFO +- id: rust.lang.security.args.args + message: 'args should not be used for security operations. From the docs: "The first element is traditionally the path of + the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be + relied upon for security purposes."' + pattern: std::env::args() + metadata: + references: + - https://doc.rust-lang.org/stable/std/env/fn.args.html + technology: + - rust + category: security + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' + confidence: HIGH + likelihood: LOW + impact: LOW + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/rust.lang.security.args.args + shortlink: https://sg.run/RADN + semgrep.dev: + rule: + r_id: 40105 + rv_id: 946548 + rule_id: WAU6Lk + version_id: ZRT35Ly + url: https://semgrep.dev/playground/r/ZRT35Ly/rust.lang.security.args.args + origin: community + languages: + - rust + severity: INFO +- id: rust.lang.security.current-exe.current-exe + message: 'current_exe should not be used for security operations. From the docs: "The output of this function should not + be trusted for anything that might have security implications. Basically, if users can run the executable, they can change + the output arbitrarily."' + pattern: std::env::current_exe() + metadata: + references: + - https://doc.rust-lang.org/stable/std/env/fn.current_exe.html#security + technology: + - rust + category: security + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' + confidence: HIGH + likelihood: LOW + impact: LOW + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/rust.lang.security.current-exe.current-exe + shortlink: https://sg.run/AW1B + semgrep.dev: + rule: + r_id: 40106 + rv_id: 946549 + rule_id: 0oU6nZ + version_id: nWTpz6d + url: https://semgrep.dev/playground/r/nWTpz6d/rust.lang.security.current-exe.current-exe + origin: community + languages: + - rust + severity: INFO +- id: rust.lang.security.insecure-hashes.insecure-hashes + message: Detected cryptographically insecure hashing function + pattern-either: + - pattern: md2::Md2::new(...) + - pattern: md4::Md4::new(...) + - pattern: md5::Md5::new(...) + - pattern: sha1::Sha1::new(...) + metadata: + references: + - https://github.com/RustCrypto/hashes + - https://docs.rs/md2/latest/md2/ + - https://docs.rs/md4/latest/md4/ + - https://docs.rs/md5/latest/md5/ + - https://docs.rs/sha-1/latest/sha1/ + technology: + - rust + category: security + cwe: 'CWE-328: Use of Weak Hash' + confidence: HIGH + likelihood: LOW + impact: MEDIUM + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Insecure Hashing Algorithm + source: https://semgrep.dev/r/rust.lang.security.insecure-hashes.insecure-hashes + shortlink: https://sg.run/B09R + semgrep.dev: + rule: + r_id: 40107 + rv_id: 946550 + rule_id: KxUOxA + version_id: ExTg29b + url: https://semgrep.dev/playground/r/ExTg29b/rust.lang.security.insecure-hashes.insecure-hashes + origin: community + languages: + - rust + severity: WARNING +- id: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid + message: Dangerously accepting invalid TLS information + pattern-either: + - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_hostnames(true) + - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_certs(true) + metadata: + references: + - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames + - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs + technology: + - reqwest + category: security + cwe: 'CWE-295: Improper Certificate Validation' + confidence: HIGH + likelihood: LOW + impact: MEDIUM + subcategory: vuln + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid + shortlink: https://sg.run/DqrG + semgrep.dev: + rule: + r_id: 40108 + rv_id: 946551 + rule_id: qNUKDg + version_id: 7ZTrQLJ + url: https://semgrep.dev/playground/r/7ZTrQLJ/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid + origin: community + languages: + - rust + severity: WARNING +- id: rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive + message: Set sensitive flag on security headers with 'set_sensitive' to treat data with special care + patterns: + - pattern: 'let mut $HEADERS = header::HeaderMap::new(); + + ... + + let $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) ...>; + + ... + + $HEADERS.insert($HEADER, $HEADER_VALUE); + + ' + - pattern-not: 'let mut $HEADERS = header::HeaderMap::new(); + + ... + + let $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) ...>; + + ... + + $HEADER_VALUE.set_sensitive(true); + + ... + + $HEADERS.insert($HEADER, $HEADER_VALUE); + + ' + - metavariable-pattern: + metavariable: $FROM_FUNC + pattern-either: + - pattern: from_static + - pattern: from_str + - pattern: from_name + - pattern: from_bytes + - pattern: from_maybe_shared + - metavariable-pattern: + metavariable: $HEADER + pattern-either: + - pattern: header::AUTHORIZATION + - pattern: '"Authorization"' + metadata: + references: + - https://docs.rs/reqwest/latest/reqwest/header/struct.HeaderValue.html#method.set_sensitive + technology: + - reqwest + category: security + cwe: 'CWE-921: Storage of Sensitive Data in a Mechanism without Access Control' + confidence: MEDIUM + likelihood: LOW + impact: LOW + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive + shortlink: https://sg.run/WKlE + semgrep.dev: + rule: + r_id: 40109 + rv_id: 946552 + rule_id: lBUNEw + version_id: LjTXy1d + url: https://semgrep.dev/playground/r/LjTXy1d/rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive + origin: community + languages: + - rust + severity: INFO +- id: rust.lang.security.rustls-dangerous.rustls-dangerous + message: Dangerous client config used, ensure SSL verification + pattern-either: + - pattern: rustls::client::DangerousClientConfig + - pattern: $CLIENT.dangerous().set_certificate_verifier(...) + - pattern: 'let $CLIENT = rustls::client::ClientConfig::dangerous(...); + + ... + + $CLIENT.set_certificate_verifier(...); + + ' + metadata: + references: + - https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html + - https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous + technology: + - rustls + category: security + cwe: 'CWE-295: Improper Certificate Validation' + confidence: HIGH + likelihood: LOW + impact: MEDIUM + subcategory: vuln + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous + shortlink: https://sg.run/01Rw + semgrep.dev: + rule: + r_id: 40110 + rv_id: 946553 + rule_id: YGU8LK + version_id: 8KTKjdO + url: https://semgrep.dev/playground/r/8KTKjdO/rust.lang.security.rustls-dangerous.rustls-dangerous + origin: community + languages: + - rust + severity: WARNING +- id: rust.lang.security.ssl-verify-none.ssl-verify-none + message: SSL verification disabled, this allows for MitM attacks + pattern: $BUILDER.set_verify(openssl::ssl::SSL_VERIFY_NONE) + metadata: + references: + - https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify + technology: + - openssl + category: security + cwe: 'CWE-295: Improper Certificate Validation' + confidence: HIGH + likelihood: LOW + impact: MEDIUM + subcategory: vuln + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authentication + source: https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none + shortlink: https://sg.run/K2Pn + semgrep.dev: + rule: + r_id: 40111 + rv_id: 946554 + rule_id: 6JU0Bl + version_id: gETe1bo + url: https://semgrep.dev/playground/r/gETe1bo/rust.lang.security.ssl-verify-none.ssl-verify-none + origin: community + languages: + - rust + severity: WARNING +- id: rust.lang.security.temp-dir.temp-dir + message: 'temp_dir should not be used for security operations. From the docs: ''The temporary directory may be shared among + users, or between processes with different privileges; thus, the creation of any files or directories in the temporary + directory must use a secure method to create a uniquely named file. Creating a file or directory with a fixed or predictable + name may result in “insecure temporary file” security vulnerabilities.''' + pattern: std::env::temp_dir() + metadata: + references: + - https://doc.rust-lang.org/stable/std/env/fn.temp_dir.html + technology: + - rust + category: security + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' + confidence: HIGH + likelihood: LOW + impact: LOW + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Other + source: https://semgrep.dev/r/rust.lang.security.temp-dir.temp-dir + shortlink: https://sg.run/qzEO + semgrep.dev: + rule: + r_id: 40112 + rv_id: 946555 + rule_id: oqU5AO + version_id: QkTZz4Y + url: https://semgrep.dev/playground/r/QkTZz4Y/rust.lang.security.temp-dir.temp-dir + origin: community + languages: + - rust + severity: INFO +- id: rust.lang.security.unsafe-usage.unsafe-usage + message: Detected 'unsafe' usage, please audit for secure usage + pattern: unsafe { ... } + metadata: + references: + - https://doc.rust-lang.org/std/keyword.unsafe.html + technology: + - rust + category: security + cwe: 'CWE-242: Use of Inherently Dangerous Function' + confidence: HIGH + likelihood: LOW + impact: LOW + subcategory: audit + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Dangerous Method or Function + source: https://semgrep.dev/r/rust.lang.security.unsafe-usage.unsafe-usage + shortlink: https://sg.run/lqgo + semgrep.dev: + rule: + r_id: 40113 + rv_id: 946556 + rule_id: zdUezd + version_id: 3ZTOPoZ + url: https://semgrep.dev/playground/r/3ZTOPoZ/rust.lang.security.unsafe-usage.unsafe-usage + origin: community + languages: + - rust + severity: INFO diff --git a/.semgrep/registry/security-audit.yaml b/.semgrep/registry/security-audit.yaml new file mode 100644 index 0000000..c3c2c01 --- /dev/null +++ b/.semgrep/registry/security-audit.yaml @@ -0,0 +1,14189 @@ +# GENERATED FILE - DO NOT EDIT. +# Snapshot of Semgrep registry config(s): p/security-audit +# Rules are fetched from https://semgrep.dev/c/, deduplicated by rule id, +# and sorted. Refresh with: python3 .github/scripts/semgrep_registry.py sync +# (the semgrep-registry-update workflow does this on a schedule). +rules: +- id: c.lang.security.double-free.double-free + patterns: + - pattern-not: 'free($VAR); + + ... + + $VAR = NULL; + + ... + + free($VAR); + + ' + - pattern-not: 'free($VAR); + + ... + + $VAR = malloc(...); + + ... + + free($VAR); + + ' + - pattern-inside: 'free($VAR); + + ... + + $FREE($VAR); + + ' + - metavariable-pattern: + metavariable: $FREE + pattern: free + - focus-metavariable: $FREE + message: Variable '$VAR' was freed twice. This can lead to undefined behavior. + metadata: + cwe: + - 'CWE-415: Double Free' + owasp: + - A03:2021 - Injection + - A01:2017 - Injection + - A05:2025 - Injection + references: + - https://cwe.mitre.org/data/definitions/415.html + - https://owasp.org/www-community/vulnerabilities/Doubly_freeing_memory + category: security + technology: + - c + confidence: LOW + subcategory: + - vuln + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Memory Issues + source: https://semgrep.dev/r/c.lang.security.double-free.double-free + shortlink: https://sg.run/eLl0 + semgrep.dev: + rule: + r_id: 8832 + rv_id: 1262604 + rule_id: JDUyw8 + version_id: RGT0L3W + url: https://semgrep.dev/playground/r/RGT0L3W/c.lang.security.double-free.double-free + origin: community + languages: + - c + severity: ERROR +- id: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn + pattern: gets(...) + message: Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' + or 'gets_s()' instead. + metadata: + cwe: + - 'CWE-676: Use of Potentially Dangerous Function' + references: + - https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s + category: security + technology: + - c + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Dangerous Method or Function + source: https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn + shortlink: https://sg.run/dKqX + semgrep.dev: + rule: + r_id: 8834 + rv_id: 945170 + rule_id: GdU7OE + version_id: YDTvRlQ + url: https://semgrep.dev/playground/r/YDTvRlQ/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn + origin: community + languages: + - c + severity: ERROR +- id: c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn + message: Avoid using user-controlled format strings passed into 'sprintf', 'printf' and 'vsprintf'. These functions put + you at risk of buffer overflow vulnerabilities through the use of format string exploits. Instead, use 'snprintf' and + 'vsnprintf'. + metadata: + cwe: + - 'CWE-134: Use of Externally-Controlled Format String' + references: + - https://doc.castsoftware.com/display/SBX/Never+use+sprintf%28%29+or+vsprintf%28%29+functions + - https://www.cvedetails.com/cwe-details/134/Uncontrolled-Format-String.html + category: security + technology: + - c + confidence: LOW + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Validation + source: https://semgrep.dev/r/c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn + shortlink: https://sg.run/ZvJx + semgrep.dev: + rule: + r_id: 8835 + rv_id: 945172 + rule_id: ReUgWx + version_id: o5TZeB2 + url: https://semgrep.dev/playground/r/o5TZeB2/c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn + origin: community + languages: + - c + severity: WARNING + patterns: + - pattern-either: + - pattern: '$FUNC($BUFFER, argv[$NUM], ...); + + ... + + vsprintf(..., $BUFFER, ...); + + ' + - pattern: vsprintf(..., argv[$NUM], ...) + - pattern: '$FUNC($BUFFER, argv[$NUM], ...); + + ... + + sprintf(..., $BUFFER, ...); + + ' + - pattern: sprintf(...,argv[$NUM],...) + - pattern: '$FUNC($BUFFER, argv[$NUM], ...); + + ... + + printf(..., $BUFFER, ...); + + ' + - pattern: printf(...,argv[$NUM],...) + - metavariable-comparison: + metavariable: $NUM + comparison: int($NUM) > 0 +- id: c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn + pattern: scanf(...) + message: Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to + buffer overflows. Use 'fgets()' instead for reading input. + metadata: + cwe: + - 'CWE-676: Use of Potentially Dangerous Function' + references: + - http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html + category: security + technology: + - c + confidence: LOW + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Dangerous Method or Function + source: https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn + shortlink: https://sg.run/nd1g + semgrep.dev: + rule: + r_id: 8836 + rv_id: 945173 + rule_id: AbUzPd + version_id: zyTlkWW + url: https://semgrep.dev/playground/r/zyTlkWW/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn + origin: community + languages: + - c + severity: WARNING +- id: c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn + pattern-either: + - pattern: strcat(...) + - pattern: strncat(...) + message: Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can lead + to buffer overflow vulns. Fix this by using strcat_s instead. + metadata: + cwe: + - 'CWE-676: Use of Potentially Dangerous Function' + references: + - https://nvd.nist.gov/vuln/detail/CVE-2019-12553 + - https://techblog.mediaservice.net/2020/04/cve-2020-2851-stack-based-buffer-overflow-in-cde-libdtsvc/ + category: security + technology: + - c + confidence: LOW + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Dangerous Method or Function + source: https://semgrep.dev/r/c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn + shortlink: https://sg.run/EkRP + semgrep.dev: + rule: + r_id: 8837 + rv_id: 945174 + rule_id: BYUNjA + version_id: pZTNOXb + url: https://semgrep.dev/playground/r/pZTNOXb/c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn + origin: community + languages: + - c + severity: WARNING +- id: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn + pattern-either: + - pattern: strcpy(...) + - pattern: strncpy(...) + message: Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the + size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, + which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s + instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available). + metadata: + cwe: + - 'CWE-676: Use of Potentially Dangerous Function' + references: + - https://cwe.mitre.org/data/definitions/676 + - https://nvd.nist.gov/vuln/detail/CVE-2019-11365 + category: security + technology: + - c + confidence: LOW + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Dangerous Method or Function + source: https://semgrep.dev/r/c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn + shortlink: https://sg.run/7oNk + semgrep.dev: + rule: + r_id: 8838 + rv_id: 945175 + rule_id: DbUpo5 + version_id: 2KTYb7Y + url: https://semgrep.dev/playground/r/2KTYb7Y/c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn + origin: community + languages: + - c + severity: WARNING +- id: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn + pattern: strtok(...) + message: Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter + character. Use 'strtok_r()' instead. + metadata: + cwe: + - 'CWE-676: Use of Potentially Dangerous Function' + references: + - https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged + - https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS + - https://stackoverflow.com/a/40335556 + category: security + technology: + - c + confidence: LOW + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Dangerous Method or Function + source: https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn + shortlink: https://sg.run/LwqG + semgrep.dev: + rule: + r_id: 8839 + rv_id: 1028278 + rule_id: WAUo5v + version_id: qkTx1oq + url: https://semgrep.dev/playground/r/qkTx1oq/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn + origin: community + languages: + - c + severity: WARNING +- id: c.lang.security.random-fd-exhaustion.random-fd-exhaustion + pattern-either: + - patterns: + - pattern: '$FD = open("/dev/urandom", ...); + + ... + + read($FD, ...); + + ' + - pattern-not: '$FD = open("/dev/urandom", ...); + + ... + + $BYTES_READ = read($FD, ...); + + ' + - patterns: + - pattern: '$FD = open("/dev/random", ...); + + ... + + read($FD, ...); + + ' + - pattern-not: '$FD = open("/dev/random", ...); + + ... + + $BYTES_READ = read($FD, ...); + + ' + message: Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' + function. + metadata: + cwe: + - 'CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling' + references: + - https://lwn.net/Articles/606141/ + category: security + technology: + - c + confidence: MEDIUM + subcategory: + - audit + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Denial-of-Service (DoS) + source: https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion + shortlink: https://sg.run/8yNj + semgrep.dev: + rule: + r_id: 8840 + rv_id: 945177 + rule_id: 0oU5k4 + version_id: jQTzvry + url: https://semgrep.dev/playground/r/jQTzvry/c.lang.security.random-fd-exhaustion.random-fd-exhaustion + origin: community + languages: + - c + severity: WARNING +- id: c.lang.security.use-after-free.use-after-free + patterns: + - pattern-either: + - pattern: $VAR->$ACCESSOR + - pattern: (*$VAR).$ACCESSOR + - pattern: $VAR[$NUM] + - pattern-inside: free($VAR); ... + - pattern-not-inside: $VAR = NULL; ... + - pattern-not-inside: free($VAR); ... $VAR = malloc(...); ... + message: Variable '$VAR' was used after being freed. This can lead to undefined behavior. + metadata: + cwe: + - 'CWE-416: Use After Free' + references: + - https://cwe.mitre.org/data/definitions/416.html + - https://ctf-wiki.github.io/ctf-wiki/pwn/linux/glibc-heap/use_after_free/ + category: security + technology: + - c + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Memory Issues + source: https://semgrep.dev/r/c.lang.security.use-after-free.use-after-free + shortlink: https://sg.run/gL6e + semgrep.dev: + rule: + r_id: 8841 + rv_id: 945178 + rule_id: KxUb9l + version_id: 1QToKPy + url: https://semgrep.dev/playground/r/1QToKPy/c.lang.security.use-after-free.use-after-free + origin: community + languages: + - c + severity: WARNING +- id: dockerfile.security.last-user-is-root.last-user-is-root + patterns: + - pattern: USER root + - pattern-not-inside: + patterns: + - pattern: 'USER root + + ... + + USER $X + + ' + - metavariable-pattern: + metavariable: $X + patterns: + - pattern-not: root + message: The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the + container they will have root access. Switch back to another user after running commands as 'root'. + severity: ERROR + languages: + - dockerfile + metadata: + cwe: + - 'CWE-269: Improper Privilege Management' + source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3002 + references: + - https://github.com/hadolint/hadolint/wiki/DL3002 + category: security + technology: + - dockerfile + confidence: MEDIUM + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + subcategory: + - audit + likelihood: MEDIUM + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Improper Authorization + source: https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root + shortlink: https://sg.run/5Z43 + semgrep.dev: + rule: + r_id: 20147 + rv_id: 1262658 + rule_id: ReU2n5 + version_id: 6xT29Eg + url: https://semgrep.dev/playground/r/6xT29Eg/dockerfile.security.last-user-is-root.last-user-is-root + origin: community +- id: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var + message: 'Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript + handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}".' + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss + category: security + technology: + - html-templates + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var + shortlink: https://sg.run/weNX + semgrep.dev: + rule: + r_id: 9029 + rv_id: 1501833 + rule_id: gxU1jy + version_id: 1QT3R1A + url: https://semgrep.dev/playground/r/1QT3R1A/generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var + origin: community + languages: + - generic + paths: + include: + - '*.html' + - '*.mustache' + - '*.hbs' + - '*.twig' + severity: WARNING + patterns: + - pattern-inside: <$TAG ...> + - pattern-not-inside: ="..." + - pattern-not-inside: ="{{ ... }}" + - pattern-not-inside: ='...' + - pattern-not-inside: ='{{ ... }}' + - pattern: '{{ ... }}' + fix-regex: + regex: '{{(.*?)}}' + replacement: '"{{\1}}"' +- id: generic.html-templates.security.var-in-href.var-in-href + message: Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to + input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to + safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding + library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting + the Content Security Policy (CSP) header. + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI + - https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#url + - https://github.com/pugjs/pug/issues/2952 + - https://content-security-policy.com/ + category: security + technology: + - html-templates + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/generic.html-templates.security.var-in-href.var-in-href + shortlink: https://sg.run/x1kP + semgrep.dev: + rule: + r_id: 9030 + rv_id: 1501834 + rule_id: QrUzD1 + version_id: 9lTqGx9 + url: https://semgrep.dev/playground/r/9lTqGx9/generic.html-templates.security.var-in-href.var-in-href + origin: community + languages: + - generic + paths: + include: + - '*.html' + - '*.mustache' + - '*.hbs' + - '*.twig' + severity: WARNING + patterns: + - pattern-inside: + - pattern-either: + - pattern: href = {{ ... }} + - pattern: href = "{{ ... }}" + - pattern: href = '{{ ... }}' + - pattern-not-inside: href = {{ url_for(...) ... }} + - pattern-not-inside: href = "{{ url_for(...) ... }}" + - pattern-not-inside: href = '{{ url_for(...) ... }}' + - pattern-not-inside: href = "/{{ ... }}" + - pattern-not-inside: href = '/{{ ... }}' +- id: generic.html-templates.security.var-in-script-tag.var-in-script-tag + message: Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping + does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on + the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific + encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template + tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`). + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://adamj.eu/tech/2020/02/18/safely-including-data-for-javascript-in-a-django-template/?utm_campaign=Django%2BNewsletter&utm_medium=rss&utm_source=Django_Newsletter_12A + - https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough + - https://github.com/ESAPI/owasp-esapi-js + category: security + technology: + - html-templates + confidence: LOW + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/generic.html-templates.security.var-in-script-tag.var-in-script-tag + shortlink: https://sg.run/eLWE + semgrep.dev: + rule: + r_id: 9032 + rv_id: 1501836 + rule_id: 4bUkpl + version_id: rxTlpQE + url: https://semgrep.dev/playground/r/rxTlpQE/generic.html-templates.security.var-in-script-tag.var-in-script-tag + origin: community + languages: + - generic + paths: + include: + - '*.mustache' + - '*.hbs' + - '*.html' + - '*.twig' + severity: WARNING + patterns: + - pattern-inside: + - pattern-not-inside: ", $X.CASE_INSENSITIVE); + + $V = $P.matcher(...).replaceAll("");' +- id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal + metadata: + cwe: + - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN + references: + - https://www.owasp.org/index.php/Path_Traversal + category: security + technology: + - java + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Path Traversal + source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal + shortlink: https://sg.run/oxXN + semgrep.dev: + rule: + r_id: 9160 + rv_id: 1263064 + rule_id: NbUk7X + version_id: zyTb2rq + url: https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal + origin: community + message: Detected a potential path traversal. A malicious actor could control the location of this file, to include going + backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. + You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve + the file name from the path. + mode: taint + pattern-sources: + - patterns: + - pattern-either: + - pattern: '(HttpServletRequest $REQ) + + ' + - patterns: + - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie\ + \ $COOKIE: $COOKIES) {\n ...\n}\n" + - pattern: '$COOKIE.getValue(...) + + ' + - patterns: + - pattern-inside: '$TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...); + + ... + + ' + - pattern: '$PARAM = $VALS[$INDEX]; + + ' + pattern-sanitizers: + - pattern: org.apache.commons.io.FilenameUtils.getName(...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: '(java.io.File $FILE) = ... + + ' + - pattern: '(java.io.FileOutputStream $FOS) = ... + + ' + - pattern: 'new java.io.FileInputStream(...) + + ' + severity: ERROR + languages: + - java +- id: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss + message: 'Cross-site scripting detected in HttpServletResponse writer with variable ''$VAR''. User input was detected going + directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: + ''Encode.forHtml($VAR)''.' + metadata: + cwe: + - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET + category: security + technology: + - java + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site-Scripting (XSS) + source: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss + shortlink: https://sg.run/pxjN + semgrep.dev: + rule: + r_id: 9162 + rv_id: 1263066 + rule_id: wdUJOk + version_id: 2KTv2EG + url: https://semgrep.dev/playground/r/2KTv2EG/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss + origin: community + severity: ERROR + patterns: + - pattern-inside: $TYPE $FUNC(..., HttpServletResponse $RESP, ...) { ... } + - pattern-inside: $VAR = $REQ.getParameter(...); ... + - pattern-either: + - pattern: $RESP.getWriter(...).write(..., $VAR, ...); + - pattern: '$WRITER = $RESP.getWriter(...); + + ... + + $WRITER.write(..., $VAR, ...); + + ' + languages: + - java +- id: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled + severity: ERROR + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://semgrep.dev/blog/2022/xml-security-in-java + - https://semgrep.dev/docs/cheat-sheets/java-xxe/ + - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf + category: security + technology: + - java + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + confidence: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled + shortlink: https://sg.run/2x75 + semgrep.dev: + rule: + r_id: 9163 + rv_id: 1263068 + rule_id: x8Unkq + version_id: jQTn5Jv + url: https://semgrep.dev/playground/r/jQTn5Jv/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled + origin: community + message: XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. + Disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" to false. + patterns: + - pattern-either: + - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities", + true); + - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, + true); + - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD, true); + - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities", + Boolean.TRUE); + - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, + Boolean.TRUE); + - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD, Boolean.TRUE); + languages: + - java +- id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe + severity: WARNING + metadata: + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.2 Insecue XML Deserialization + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + version: '4' + references: + - https://semgrep.dev/blog/2022/xml-security-in-java + - https://semgrep.dev/docs/cheat-sheets/java-xxe/ + - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf + - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser + category: security + technology: + - java + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: LOW + impact: HIGH + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - XML Injection + source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe + shortlink: https://sg.run/XBwA + semgrep.dev: + rule: + r_id: 9164 + rv_id: 1263069 + rule_id: OrU35O + version_id: 1QTypQZ + url: https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe + origin: community + message: XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external + entity vulnerabilities. Explicitly disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" + to false. + patterns: + - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(\"javax.xml.stream.isSupportingExternalEntities\"\ + , false);\n ...\n}\n" + - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES,\ + \ false);\n ...\n}\n" + - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(\"javax.xml.stream.isSupportingExternalEntities\"\ + , Boolean.FALSE);\n ...\n}\n" + - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES,\ + \ Boolean.FALSE);\n ...\n}\n" + - pattern-either: + - pattern: javax.xml.stream.XMLInputFactory.newFactory(...) + - pattern: new XMLInputFactory(...) + languages: + - java +- id: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization + severity: ERROR + metadata: + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + references: + - https://frohoff.github.io/appseccali-marshalling-pickles/ + - https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi + - https://youtu.be/t_aw1mDNhzI + - https://github.com/qtc-de/remote-method-guesser + - https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331 + category: security + technology: + - rmi + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + confidence: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization + shortlink: https://sg.run/zvnl + semgrep.dev: + rule: + r_id: 9217 + rv_id: 1263072 + rule_id: NbUkw5 + version_id: rxTAKN2 + url: https://semgrep.dev/playground/r/rxTAKN2/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization + origin: community + message: Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This + object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID + to look up your object, or consider alternative serialization schemes such as JSON. + languages: + - java + patterns: + - pattern: "interface $INTERFACE extends Remote {\n $RETURNTYPE $METHOD($PARAMTYPE $PARAM) throws RemoteException;\n}\n" + - metavariable-pattern: + metavariable: $PARAMTYPE + language: generic + patterns: + - pattern-not: String + - pattern-not: java.lang.String + - pattern-not: boolean + - pattern-not: Boolean + - pattern-not: java.lang.Boolean + - pattern-not: byte + - pattern-not: Byte + - pattern-not: java.lang.Byte + - pattern-not: char + - pattern-not: Character + - pattern-not: java.lang.Character + - pattern-not: double + - pattern-not: Double + - pattern-not: java.lang.Double + - pattern-not: float + - pattern-not: Float + - pattern-not: java.lang.Float + - pattern-not: int + - pattern-not: Integer + - pattern-not: java.lang.Integer + - pattern-not: long + - pattern-not: Long + - pattern-not: java.lang.Long + - pattern-not: short + - pattern-not: Short + - pattern-not: java.lang.Short +- id: java.spring.security.audit.spel-injection.spel-injection + message: A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that + unfiltered values fall into this risky code evaluation. + metadata: + cwe: + - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPEL_INJECTION + category: security + technology: + - spring + references: + - https://owasp.org/Top10/A03_2021-Injection + cwe2022-top25: true + subcategory: + - audit + likelihood: LOW + impact: HIGH + confidence: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Code Injection + source: https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection + shortlink: https://sg.run/XBp4 + semgrep.dev: + rule: + r_id: 9220 + rv_id: 1263075 + rule_id: x8Un7b + version_id: kbTzG5Y + url: https://semgrep.dev/playground/r/kbTzG5Y/java.spring.security.audit.spel-injection.spel-injection + origin: community + severity: WARNING + languages: + - java + patterns: + - pattern-either: + - pattern-inside: "class $CLASS {\n ...\n ExpressionParser $PARSER;\n ...\n}\n" + - pattern-inside: "class $CLASS {\n ...\n ExpressionParser $PARSER = ...;\n ...\n}\n" + - pattern-inside: "$X $METHOD(...) {\n ...\n ExpressionParser $PARSER = ...;\n ...\n}\n" + - pattern-inside: "class $CLASS {\n ...\n SpelExpressionParser $PARSER;\n ...\n}\n" + - pattern-inside: "class $CLASS {\n ...\n SpelExpressionParser $PARSER = ...;\n ...\n}\n" + - pattern-inside: "$X $METHOD(...) {\n ...\n SpelExpressionParser $PARSER = ...;\n ...\n}\n" + - pattern-inside: "class $CLASS {\n ...\n TemplateAwareExpressionParser $PARSER;\n ...\n}\n" + - pattern-inside: "class $CLASS {\n ...\n TemplateAwareExpressionParser $PARSER = ...;\n ...\n}\n" + - pattern-inside: "$X $METHOD(...) {\n ...\n TemplateAwareExpressionParser $PARSER = ...;\n ...\n}\n" + - pattern: "$X $METHOD(...) {\n ...\n $PARSER.parseExpression(...);\n ...\n}\n" + - pattern-not: "$X $METHOD(...) {\n ...\n $PARSER.parseExpression(\"...\");\n ...\n}\n" + - pattern-not: "$X $METHOD(...) {\n ...\n String $S = \"...\";\n ...\n $PARSER.parseExpression($S);\n ...\n}\n" +- id: java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled + message: CSRF protection is disabled for this configuration. This is a security risk. + metadata: + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_PROTECTION_DISABLED + asvs: + section: V4 Access Control + control_id: 4.2.2 CSRF + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control + version: '4' + category: security + technology: + - spring + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + source: https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled + shortlink: https://sg.run/jRnl + semgrep.dev: + rule: + r_id: 9221 + rv_id: 1263080 + rule_id: OrU3gK + version_id: vdT06dL + url: https://semgrep.dev/playground/r/vdT06dL/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled + origin: community + severity: WARNING + languages: + - java + pattern: $OBJ.csrf(...).disable(...) +- id: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect + message: Application redirects a user to a destination URL specified by a user supplied parameter that is not validated. + metadata: + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT + category: security + technology: + - spring + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + subcategory: + - vuln + likelihood: MEDIUM + impact: MEDIUM + confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect + shortlink: https://sg.run/9oXz + semgrep.dev: + rule: + r_id: 9223 + rv_id: 1263083 + rule_id: v8Un7w + version_id: nWT2Lk0 + url: https://semgrep.dev/playground/r/nWT2Lk0/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect + origin: community + severity: WARNING + languages: + - java + pattern-either: + - pattern: "$X $METHOD(...,String $URL,...) {\n return \"redirect:\" + $URL;\n}\n" + - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n String $REDIR = \"redirect:\" + $URL;\n ...\n return $REDIR;\n\ + \ ...\n}\n" + - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n new ModelAndView(\"redirect:\" + $URL);\n ...\n}\n" + - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n String $REDIR = \"redirect:\" + $URL;\n ...\n new ModelAndView($REDIR);\n\ + \ ...\n}" +- id: java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping + patterns: + - pattern-inside: '@RequestMapping(...) + + $RETURNTYPE $METHOD(...) { ... } + + ' + - pattern-not-inside: '@RequestMapping(..., method = $X, ...) + + $RETURNTYPE $METHOD(...) { ... } + + ' + - pattern: 'RequestMapping + + ' + message: Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not + enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly + specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add + the 'method' field and specify the HTTP method (such as 'RequestMethod.POST'). + severity: WARNING + metadata: + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING + references: + - https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING + category: security + technology: + - spring + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + source: https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping + shortlink: https://sg.run/2xlq + semgrep.dev: + rule: + r_id: 9219 + rv_id: 1263089 + rule_id: wdUJ7q + version_id: QkTGq2l + url: https://semgrep.dev/playground/r/QkTGq2l/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping + origin: community + languages: + - java +- id: javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect + message: It looks like '$UNK' is read from user input and it is used to as a redirect. Ensure '$UNK' is not externally controlled, + otherwise this is an open redirect. + metadata: + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + cwe: + - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + asvs: + section: V5 Validation, Sanitization and Encoding + control_id: 5.5.1 Insecue Redirect + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation + version: '4' + category: security + technology: + - express + subcategory: + - audit + likelihood: LOW + impact: LOW + confidence: LOW + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Open Redirect + source: https://semgrep.dev/r/javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect + shortlink: https://sg.run/OPv2 + semgrep.dev: + rule: + r_id: 9275 + rv_id: 1263147 + rule_id: gxU12X + version_id: 3ZT4Xev + url: https://semgrep.dev/playground/r/3ZT4Xev/javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect + origin: community + languages: + - javascript + - typescript + severity: WARNING + patterns: + - pattern-either: + - pattern-inside: '$UNK = query.$B; + + ... + + ' + - pattern-inside: '$UNK = $A.query.$B; + + ... + + ' + - pattern-inside: '$UNK = req.$SOMETHING; + + ... + + ' + - pattern: $RES.redirect(..., <... $UNK ...>, ...) +- id: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection + message: Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious + attacker could tamper with the gRPC message, which could compromise the machine. + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + category: security + technology: + - grpc + references: + - https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - 'Insecure Deserialization ' + source: https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection + shortlink: https://sg.run/5QkD + semgrep.dev: + rule: + r_id: 9291 + rv_id: 1263180 + rule_id: lBU9D8 + version_id: e1TyjAl + url: https://semgrep.dev/playground/r/e1TyjAl/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection + origin: community + languages: + - javascript + - typescript + severity: ERROR + pattern-either: + - pattern: 'require(''grpc''); + + ... + + $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...); + + ' + - pattern: 'require(''grpc''); + + ... + + new $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...); + + ' + - pattern: 'require(''grpc''); + + ... + + $CREDS = <... $CREDENTIALS.createInsecure() ...>; + + ... + + $GRPC($ADDR,...,$CREDS,...);' + - pattern: 'require(''grpc''); + + ... + + $CREDS = <... $CREDENTIALS.createInsecure() ...>; + + ... + + new $GRPC($ADDR,...,$CREDS,...);' +- id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + metadata: + interfile: true + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.2 Static API keys or secret + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jose + - jwt + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret + shortlink: https://sg.run/Ro1g + semgrep.dev: + rule: + r_id: 9293 + rv_id: 1263182 + rule_id: JDUyRl + version_id: d6TyxbX + url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret + origin: community + languages: + - javascript + - typescript + severity: WARNING + patterns: + - pattern-inside: '$JOSE = require("jose"); + + ... + + ' + - pattern-either: + - pattern-inside: 'var {JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'var {JWK, JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'const {JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'const {JWK, JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'let {JWT} = $JOSE; + + ... + + ' + - pattern-inside: 'let {JWK, JWT} = $JOSE; + + ... + + ' + - pattern-either: + - pattern: 'JWT.verify($P, "...", ...); + + ' + - pattern: 'JWT.sign($P, "...", ...); + + ' + - pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...); \n" + - pattern: '$JWT.sign($P, JWK.asKey("..."), ...); + + ' + options: + symbolic_propagation: true + interfile: true +- id: javascript.jose.security.jwt-none-alg.jwt-none-alg + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has + already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do + not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.3 Insecue Stateless Session Tokens + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jose + - jwt + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg + shortlink: https://sg.run/AvRL + semgrep.dev: + rule: + r_id: 9294 + rv_id: 1263183 + rule_id: 5rUOGN + version_id: ZRTKAyb + url: https://semgrep.dev/playground/r/ZRTKAyb/javascript.jose.security.jwt-none-alg.jwt-none-alg + origin: community + languages: + - javascript + - typescript + severity: ERROR + pattern-either: + - pattern: 'var $JOSE = require("jose"); + + ... + + var { JWK, JWT } = $JOSE; + + ... + + var $T = JWT.verify($P, JWK.None,...); + + ' + - pattern: 'var $JOSE = require("jose"); + + ... + + var { JWK, JWT } = $JOSE; + + ... + + $T = JWT.verify($P, JWK.None,...); + + ' + - pattern: 'var $JOSE = require("jose"); + + ... + + var { JWK, JWT } = $JOSE; + + ... + + JWT.verify($P, JWK.None,...); + + ' +- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks + secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment + variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + metadata: + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.2 Static API keys or secret + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jwt + - javascript + - secrets + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - vuln + likelihood: HIGH + impact: MEDIUM + confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Hard-coded Secrets + source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret + shortlink: https://sg.run/4xN9 + semgrep.dev: + rule: + r_id: 9300 + rv_id: 1263189 + rule_id: WAUon7 + version_id: gETB75D + url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret + origin: community + languages: + - javascript + - typescript + severity: WARNING + mode: taint + pattern-sources: + - patterns: + - pattern: "$X = '...' \n" + - pattern: "$X = '$Y' \n" + - patterns: + - pattern-either: + - pattern-inside: '$JWT.sign($DATA,"...",...); + + ' + - pattern-inside: '$JWT.verify($DATA,"...",...); + + ' + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: '$JWT = require("jsonwebtoken") + + ... + + ' + - pattern-inside: 'import $JWT from "jsonwebtoken" + + ... + + ' + - pattern-inside: 'import * as $JWT from "jsonwebtoken" + + ... + + ' + - pattern-inside: 'import {...,$JWT,...} from "jsonwebtoken" + + ... + + ' + - pattern-either: + - pattern-inside: '$JWT.sign($DATA,$VALUE,...); + + ' + - pattern-inside: '$JWT.verify($DATA,$VALUE,...); + + ' + - focus-metavariable: $VALUE +- id: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has + already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do + not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + metadata: + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + asvs: + section: 'V3: Session Management Verification Requirements' + control_id: 3.5.3 Insecue Stateless Session Tokens + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + version: '4' + category: security + technology: + - jwt + subcategory: + - vuln + likelihood: MEDIUM + impact: HIGH + confidence: MEDIUM + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + vulnerability_class: + - Cryptographic Issues + source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg + shortlink: https://sg.run/PJXv + semgrep.dev: + rule: + r_id: 9301 + rv_id: 1263190 + rule_id: 0oU53g + version_id: QkTGqQo + url: https://semgrep.dev/playground/r/QkTGqQo/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg + origin: community + languages: + - javascript + - typescript + severity: ERROR + patterns: + - pattern-inside: '$JWT = require("jsonwebtoken"); + + ... + + ' + - pattern: $JWT.verify($P, $X, {algorithms:[...,'none',...]},...) +- id: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag + message: Cannot determine what '$UNK' is and it is used with a ' - pattern: '` ... {{ ... }} ...`' + severity: WARNING - id: go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter - message: Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents - cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. + languages: + - go + message: Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that + prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. metadata: + category: security + confidence: LOW + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' references: - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ - https://golang.org/pkg/io/#WriteString - category: security - technology: - - go - confidence: LOW - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter - shortlink: https://sg.run/gLwn semgrep.dev: rule: + origin: community r_id: 9141 - rv_id: 1262961 rule_id: DbUpEr + rv_id: 1262961 + url: + https://semgrep.dev/playground/r/6xT2983/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter version_id: 6xT2983 - url: https://semgrep.dev/playground/r/6xT2983/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter - origin: community - severity: WARNING + shortlink: https://sg.run/gLwn + source: + https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter + subcategory: + - audit + technology: + - go + vulnerability_class: + - Cross-Site-Scripting (XSS) patterns: - pattern-either: - pattern-inside: "func $HANDLER(..., $WRITER http.ResponseWriter, ...) {\n ...\n}\n" - pattern-inside: "func(..., $WRITER http.ResponseWriter, ...) {\n ...\n}\n" - pattern-not: io.WriteString($WRITER, "...") - pattern: io.WriteString($WRITER, $STRING) + severity: WARNING +- id: go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter languages: - go -- id: go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter - message: Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site - scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. + message: Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents + cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. metadata: + category: security + confidence: LOW + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' references: - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ - category: security - technology: - - go - confidence: LOW - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter - shortlink: https://sg.run/Q5BP semgrep.dev: rule: + origin: community r_id: 9142 - rv_id: 1262962 rule_id: WAUoLp + rv_id: 1262962 + url: + https://semgrep.dev/playground/r/o5TbDdq/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter version_id: o5TbDdq - url: https://semgrep.dev/playground/r/o5TbDdq/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter - origin: community - severity: WARNING + shortlink: https://sg.run/Q5BP + source: https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter + subcategory: + - audit + technology: + - go + vulnerability_class: + - Cross-Site-Scripting (XSS) patterns: - pattern-either: - pattern-inside: "func $HANDLER(..., $WRITER http.ResponseWriter, ...) {\n ...\n}\n" - pattern-inside: "func(..., $WRITER http.ResponseWriter, ...) {\n ...\n}\n" - - pattern: '$WRITER.Write(<... fmt.$PRINTF(...) ...>, ...) - - ' + - pattern: "$WRITER.Write(<... fmt.$PRINTF(...) ...>, ...)\n" + severity: WARNING +- id: go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type languages: - go -- id: go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type - message: Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar - does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach - this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'. + message: Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and + similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data + can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use + 'template.Execute()'. metadata: + category: security + confidence: LOW cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection @@ -2840,32 +2189,23 @@ rules: references: - https://golang.org/pkg/html/template/#HTML - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33 - category: security - technology: - - go - confidence: LOW - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type - shortlink: https://sg.run/3xDb semgrep.dev: rule: + origin: community r_id: 9143 - rv_id: 1262963 rule_id: 0oU5n3 + rv_id: 1262963 + url: + https://semgrep.dev/playground/r/zyTb2Lz/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type version_id: zyTb2Lz - url: https://semgrep.dev/playground/r/zyTb2Lz/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type - origin: community - languages: - - go - severity: WARNING + shortlink: https://sg.run/3xDb + source: https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type + subcategory: + - audit + technology: + - go + vulnerability_class: + - Cross-Site-Scripting (XSS) patterns: - pattern-not: template.$ANY("..." + "...") - pattern-not: template.$ANY("...") @@ -2877,24 +2217,23 @@ rules: - pattern: template.JSStr(...) - pattern: template.Srcset(...) - pattern: template.URL(...) + severity: WARNING - id: go.lang.security.audit.xxe.parsing-external-entities-enabled.parsing-external-entities-enabled - patterns: - - pattern-inside: 'import ("github.com/lestrrat-go/libxml2/parser") - - ... - - ' - - pattern: $PARSER := parser.New(parser.XMLParseNoEnt) - message: Detected enabling of "XMLParseNoEnt", which allows parsing of external entities and can lead to XXE if user controlled - data is parsed by the library. Instead, do not enable "XMLParseNoEnt" or be sure to adequately sanitize user-controlled - data when it is being parsed by this library. languages: - go - severity: WARNING + message: Detected enabling of "XMLParseNoEnt", which allows parsing of external entities and can lead to XXE if user + controlled data is parsed by the library. Instead, do not enable "XMLParseNoEnt" or be sure to adequately sanitize + user-controlled data when it is being parsed by this library. metadata: category: security + confidence: LOW cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration @@ -2902,41 +2241,40 @@ rules: references: - https://knowledge-base.secureflag.com/vulnerabilities/xml_injection/xml_entity_expansion_go_lang.html - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing - technology: - - libxml2 - confidence: LOW - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/go.lang.security.audit.xxe.parsing-external-entities-enabled.parsing-external-entities-enabled - shortlink: https://sg.run/A51w semgrep.dev: rule: + origin: community r_id: 18794 - rv_id: 1262964 rule_id: WAUdLP + rv_id: 1262964 + url: + https://semgrep.dev/playground/r/pZT03n5/go.lang.security.audit.xxe.parsing-external-entities-enabled.parsing-external-entities-enabled version_id: pZT03n5 - url: https://semgrep.dev/playground/r/pZT03n5/go.lang.security.audit.xxe.parsing-external-entities-enabled.parsing-external-entities-enabled - origin: community + shortlink: https://sg.run/A51w + source: + https://semgrep.dev/r/go.lang.security.audit.xxe.parsing-external-entities-enabled.parsing-external-entities-enabled + subcategory: + - audit + technology: + - libxml2 + vulnerability_class: + - XML Injection + patterns: + - pattern-inside: "import (\"github.com/lestrrat-go/libxml2/parser\")\n...\n" + - pattern: $PARSER := parser.New(parser.XMLParseNoEnt) + severity: WARNING - id: go.lang.security.bad_tmp.bad-tmp-file-creation - message: File creation in shared tmp directory without using `io.CreateTemp`. languages: - go - severity: WARNING + message: File creation in shared tmp directory without using `io.CreateTemp`. metadata: - cwe: - - 'CWE-377: Insecure Temporary File' - source-rule-url: https://github.com/securego/gosec category: security - technology: - - go confidence: LOW + cwe: + - 'CWE-377: Insecure Temporary File' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control @@ -2945,308 +2283,247 @@ rules: - https://pkg.go.dev/io/ioutil#TempFile - https://pkg.go.dev/os#CreateTemp - https://github.com/securego/gosec/blob/5fd2a370447223541cddb35da8d1bc707b7bb153/rules/tempfiles.go#L67 - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation - shortlink: https://sg.run/Gejn semgrep.dev: rule: + origin: community r_id: 9104 - rv_id: 1262965 rule_id: 6JUjnL - version_id: 2KTv2pJ + rv_id: 1262965 url: https://semgrep.dev/playground/r/2KTv2pJ/go.lang.security.bad_tmp.bad-tmp-file-creation - origin: community + version_id: 2KTv2pJ + shortlink: https://sg.run/Gejn + source: https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation + source-rule-url: https://github.com/securego/gosec + subcategory: + - audit + technology: + - go + vulnerability_class: + - Other pattern-either: - pattern: ioutil.WriteFile("=~//tmp/.*$/", ...) - pattern: os.Create("=~//tmp/.*$/", ...) - pattern: os.WriteFile("=~//tmp/.*$/", ...) -- id: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb - message: 'Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate - this attack. `io.CopyN()` can specify a size. ' severity: WARNING - languages: - - go - patterns: - - pattern-either: - - pattern: io.Copy(...) - - pattern: io.CopyBuffer(...) - - pattern-either: - - pattern-inside: 'gzip.NewReader(...) - - ... - - ' - - pattern-inside: 'zlib.NewReader(...) - - ... - - ' - - pattern-inside: 'zlib.NewReaderDict(...) - - ... - - ' - - pattern-inside: 'bzip2.NewReader(...) - - ... - - ' - - pattern-inside: 'flate.NewReader(...) - - ... - - ' - - pattern-inside: 'flate.NewReaderDict(...) - - ... - - ' - - pattern-inside: 'lzw.NewReader(...) - - ... - - ' - - pattern-inside: 'tar.NewReader(...) - - ... - - ' - - pattern-inside: 'zip.NewReader(...) - - ... - - ' - - pattern-inside: 'zip.OpenReader(...) - - ... - - ' - fix-regex: +- fix-regex: regex: (.*)(Copy|CopyBuffer)\((.*?),(.*?)(\)|,.*\)) replacement: \1CopyN(\3, \4, 1024*1024*256) + id: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb + languages: + - go + message: 'Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate + this attack. `io.CopyN()` can specify a size. ' metadata: - cwe: - - 'CWE-400: Uncontrolled Resource Consumption' - source-rule-url: https://github.com/securego/gosec - references: - - https://golang.org/pkg/io/#CopyN - - https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go category: security - technology: - - go confidence: LOW + cwe: + - 'CWE-400: Uncontrolled Resource Consumption' cwe2022-top25: true - subcategory: - - audit - likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Denial-of-Service (DoS) - source: https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb - shortlink: https://sg.run/RodK + likelihood: LOW + references: + - https://golang.org/pkg/io/#CopyN + - https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go semgrep.dev: rule: + origin: community r_id: 9105 - rv_id: 945606 rule_id: oqUeqn + rv_id: 945606 + url: + https://semgrep.dev/playground/r/JdTDye5/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb version_id: JdTDye5 - url: https://semgrep.dev/playground/r/JdTDye5/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb - origin: community + shortlink: https://sg.run/RodK + source: https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb + source-rule-url: https://github.com/securego/gosec + subcategory: + - audit + technology: + - go + vulnerability_class: + - Denial-of-Service (DoS) + patterns: + - pattern-either: + - pattern: io.Copy(...) + - pattern: io.CopyBuffer(...) + - pattern-either: + - pattern-inside: "gzip.NewReader(...)\n...\n" + - pattern-inside: "zlib.NewReader(...)\n...\n" + - pattern-inside: "zlib.NewReaderDict(...)\n...\n" + - pattern-inside: "bzip2.NewReader(...)\n...\n" + - pattern-inside: "flate.NewReader(...)\n...\n" + - pattern-inside: "flate.NewReaderDict(...)\n...\n" + - pattern-inside: "lzw.NewReader(...)\n...\n" + - pattern-inside: "tar.NewReader(...)\n...\n" + - pattern-inside: "zip.NewReader(...)\n...\n" + - pattern-inside: "zip.OpenReader(...)\n...\n" + severity: WARNING - id: go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface languages: - go - message: Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security vulnerabilities - (CWE-502). Use a concrete struct type instead. - severity: WARNING + message: Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security + vulnerabilities (CWE-502). Use a concrete struct type instead. metadata: + category: security + confidence: HIGH cwe: - 'CWE-502: Deserialization of Untrusted Data' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - category: security - technology: - - go - confidence: HIGH - likelihood: MEDIUM - impact: HIGH - subcategory: - - vuln references: - https://cwe.mitre.org/data/definitions/502.html - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface - shortlink: https://sg.run/6WbKL semgrep.dev: rule: + origin: community r_id: 274359 - rv_id: 1409387 rule_id: 4bUAQDG + rv_id: 1409387 + url: + https://semgrep.dev/playground/r/ZRTDkjk/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface version_id: ZRTDkjk - url: https://semgrep.dev/playground/r/ZRTDkjk/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface - origin: community + shortlink: https://sg.run/6WbKL + source: + https://semgrep.dev/r/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface + subcategory: + - vuln + technology: + - go + vulnerability_class: + - 'Insecure Deserialization ' patterns: - pattern-either: - - pattern: 'var $VAR interface{} - - ... - - json.Unmarshal($DATA, &$VAR) - - ' - - pattern: 'var $VAR interface{} - - ... - - yaml.Unmarshal($DATA, &$VAR) - - ' - - pattern: 'var $VAR interface{} - - ... - - xml.Unmarshal($DATA, &$VAR) - - ' -- id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse + - pattern: "var $VAR interface{}\n...\njson.Unmarshal($DATA, &$VAR)\n" + - pattern: "var $VAR interface{}\n...\nyaml.Unmarshal($DATA, &$VAR)\n" + - pattern: "var $VAR interface{}\n...\nxml.Unmarshal($DATA, &$VAR)\n" + severity: WARNING +- fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/"))) + id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse + languages: + - go message: '`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path, "/")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.' - severity: ERROR - languages: - - go - mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' - - metavariable-regex: - metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ - pattern-sinks: - - patterns: - - pattern-either: - - pattern: filepath.Clean($...INNER) - - pattern: path.Clean($...INNER) - pattern-sanitizers: - - pattern-either: - - pattern: '"/" + ... - - ' - fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/"))) - options: - interfile: true metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control references: - https://pkg.go.dev/path#Clean - http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html - https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/ - https://dzx.cz/2021/04/02/go_path_traversal/ - https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme - cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' - owasp: - - A05:2017 - Broken Access Control - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - category: security - technology: - - go - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse - shortlink: https://sg.run/ZKzw semgrep.dev: rule: + origin: community r_id: 18235 - rv_id: 1262967 rule_id: qNUQJe - version_id: jQTn5Bj + rv_id: 1262967 url: https://semgrep.dev/playground/r/jQTn5Bj/go.lang.security.filepath-clean-misuse.filepath-clean-misuse - origin: community + version_id: jQTn5Bj + shortlink: https://sg.run/ZKzw + source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Path Traversal + mode: taint + options: + interfile: true + pattern-sanitizers: + - pattern-either: + - pattern: "\"/\" + ...\n" + pattern-sinks: + - patterns: + - pattern-either: + - pattern: filepath.Clean($...INNER) + - pattern: path.Clean($...INNER) + pattern-sources: + - patterns: + - pattern-either: + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" + - metavariable-regex: + metavariable: $ANYTHING + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + severity: ERROR - id: go.lang.security.injection.open-redirect.open-redirect languages: - go - severity: WARNING - message: An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, - potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input - to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices - to restrict the URL to domains in an allowlist. - options: - interfile: true + message: An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect + vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where + possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is + recommended to follow OWASP best practices to restrict the URL to domains in an allowlist. metadata: - cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' - references: - - https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html category: security - technology: - - go confidence: HIGH + cwe: + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" description: An HTTP redirect was found to be crafted from user-input leading to an open redirect vulnerability - subcategory: - - vuln impact: MEDIUM - likelihood: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect - shortlink: https://sg.run/2ZW45 + likelihood: MEDIUM + references: + - https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html semgrep.dev: rule: + origin: community r_id: 113619 - rv_id: 945608 rule_id: DbU6RlN - version_id: GxTP7J7 + rv_id: 945608 url: https://semgrep.dev/playground/r/GxTP7J7/go.lang.security.injection.open-redirect.open-redirect - origin: community + version_id: GxTP7J7 + shortlink: https://sg.run/2ZW45 + source: https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Open Redirect mode: taint + options: + interfile: true + pattern-sinks: + - patterns: + - pattern: http.Redirect($W, $REQ, $URL, ...) + - focus-metavariable: $URL + requires: INPUT and not CLEAN pattern-sources: - label: INPUT patterns: - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" - metavariable-regex: metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ - label: CLEAN - requires: INPUT patterns: - pattern-either: - - pattern: '"$URLSTR" + $INPUT - - ' + - pattern: "\"$URLSTR\" + $INPUT\n" - patterns: - pattern-either: - pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...) @@ -3255,64 +2532,48 @@ rules: - metavariable-regex: metavariable: $URLSTR regex: .*//[a-zA-Z0-10]+\..* - pattern-sinks: - - requires: INPUT and not CLEAN - patterns: - - pattern: http.Redirect($W, $REQ, $URL, ...) - - focus-metavariable: $URL + requires: INPUT + severity: WARNING - id: go.lang.security.injection.raw-html-format.raw-html-format languages: - go - severity: WARNING - message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods - of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could - let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect - that the HTML is rendered safely. + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure + methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, + which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML + instead, or inspect that the HTML is rendered safely. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - go references: - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format - shortlink: https://sg.run/3r1G semgrep.dev: rule: + origin: community r_id: 14443 - rv_id: 1262968 rule_id: PeUonQ - version_id: 1QTyp2p + rv_id: 1262968 url: https://semgrep.dev/playground/r/1QTyp2p/go.lang.security.injection.raw-html-format.raw-html-format - origin: community + version_id: 1QTyp2p + shortlink: https://sg.run/3r1G + source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' - - metavariable-regex: - metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ pattern-sanitizers: - pattern: html.EscapeString(...) pattern-sinks: @@ -3323,97 +2584,80 @@ rules: - pattern: fmt.Fprintf($W, "$HTMLSTR", ...) - pattern: '"$HTMLSTR" + ...' - metavariable-pattern: - metavariable: $HTMLSTR language: generic + metavariable: $HTMLSTR pattern: <$TAG ... + pattern-sources: + - patterns: + - pattern-either: + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" + - metavariable-regex: + metavariable: $ANYTHING + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + severity: WARNING - id: go.lang.security.injection.tainted-sql-string.tainted-sql-string languages: - go - message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using - prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of - SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements - (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library. - options: - interfile: true + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings + using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible + indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use + prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library. metadata: - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://golang.org/doc/database/sql-injection - - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/ category: security - technology: - - go confidence: HIGH - cwe2022-top25: true + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/PbEq + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://golang.org/doc/database/sql-injection + - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/ semgrep.dev: rule: + origin: community r_id: 14689 - rv_id: 1409388 rule_id: PeUoqy - version_id: nWTQ5qD + rv_id: 1409388 url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string - origin: community + version_id: nWTQ5qD + shortlink: https://sg.run/PbEq + source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - go + vulnerability_class: + - SQL Injection mode: taint - severity: ERROR - pattern-sources: - - patterns: - - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' - - metavariable-regex: - metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + options: + interfile: true + pattern-sanitizers: + - pattern-either: + - pattern: strconv.Atoi(...) + - pattern: "($X: bool)\n" pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - - pattern: '"$SQLSTR" + ... - - ' + - pattern: "\"$SQLSTR\" + ...\n" - patterns: - - pattern-inside: '$VAR = "$SQLSTR"; - - ... - - ' + - pattern-inside: "$VAR = \"$SQLSTR\";\n...\n" - pattern: $VAR += ... - patterns: - - pattern-inside: 'var $SB strings.Builder - - ... - - ' - - pattern-inside: '$SB.WriteString("$SQLSTR") - - ... - - $SB.String(...) - - ' - - pattern: '$SB.WriteString(...) - - ' + - pattern-inside: "var $SB strings.Builder\n...\n" + - pattern-inside: "$SB.WriteString(\"$SQLSTR\")\n...\n$SB.String(...)\n" + - pattern: "$SB.WriteString(...)\n" - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop).* @@ -3425,74 +2669,91 @@ rules: - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* - pattern-sanitizers: - - pattern-either: - - pattern: strconv.Atoi(...) - - pattern: '($X: bool) - - ' + pattern-sources: + - patterns: + - pattern-either: + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" + - metavariable-regex: + metavariable: $ANYTHING + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + severity: ERROR - id: go.lang.security.injection.tainted-url-host.tainted-url-host languages: - go - message: A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) - vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft - the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the - request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist. - options: - interfile: true + message: A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery + (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input + to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to + craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist. metadata: + category: security + confidence: HIGH cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://goteleport.com/blog/ssrf-attacks/ - category: security - technology: - - go - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host - shortlink: https://sg.run/5DjW semgrep.dev: rule: + origin: community r_id: 14391 - rv_id: 1262970 rule_id: AbUQLr - version_id: yeTxpOj + rv_id: 1262970 url: https://semgrep.dev/playground/r/yeTxpOj/go.lang.security.injection.tainted-url-host.tainted-url-host - origin: community + version_id: yeTxpOj + shortlink: https://sg.run/5DjW + source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint + options: + interfile: true + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - patterns: + - pattern-inside: "$CLIENT := &http.Client{...}\n...\n" + - pattern: $CLIENT.$METHOD($URL, ...) + - pattern: http.$METHOD($URL, ...) + - metavariable-regex: + metavariable: $METHOD + regex: ^(Get|Head|Post|PostForm)$ + - patterns: + - pattern: "http.NewRequest(\"$METHOD\", $URL, ...)\n" + - metavariable-regex: + metavariable: $METHOD + regex: ^(GET|HEAD|POST|POSTFORM)$ + - focus-metavariable: $URL + requires: INPUT and not CLEAN pattern-sources: - label: INPUT patterns: - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" - metavariable-regex: metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ - label: CLEAN - requires: INPUT patterns: - pattern-either: - - pattern: '"$URLSTR" + $INPUT - - ' + - pattern: "\"$URLSTR\" + $INPUT\n" - patterns: - pattern-either: - pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...) @@ -3501,107 +2762,84 @@ rules: - metavariable-regex: metavariable: $URLSTR regex: .*//[a-zA-Z0-10]+\..* - pattern-sinks: - - requires: INPUT and not CLEAN - patterns: - - pattern-either: - - patterns: - - pattern-either: - - patterns: - - pattern-inside: '$CLIENT := &http.Client{...} - - ... - - ' - - pattern: $CLIENT.$METHOD($URL, ...) - - pattern: http.$METHOD($URL, ...) - - metavariable-regex: - metavariable: $METHOD - regex: ^(Get|Head|Post|PostForm)$ - - patterns: - - pattern: 'http.NewRequest("$METHOD", $URL, ...) - - ' - - metavariable-regex: - metavariable: $METHOD - regex: ^(GET|HEAD|POST|POSTFORM)$ - - focus-metavariable: $URL + requires: INPUT severity: WARNING - id: go.lang.security.reverseproxy-director.reverseproxy-director - message: ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director. languages: - go - severity: WARNING - patterns: - - pattern-inside: 'import "net/http/httputil" - - ... - - ' - - pattern-either: - - pattern: $PROXY.Director = $FUNC - - patterns: - - pattern-inside: "httputil.ReverseProxy{\n ...\n}\n" - - pattern: 'Director: $FUNC - - ' + message: ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of + ReverseProxy.Director. metadata: - cwe: - - 'CWE-115: Misinterpretation of Input' category: security - subcategory: - - audit - technology: - - go confidence: MEDIUM - likelihood: LOW + cwe: + - 'CWE-115: Misinterpretation of Input' impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW references: - https://github.com/golang/go/issues/50580 - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director - shortlink: https://sg.run/9AYYR semgrep.dev: rule: + origin: community r_id: 146567 - rv_id: 945612 rule_id: zdUKzzA - version_id: DkTNpvx + rv_id: 945612 url: https://semgrep.dev/playground/r/DkTNpvx/go.lang.security.reverseproxy-director.reverseproxy-director - origin: community + version_id: DkTNpvx + shortlink: https://sg.run/9AYYR + source: https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director + subcategory: + - audit + technology: + - go + vulnerability_class: + - Other + patterns: + - pattern-inside: "import \"net/http/httputil\"\n...\n" + - pattern-either: + - pattern: $PROXY.Director = $FUNC + - patterns: + - pattern-inside: "httputil.ReverseProxy{\n ...\n}\n" + - pattern: "Director: $FUNC\n" + severity: WARNING - id: go.lang.security.shared-url-struct-mutation.shared-url-struct-mutation - message: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. languages: - go - severity: WARNING + message: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. + metadata: + category: security + confidence: LOW + cwe: + - 'CWE-436: Interpretation Conflict' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + references: + - https://github.com/golang/go/issues/63777 + semgrep.dev: + rule: + origin: community + r_id: 146568 + rule_id: pKU1EEO + rv_id: 945613 + url: + https://semgrep.dev/playground/r/WrTEojd/go.lang.security.shared-url-struct-mutation.shared-url-struct-mutation + version_id: WrTEojd + shortlink: https://sg.run/yyEEd + source: https://semgrep.dev/r/go.lang.security.shared-url-struct-mutation.shared-url-struct-mutation + subcategory: + - audit + technology: + - go + vulnerability_class: + - Other patterns: - - pattern-inside: 'import "net/url" - - ... - - ' - - pattern-not-inside: '... = url.Parse(...) - - ... - - ' - - pattern-not-inside: '... = url.ParseRequestURI(...) - - ... - - ' - - pattern-not-inside: '... = url.URL{...} - - ... - - ' - - pattern-not-inside: 'var $URL *$X.URL - - ... - - ' + - pattern-inside: "import \"net/url\"\n...\n" + - pattern-not-inside: "... = url.Parse(...)\n...\n" + - pattern-not-inside: "... = url.ParseRequestURI(...)\n...\n" + - pattern-not-inside: "... = url.URL{...}\n...\n" + - pattern-not-inside: "var $URL *$X.URL\n...\n" - pattern-either: - pattern: $URL.RawQuery = ... - pattern: $URL.Path = ... @@ -3617,69 +2855,44 @@ rules: patterns: - pattern-not: $X.$Y - pattern-not: $X[...] - metadata: - cwe: - - 'CWE-436: Interpretation Conflict' - category: security - subcategory: - - audit - technology: - - go - confidence: LOW - likelihood: LOW - impact: LOW - references: - - https://github.com/golang/go/issues/63777 - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/go.lang.security.shared-url-struct-mutation.shared-url-struct-mutation - shortlink: https://sg.run/yyEEd - semgrep.dev: - rule: - r_id: 146568 - rv_id: 945613 - rule_id: pKU1EEO - version_id: WrTEojd - url: https://semgrep.dev/playground/r/WrTEojd/go.lang.security.shared-url-struct-mutation.shared-url-struct-mutation - origin: community + severity: WARNING - id: go.lang.security.zip.path-traversal-inside-zip-extraction + languages: + - go message: File traversal when extracting zip archive metadata: - cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' - source_rule_url: https://github.com/securego/gosec/issues/205 category: security - technology: - - go confidence: LOW + cwe: + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction - shortlink: https://sg.run/Av64 semgrep.dev: rule: + origin: community r_id: 9106 - rv_id: 1262971 rule_id: zdUkoR - version_id: rxTAK1Z + rv_id: 1262971 url: https://semgrep.dev/playground/r/rxTAK1Z/go.lang.security.zip.path-traversal-inside-zip-extraction - origin: community - languages: - - go + version_id: rxTAK1Z + shortlink: https://sg.run/Av64 + source: https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction + source_rule_url: https://github.com/securego/gosec/issues/205 + subcategory: + - audit + technology: + - go + vulnerability_class: + - Path Traversal + pattern: "reader, $ERR := zip.OpenReader($ARCHIVE)\n...\nfor _, $FILE := range reader.File {\n ...\n path := filepath.Join($TARGET, + $FILE.Name)\n ...\n}\n" severity: WARNING - pattern: "reader, $ERR := zip.OpenReader($ARCHIVE)\n...\nfor _, $FILE := range reader.File {\n ...\n path := filepath.Join($TARGET,\ - \ $FILE.Name)\n ...\n}\n" diff --git a/.semgrep/registry/golang.yaml b/.semgrep/registry/golang.yaml index a6aad0d..a1190ba 100644 --- a/.semgrep/registry/golang.yaml +++ b/.semgrep/registry/golang.yaml @@ -7,44 +7,44 @@ rules: - id: go.aws-lambda.security.database-sqli.database-sqli languages: - go - message: Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is - user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls. - mode: taint + message: Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable + is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or + prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls. metadata: - references: - - https://pkg.go.dev/database/sql#DB.Query category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://pkg.go.dev/database/sql#DB.Query + semgrep.dev: + rule: + origin: community + r_id: 18232 + rule_id: WAUdJ7 + rv_id: 1262909 + url: https://semgrep.dev/playground/r/BjTkZkQ/go.aws-lambda.security.database-sqli.database-sqli + version_id: BjTkZkQ + shortlink: https://sg.run/e5e8 + source: https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli + subcategory: + - vuln technology: - aws-lambda - database - sql - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection - source: https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli - shortlink: https://sg.run/e5e8 - semgrep.dev: - rule: - r_id: 18232 - rv_id: 1262909 - rule_id: WAUdJ7 - version_id: BjTkZkQ - url: https://semgrep.dev/playground/r/BjTkZkQ/go.aws-lambda.security.database-sqli.database-sqli - origin: community + mode: taint pattern-sinks: - patterns: - focus-metavariable: $QUERY @@ -55,112 +55,63 @@ rules: - pattern: $DB.QueryContext($QUERY,...) - pattern: $DB.QueryRow($QUERY,...) - pattern: $DB.QueryRowContext($QUERY,...) - - pattern-inside: 'import "database/sql" - - ... - - ' + - pattern-inside: "import \"database/sql\"\n...\n" pattern-sources: - patterns: - pattern-either: - - pattern-inside: 'func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...} - - ... - - lambda.Start($HANDLER, ...) - - ' + - pattern-inside: "func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...}\n...\nlambda.Start($HANDLER, ...)\n" - patterns: - - pattern-inside: 'func $HANDLER($EVENT $TYPE) {...} - - ... - - lambda.Start($HANDLER, ...) - - ' - - pattern-not-inside: 'func $HANDLER($EVENT context.Context) {...} - - ... - - lambda.Start($HANDLER, ...) - - ' + - pattern-inside: "func $HANDLER($EVENT $TYPE) {...}\n...\nlambda.Start($HANDLER, ...)\n" + - pattern-not-inside: "func $HANDLER($EVENT context.Context) {...}\n...\nlambda.Start($HANDLER, ...)\n" - focus-metavariable: $EVENT severity: WARNING - id: go.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - go - severity: ERROR - message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction - could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the - database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider - using an object-relational mapper (ORM) such as Sequelize which will protect your queries. + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual + construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify + contents of the database. Instead, use a parameterized query which is available by default in most database engines. + Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. metadata: - references: - - https://owasp.org/www-community/attacks/SQL_Injection category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/vX3Y + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/SQL_Injection semgrep.dev: rule: + origin: community r_id: 18233 - rv_id: 1262910 rule_id: 0oUwqg - version_id: DkTRbRL + rv_id: 1262910 url: https://semgrep.dev/playground/r/DkTRbRL/go.aws-lambda.security.tainted-sql-string.tainted-sql-string - origin: community + version_id: DkTRbRL + shortlink: https://sg.run/vX3Y + source: https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: 'func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...} - - ... - - lambda.Start($HANDLER, ...) - - ' - - patterns: - - pattern-inside: 'func $HANDLER($EVENT $TYPE) {...} - - ... - - lambda.Start($HANDLER, ...) - - ' - - pattern-not-inside: 'func $HANDLER($EVENT context.Context) {...} - - ... - - lambda.Start($HANDLER, ...) - - ' - - focus-metavariable: $EVENT + pattern-sanitizers: + - pattern: strconv.Atoi(...) pattern-sinks: - patterns: - pattern-either: - patterns: - - pattern: '"$SQLSTR" + ... - - ' + - pattern: "\"$SQLSTR\" + ...\n" - metavariable-regex: metavariable: $SQLSTR regex: (?i)(\s*select|\s*delete|\s*insert|\s*create|\s*update|\s*alter|\s*drop).* @@ -172,318 +123,256 @@ rules: - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* - - pattern-not-inside: 'log.$PRINT(...) - - ' - pattern-sanitizers: - - pattern: strconv.Atoi(...) + - pattern-not-inside: "log.$PRINT(...)\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...}\n...\nlambda.Start($HANDLER, ...)\n" + - patterns: + - pattern-inside: "func $HANDLER($EVENT $TYPE) {...}\n...\nlambda.Start($HANDLER, ...)\n" + - pattern-not-inside: "func $HANDLER($EVENT context.Context) {...}\n...\nlambda.Start($HANDLER, ...)\n" + - focus-metavariable: $EVENT + severity: ERROR - id: go.gorilla.security.audit.handler-assignment-from-multiple-sources.handler-assignment-from-multiple-sources + languages: + - go + message: "Variable $VAR is assigned from two different sources: '$Y' and '$R'. Make sure this is intended, as this could + cause logic bugs if they are treated as they are the same object." metadata: - cwe: - - 'CWE-289: Authentication Bypass by Alternate Name' category: security - technology: - - gorilla confidence: MEDIUM - references: - - https://cwe.mitre.org/data/definitions/289.html - subcategory: - - audit + cwe: + - 'CWE-289: Authentication Bypass by Alternate Name' impact: MEDIUM - likelihood: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/go.gorilla.security.audit.handler-assignment-from-multiple-sources.handler-assignment-from-multiple-sources - shortlink: https://sg.run/gL3y + likelihood: LOW + references: + - https://cwe.mitre.org/data/definitions/289.html semgrep.dev: rule: + origin: community r_id: 9085 - rv_id: 945538 rule_id: WAUoBk + rv_id: 945538 + url: + https://semgrep.dev/playground/r/ZRT35xJ/go.gorilla.security.audit.handler-assignment-from-multiple-sources.handler-assignment-from-multiple-sources version_id: ZRT35xJ - url: https://semgrep.dev/playground/r/ZRT35xJ/go.gorilla.security.audit.handler-assignment-from-multiple-sources.handler-assignment-from-multiple-sources - origin: community + shortlink: https://sg.run/gL3y + source: + https://semgrep.dev/r/go.gorilla.security.audit.handler-assignment-from-multiple-sources.handler-assignment-from-multiple-sources + subcategory: + - audit + technology: + - gorilla + vulnerability_class: + - Improper Authentication mode: taint - pattern-sources: + pattern-sinks: - patterns: - - pattern-inside: "func $HANDLER(..., $R *http.Request, ...) {\n ...\n}\n" + - pattern: "$Y, err := store.Get(...)\n...\n$VAR := $Y.Values[...]\n...\n$VAR = $R\n" - focus-metavariable: $R - - pattern-either: - - pattern: $R.query - pattern-sinks: - patterns: - - pattern: '$Y, err := store.Get(...) - - ... - - $VAR := $Y.Values[...] - - ... - - $VAR = $R - - ' + - pattern: "$Y, err := store.Get(...)\n...\nvar $VAR $INT = $Y.Values[\"...\"].($INT)\n...\n$VAR = $R\n" - focus-metavariable: $R + pattern-sources: - patterns: - - pattern: '$Y, err := store.Get(...) - - ... - - var $VAR $INT = $Y.Values["..."].($INT) - - ... - - $VAR = $R - - ' + - pattern-inside: "func $HANDLER(..., $R *http.Request, ...) {\n ...\n}\n" - focus-metavariable: $R - message: 'Variable $VAR is assigned from two different sources: ''$Y'' and ''$R''. Make sure this is intended, as this could - cause logic bugs if they are treated as they are the same object.' + - pattern-either: + - pattern: $R.query + severity: WARNING +- fix-regex: + regex: (HttpOnly\s*:\s+)false + replacement: \1true + id: go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly languages: - go - severity: WARNING -- id: go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly - patterns: - - pattern-not-inside: "&sessions.Options{\n ...,\n HttpOnly: true,\n ...,\n}\n" - - pattern: "&sessions.Options{\n ...,\n}\n" - message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the - browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by - setting 'HttpOnly' to 'true' in the Options struct. + message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs + the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' + flag by setting 'HttpOnly' to 'true' in the Options struct. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69 - category: security - technology: - - gorilla - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly - shortlink: https://sg.run/4xJZ semgrep.dev: rule: + origin: community r_id: 9088 - rv_id: 1262911 rule_id: qNUj6g + rv_id: 1262911 + url: + https://semgrep.dev/playground/r/WrTqKqe/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly version_id: WrTqKqe - url: https://semgrep.dev/playground/r/WrTqKqe/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly - origin: community - fix-regex: - regex: (HttpOnly\s*:\s+)false - replacement: \1true + shortlink: https://sg.run/4xJZ + source: + https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly + subcategory: + - audit + technology: + - gorilla + vulnerability_class: + - Cookie Security + patterns: + - pattern-not-inside: "&sessions.Options{\n ...,\n HttpOnly: true,\n ...,\n}\n" + - pattern: "&sessions.Options{\n ...,\n}\n" severity: WARNING +- fix-regex: + regex: (Secure\s*:\s+)false + replacement: \1true + id: go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure languages: - go -- id: go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure - patterns: - - pattern-not-inside: "&sessions.Options{\n ...,\n Secure: true,\n ...,\n}\n" - - pattern: "&sessions.Options{\n ...,\n}\n" - message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client - from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' - in the Options struct. + message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the + client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' + to 'true' in the Options struct. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69 - category: security - technology: - - gorilla - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure - shortlink: https://sg.run/PJdE semgrep.dev: rule: + origin: community r_id: 9089 - rv_id: 1262912 rule_id: lBU9kw + rv_id: 1262912 + url: + https://semgrep.dev/playground/r/0bTKzKk/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure version_id: 0bTKzKk - url: https://semgrep.dev/playground/r/0bTKzKk/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure - origin: community - fix-regex: - regex: (Secure\s*:\s+)false - replacement: \1true + shortlink: https://sg.run/PJdE + source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure + subcategory: + - audit + technology: + - gorilla + vulnerability_class: + - Cookie Security + patterns: + - pattern-not-inside: "&sessions.Options{\n ...,\n Secure: true,\n ...,\n}\n" + - pattern: "&sessions.Options{\n ...,\n}\n" severity: WARNING +- fix-regex: + regex: (SameSite\s*:\s+)http.SameSiteNoneMode + replacement: \1http.SameSiteDefaultMode + id: go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone languages: - go -- id: go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone - patterns: - - pattern-inside: "&sessions.Options{\n ...,\n SameSite: http.SameSiteNoneMode,\n ...,\n}\n" - - pattern: "&sessions.Options{\n ...,\n}\n" - message: Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default - for enhanced security. + message: Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or + Default for enhanced security. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://pkg.go.dev/github.com/gorilla/sessions#Options - category: security - technology: - - gorilla - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone - shortlink: https://sg.run/x8Nwj semgrep.dev: rule: + origin: community r_id: 133074 - rv_id: 1262913 rule_id: YGUpGd4 + rv_id: 1262913 + url: + https://semgrep.dev/playground/r/K3TKkKB/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone version_id: K3TKkKB - url: https://semgrep.dev/playground/r/K3TKkKB/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone - origin: community - fix-regex: - regex: (SameSite\s*:\s+)http.SameSiteNoneMode - replacement: \1http.SameSiteDefaultMode - severity: WARNING - languages: - - go -- id: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check - patterns: - - pattern-inside: 'import ("github.com/gorilla/websocket") - - ... - - ' - - patterns: - - pattern-not-inside: '$UPGRADER = websocket.Upgrader{..., CheckOrigin: $FN ,...} - - ... - - ' - - pattern-not-inside: '$UPGRADER.CheckOrigin = $FN2 - - ... - - ' - - pattern: '$UPGRADER.Upgrade(...) - - ' - message: 'The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket - is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per "gorilla/websocket" - documentation: "A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery."' + shortlink: https://sg.run/x8Nwj + source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone + subcategory: + - audit + technology: + - gorilla + vulnerability_class: + - Cookie Security + patterns: + - pattern-inside: "&sessions.Options{\n ...,\n SameSite: http.SameSiteNoneMode,\n ...,\n}\n" + - pattern: "&sessions.Options{\n ...,\n}\n" + severity: WARNING +- id: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check languages: - go - severity: WARNING + message: 'The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket + is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per "gorilla/websocket" + documentation: "A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery."' metadata: category: security + confidence: MEDIUM cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://pkg.go.dev/github.com/gorilla/websocket#Upgrader - technology: - - gorilla - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site Request Forgery (CSRF) - source: https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check - shortlink: https://sg.run/xXpz semgrep.dev: rule: + origin: community r_id: 18430 - rv_id: 1262914 rule_id: ReUKdz + rv_id: 1262914 + url: + https://semgrep.dev/playground/r/qkTR7RP/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check version_id: qkTR7RP - url: https://semgrep.dev/playground/r/qkTR7RP/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check - origin: community -- id: go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage - message: Detected usage of dangerous method $METHOD which does not escape inputs (see link in references). If the argument - is user-controlled, this can lead to SQL injection. When using $METHOD function, do not trust user-submitted data and - only allow approved list of input (possibly, use an allowlist approach). + shortlink: https://sg.run/xXpz + source: + https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check + subcategory: + - audit + technology: + - gorilla + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + patterns: + - pattern-inside: "import (\"github.com/gorilla/websocket\")\n...\n" + - patterns: + - pattern-not-inside: "$UPGRADER = websocket.Upgrader{..., CheckOrigin: $FN ,...}\n...\n" + - pattern-not-inside: "$UPGRADER.CheckOrigin = $FN2\n...\n" + - pattern: "$UPGRADER.Upgrade(...)\n" severity: WARNING +- id: go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage languages: - go - mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - metavariable-regex: - metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ - pattern-sinks: - - patterns: - - pattern-inside: 'import ("gorm.io/gorm") - - ... - - ' - - patterns: - - pattern-inside: "func $VAL(..., $GORM *gorm.DB,... ) {\n ...\n}\n" - - pattern-either: - - pattern: '$GORM. ... .$METHOD($VALUE) - - ' - - pattern: '$DB := $GORM. ... .$ANYTHING(...) - - ... - - $DB. ... .$METHOD($VALUE) - - ' - - focus-metavariable: $VALUE - - metavariable-regex: - metavariable: $METHOD - regex: ^(Order|Exec|Raw|Group|Having|Distinct|Select|Pluck)$ - pattern-sanitizers: - - pattern-either: - - pattern: strconv.Atoi(...) - - pattern: '($X: bool) - - ' - options: - interfile: true + message: Detected usage of dangerous method $METHOD which does not escape inputs (see link in references). If the + argument is user-controlled, this can lead to SQL injection. When using $METHOD function, do not trust + user-submitted data and only allow approved list of input (possibly, use an allowlist approach). metadata: category: security - technology: - - gorm + confidence: HIGH cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -491,112 +380,137 @@ rules: references: - https://gorm.io/docs/security.html#SQL-injection-Methods - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage - shortlink: https://sg.run/R4qg semgrep.dev: rule: + origin: community r_id: 24693 - rv_id: 1262915 rule_id: AbU5o3 + rv_id: 1262915 + url: + https://semgrep.dev/playground/r/l4TJRJK/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage version_id: l4TJRJK - url: https://semgrep.dev/playground/r/l4TJRJK/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage - origin: community -- id: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection + shortlink: https://sg.run/R4qg + source: https://semgrep.dev/r/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage + subcategory: + - vuln + technology: + - gorm + vulnerability_class: + - SQL Injection + mode: taint + options: + interfile: true + pattern-sanitizers: + - pattern-either: + - pattern: strconv.Atoi(...) + - pattern: "($X: bool)\n" + pattern-sinks: + - patterns: + - pattern-inside: "import (\"gorm.io/gorm\")\n...\n" + - patterns: + - pattern-inside: "func $VAL(..., $GORM *gorm.DB,... ) {\n ...\n}\n" + - pattern-either: + - pattern: "$GORM. ... .$METHOD($VALUE)\n" + - pattern: "$DB := $GORM. ... .$ANYTHING(...)\n...\n$DB. ... .$METHOD($VALUE)\n" + - focus-metavariable: $VALUE + - metavariable-regex: + metavariable: $METHOD + regex: ^(Order|Exec|Raw|Group|Having|Distinct|Select|Pluck)$ + pattern-sources: + - patterns: + - pattern-either: + - pattern: "($REQUEST : http.Request).$ANYTHING\n" + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - metavariable-regex: + metavariable: $ANYTHING + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + severity: WARNING +- fix-regex: + regex: (.*)WithInsecure\(.*?\) + replacement: \1WithTransportCredentials(credentials.NewTLS()) + id: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection + languages: + - go + message: "Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to + a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish + a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create + credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS())'." metadata: - cwe: - - 'CWE-300: Channel Accessible by Non-Endpoint' - references: - - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption category: security - technology: - - grpc confidence: HIGH + cwe: + - 'CWE-300: Channel Accessible by Non-Endpoint' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection - shortlink: https://sg.run/J9yZ + references: + - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption semgrep.dev: rule: + origin: community r_id: 9090 - rv_id: 1262916 rule_id: PeUZ4X + rv_id: 1262916 + url: + https://semgrep.dev/playground/r/YDTZeZB/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection version_id: YDTZeZB - url: https://semgrep.dev/playground/r/YDTZeZB/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection - origin: community - message: 'Found an insecure gRPC connection using ''grpc.WithInsecure()''. This creates a connection without encryption - to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, - establish a secure connection with an SSL certificate using the ''grpc.WithTransportCredentials()'' function. You can - create a create credentials using a ''tls.Config{}'' struct with ''credentials.NewTLS()''. The final fix looks like this: - ''grpc.WithTransportCredentials(credentials.NewTLS())''.' - languages: - - go - severity: ERROR + shortlink: https://sg.run/J9yZ + source: https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection + subcategory: + - audit + technology: + - grpc + vulnerability_class: + - Other pattern: $GRPC.Dial($ADDR, ..., $GRPC.WithInsecure(...), ...) - fix-regex: - regex: (.*)WithInsecure\(.*?\) - replacement: \1WithTransportCredentials(credentials.NewTLS()) + severity: ERROR - id: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection + languages: + - go + message: Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a + connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could + compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC + connection. You can create credentials using 'credentials.NewServerTLSFromFile("cert.pem", "cert.key")'. metadata: - cwe: - - 'CWE-300: Channel Accessible by Non-Endpoint' - references: - - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption category: security - technology: - - grpc confidence: HIGH + cwe: + - 'CWE-300: Channel Accessible by Non-Endpoint' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection - shortlink: https://sg.run/5Q5l + references: + - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption semgrep.dev: rule: + origin: community r_id: 9091 - rv_id: 1262917 rule_id: JDUy0B + rv_id: 1262917 + url: + https://semgrep.dev/playground/r/6xT2923/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection version_id: 6xT2923 - url: https://semgrep.dev/playground/r/6xT2923/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection - origin: community - message: Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection - without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the - machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create - credentials using 'credentials.NewServerTLSFromFile("cert.pem", "cert.key")'. - languages: - - go - severity: ERROR + shortlink: https://sg.run/5Q5l + source: https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection + subcategory: + - audit + technology: + - grpc + vulnerability_class: + - Other mode: taint pattern-sinks: - - requires: OPTIONS and not CREDS - pattern: grpc.NewServer($OPT, ...) - - requires: EMPTY_CONSTRUCTOR - pattern: grpc.NewServer() + - pattern: grpc.NewServer($OPT, ...) + requires: OPTIONS and not CREDS + - pattern: grpc.NewServer() + requires: EMPTY_CONSTRUCTOR pattern-sources: - label: OPTIONS pattern: grpc.ServerOption{ ... } @@ -604,1282 +518,1034 @@ rules: pattern: grpc.Creds(...) - label: EMPTY_CONSTRUCTOR pattern: grpc.NewServer() + severity: ERROR - id: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified - message: Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're - doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the - signature is valid (because it has been checked previously in the stack) and you want to extract values from it. + languages: + - go + message: Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what + you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where + you know the signature is valid (because it has been checked previously in the stack) and you want to extract values + from it. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-345: Insufficient Verification of Data Authenticity' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - category: security - technology: - - jwt - confidence: MEDIUM references: - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified - shortlink: https://sg.run/Av66 semgrep.dev: rule: + origin: community r_id: 9094 - rv_id: 1262918 rule_id: ReUgJJ + rv_id: 1262918 + url: + https://semgrep.dev/playground/r/o5TbDbq/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified version_id: o5TbDbq - url: https://semgrep.dev/playground/r/o5TbDbq/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified - origin: community - languages: - - go - severity: WARNING + shortlink: https://sg.run/Av66 + source: https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - audit + technology: + - jwt + vulnerability_class: + - Improper Authentication patterns: - - pattern-inside: 'import "github.com/dgrijalva/jwt-go" - - ... - - ' - - pattern: '$JWT.ParseUnverified(...) - - ' + - pattern-inside: "import \"github.com/dgrijalva/jwt-go\"\n...\n" + - pattern: "$JWT.ParseUnverified(...)\n" + severity: WARNING - id: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm - message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has - already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do - not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + languages: + - go + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token + has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be + verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - category: security - technology: - - jwt - confidence: HIGH references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm - shortlink: https://sg.run/Gej1 semgrep.dev: rule: + origin: community r_id: 9092 - rv_id: 1262919 rule_id: 5rUOWQ - version_id: zyTb2bz + rv_id: 1262919 url: https://semgrep.dev/playground/r/zyTb2bz/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm - origin: community - languages: - - go - severity: ERROR + version_id: zyTb2bz + shortlink: https://sg.run/Gej1 + source: https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - audit + technology: + - jwt + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern-inside: 'import "github.com/golang-jwt/jwt" - - ... - - ' - - pattern-inside: 'import "github.com/dgrijalva/jwt-go" - - ... - - ' + - pattern-inside: "import \"github.com/golang-jwt/jwt\"\n...\n" + - pattern-inside: "import \"github.com/dgrijalva/jwt-go\"\n...\n" - pattern-either: - - pattern: 'jwt.SigningMethodNone - - ' + - pattern: "jwt.SigningMethodNone\n" - pattern: jwt.UnsafeAllowNoneSignatureType + severity: ERROR - id: go.jwt-go.security.jwt.hardcoded-jwt-key - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). - options: - interfile: true + languages: + - go + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures category: security - technology: - - jwt - - secrets confidence: MEDIUM - cwe2022-top25: true + cwe: + - 'CWE-798: Use of Hard-coded Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key - shortlink: https://sg.run/Rod2 + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9093 - rv_id: 1262920 rule_id: GdU7Ny - version_id: pZT0305 + rv_id: 1262920 url: https://semgrep.dev/playground/r/pZT0305/go.jwt-go.security.jwt.hardcoded-jwt-key - origin: community - severity: WARNING - languages: - - go + version_id: pZT0305 + shortlink: https://sg.run/Rod2 + source: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key + subcategory: + - vuln + technology: + - jwt + - secrets + vulnerability_class: + - Hard-coded Secrets mode: taint - pattern-sources: - - patterns: - - pattern-inside: '[]byte("$F") - - ' + options: + interfile: true pattern-sinks: - patterns: - pattern-either: - - pattern-inside: '$TOKEN.SignedString($F) - - ' + - pattern-inside: "$TOKEN.SignedString($F)\n" - focus-metavariable: $F + pattern-sources: + - patterns: + - pattern-inside: "[]byte(\"$F\")\n" + severity: WARNING - id: go.lang.security.audit.crypto.bad_imports.insecure-module-used - message: The package `net/http/cgi` is on the import blocklist. The package is vulnerable to httpoxy attacks (CVE-2015-5386). - It is recommended to use `net/http` or a web framework to build a web application instead. + languages: + - go + message: The package `net/http/cgi` is on the import blocklist. The package is vulnerable to httpoxy attacks + (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - source-rule-url: https://github.com/securego/gosec references: - https://godoc.org/golang.org/x/crypto/sha3 - category: security - technology: - - go - confidence: MEDIUM + semgrep.dev: + rule: + origin: community + r_id: 9113 + rule_id: yyUnov + rv_id: 1262921 + url: https://semgrep.dev/playground/r/2KTv2vJ/go.lang.security.audit.crypto.bad_imports.insecure-module-used + version_id: 2KTv2vJ + shortlink: https://sg.run/l2gj + source: https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used + source-rule-url: https://github.com/securego/gosec subcategory: - audit - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - go vulnerability_class: - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used - shortlink: https://sg.run/l2gj - semgrep.dev: - rule: - r_id: 9113 - rv_id: 1262921 - rule_id: yyUnov - version_id: 2KTv2vJ - url: https://semgrep.dev/playground/r/2KTv2vJ/go.lang.security.audit.crypto.bad_imports.insecure-module-used - origin: community - languages: - - go - severity: WARNING pattern-either: - patterns: - - pattern-inside: 'import "net/http/cgi" - - ... - - ' - - pattern: 'cgi.$FUNC(...) - - ' + - pattern-inside: "import \"net/http/cgi\"\n...\n" + - pattern: "cgi.$FUNC(...)\n" + severity: WARNING - id: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key - message: Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' - package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn - more about the problem and how to fix it. + languages: + - go + message: Disabled host key verification detected. This allows man-in-the-middle attacks. Use the + 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See + https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to + fix it. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-322: Key Exchange without Entity Authentication' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/securego/gosec references: - https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ - https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key - shortlink: https://sg.run/Yv6X semgrep.dev: rule: + origin: community r_id: 9114 - rv_id: 1262922 rule_id: r6UrW9 + rv_id: 1262922 + url: + https://semgrep.dev/playground/r/X0TzyzN/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key version_id: X0TzyzN - url: https://semgrep.dev/playground/r/X0TzyzN/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key - origin: community + shortlink: https://sg.run/Yv6X + source: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key + source-rule-url: https://github.com/securego/gosec + subcategory: + - audit + technology: + - go + vulnerability_class: + - Improper Authentication + pattern: ssh.InsecureIgnoreHostKey() + severity: WARNING +- fix: "crypto/rand\n" + id: go.lang.security.audit.crypto.math_random.math-random-used languages: - go - severity: WARNING - pattern: ssh.InsecureIgnoreHostKey() -- id: go.lang.security.audit.crypto.math_random.math-random-used + message: Do not use `math/rand`. Use `crypto/rand` instead. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used - shortlink: https://sg.run/6nK6 semgrep.dev: rule: + origin: community r_id: 9115 - rv_id: 1262923 rule_id: bwUwy8 - version_id: jQTn5nj + rv_id: 1262923 url: https://semgrep.dev/playground/r/jQTn5nj/go.lang.security.audit.crypto.math_random.math-random-used - origin: community - message: Do not use `math/rand`. Use `crypto/rand` instead. - languages: - - go - severity: WARNING + version_id: jQTn5nj + shortlink: https://sg.run/6nK6 + source: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern: 'import $RAND "$MATH" - - ' - - pattern: 'import "$MATH" - - ' + - pattern: "import $RAND \"$MATH\"\n" + - pattern: "import \"$MATH\"\n" - metavariable-regex: metavariable: $MATH regex: ^(math/rand(\/v[0-9]+)*)$ - pattern-either: - - pattern-inside: '... - - rand.$FUNC(...) - - ' - - pattern-inside: '... - - $RAND.$FUNC(...) - - ' + - pattern-inside: "...\nrand.$FUNC(...)\n" + - pattern-inside: "...\n$RAND.$FUNC(...)\n" - focus-metavariable: - $MATH - fix: 'crypto/rand - - ' -- id: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion - message: '`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as + severity: WARNING +- fix: "tls.Config{ $...CONF, MinVersion: tls.VersionTLS13 }\n" + id: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + languages: + - go + message: "`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer - 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13'' to the TLS configuration - to bump the minimum version to TLS 1.3.' + 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration + to bump the minimum version to TLS 1.3." metadata: + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go references: - https://go.dev/doc/go1.22#minor_library_changes - https://pkg.go.dev/crypto/tls#:~:text=MinVersion - https://www.us-cert.gov/ncas/alerts/TA14-290A - category: security - technology: - - go - confidence: HIGH - subcategory: - - audit - likelihood: MEDIUM - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion - shortlink: https://sg.run/oxEN semgrep.dev: rule: + origin: community r_id: 9116 - rv_id: 1262924 rule_id: NbUk4X + rv_id: 1262924 + url: + https://semgrep.dev/playground/r/1QTypyp/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion version_id: 1QTypyp - url: https://semgrep.dev/playground/r/1QTypyp/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion - origin: community - languages: - - go - severity: WARNING + shortlink: https://sg.run/oxEN + source: https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go + subcategory: + - audit + technology: + - go + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: 'tls.Config{ $...CONF } - - ' - - pattern-not: 'tls.Config{..., MinVersion: ..., ...} - - ' - fix: 'tls.Config{ $...CONF, MinVersion: tls.VersionTLS13 } - - ' + - pattern: "tls.Config{ $...CONF }\n" + - pattern-not: "tls.Config{..., MinVersion: ..., ...}\n" + severity: WARNING - id: go.lang.security.audit.crypto.sha224-hash.sha224-hash - pattern-either: - - patterns: - - pattern-inside: 'import "crypto/sha256" - - ... - - ' - - pattern-either: - - pattern: 'sha256.New224() - - ' - - pattern: 'sha256.Sum224(...) - - ' - - patterns: - - pattern-inside: 'import "golang.org/x/crypto/sha3" - - ... - - ' - - pattern-either: - - pattern: 'sha3.New224() - - ' - - pattern: 'sha3.Sum224(...) - - ' - message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating - to a stronger hash function such as SHA-384 or higher to ensure compliance and security. languages: - go - severity: WARNING + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider + updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security. metadata: + category: security + confidence: HIGH + cwe: + - 'CWE-328: Use of Weak Hash' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-328: Use of Weak Hash' - category: security - technology: - - go references: - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/go.lang.security.audit.crypto.sha224-hash.sha224-hash - shortlink: https://sg.run/ReJwY semgrep.dev: rule: + origin: community r_id: 151749 - rv_id: 1262925 rule_id: GdUvElR - version_id: 9lT4b4w + rv_id: 1262925 url: https://semgrep.dev/playground/r/9lT4b4w/go.lang.security.audit.crypto.sha224-hash.sha224-hash - origin: community -- id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure - message: SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use - 'tls.VersionTLS13'. + version_id: 9lT4b4w + shortlink: https://sg.run/ReJwY + source: https://semgrep.dev/r/go.lang.security.audit.crypto.sha224-hash.sha224-hash + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Insecure Hashing Algorithm + pattern-either: + - patterns: + - pattern-inside: "import \"crypto/sha256\"\n...\n" + - pattern-either: + - pattern: "sha256.New224()\n" + - pattern: "sha256.Sum224(...)\n" + - patterns: + - pattern-inside: "import \"golang.org/x/crypto/sha3\"\n...\n" + - pattern-either: + - pattern: "sha3.New224()\n" + - pattern: "sha3.Sum224(...)\n" + severity: WARNING +- fix-regex: + regex: VersionSSL30 + replacement: VersionTLS13 + id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + languages: + - go + message: SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, + use 'tls.VersionTLS13'. metadata: + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go references: - https://golang.org/doc/go1.14#crypto/tls - https://www.us-cert.gov/ncas/alerts/TA14-290A - category: security - technology: - - go - confidence: HIGH - subcategory: - - vuln - likelihood: MEDIUM - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure - shortlink: https://sg.run/zvE1 semgrep.dev: rule: + origin: community r_id: 9117 - rv_id: 1262926 rule_id: kxUkJ2 - version_id: yeTxpxj + rv_id: 1262926 url: https://semgrep.dev/playground/r/yeTxpxj/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure - origin: community - languages: - - go - severity: WARNING - fix-regex: - regex: VersionSSL30 - replacement: VersionTLS13 + version_id: yeTxpxj + shortlink: https://sg.run/zvE1 + source: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cryptographic Issues pattern: 'tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}' + severity: WARNING - id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher - message: Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' - to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other - cipher suites to use. + languages: + - go + message: Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function + 'tls.CipherSuites()' to get a list of good cipher suites. See + https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use. metadata: + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go references: - https://golang.org/pkg/crypto/tls/#InsecureCipherSuites - category: security - technology: - - go - confidence: HIGH - subcategory: - - vuln - likelihood: HIGH - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher - shortlink: https://sg.run/px8N semgrep.dev: rule: + origin: community r_id: 9118 - rv_id: 1262927 rule_id: wdUJYk - version_id: rxTAKAZ + rv_id: 1262927 url: https://semgrep.dev/playground/r/rxTAKAZ/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher - origin: community - languages: - - go - severity: WARNING + version_id: rxTAKAZ + shortlink: https://sg.run/px8N + source: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cryptographic Issues pattern-either: - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}} - - ' - - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...} - - ' + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}}\n" + - pattern: "tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}\n" + severity: WARNING - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES - message: Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use - AES instead. languages: - go - severity: WARNING + message: Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. + Use AES instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - source-rule-url: https://github.com/securego/gosec#available-rules - category: security - technology: - - go references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES - shortlink: https://sg.run/jREA semgrep.dev: rule: + origin: community r_id: 9121 - rv_id: 1262930 rule_id: eqU8B3 - version_id: kbTzGzA + rv_id: 1262930 url: https://semgrep.dev/playground/r/kbTzGzA/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES - origin: community + version_id: kbTzGzA + shortlink: https://sg.run/jREA + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES + source-rule-url: https://github.com/securego/gosec#available-rules + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: 'import "crypto/des" - - ... - - ' + - pattern-inside: "import \"crypto/des\"\n...\n" - pattern-either: - - pattern: 'des.NewTripleDESCipher(...) - - ' - - pattern: 'des.NewCipher(...) - - ' + - pattern: "des.NewTripleDESCipher(...)\n" + - pattern: "des.NewCipher(...)\n" + severity: WARNING - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 - message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use SHA256 or SHA3 instead. languages: - go - severity: WARNING + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-328: Use of Weak Hash' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-328: Use of Weak Hash' - source-rule-url: https://github.com/securego/gosec#available-rules - category: security - technology: - - go - confidence: MEDIUM references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 - shortlink: https://sg.run/2xB5 semgrep.dev: rule: + origin: community r_id: 9119 - rv_id: 1262928 rule_id: x8Un6q - version_id: bZT535Y + rv_id: 1262928 url: https://semgrep.dev/playground/r/bZT535Y/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 - origin: community + version_id: bZT535Y + shortlink: https://sg.run/2xB5 + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 + source-rule-url: https://github.com/securego/gosec#available-rules + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Insecure Hashing Algorithm patterns: - - pattern-inside: 'import "crypto/md5" - - ... - - ' + - pattern-inside: "import \"crypto/md5\"\n...\n" - pattern-either: - - pattern: 'md5.New() - - ' - - pattern: 'md5.Sum(...) - - ' + - pattern: "md5.New()\n" + - pattern: "md5.Sum(...)\n" + severity: WARNING - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 - message: Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead. languages: - go - severity: WARNING + message: Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES + instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - source-rule-url: https://github.com/securego/gosec#available-rules - category: security - technology: - - go references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 - shortlink: https://sg.run/1ZAD semgrep.dev: rule: + origin: community r_id: 9122 - rv_id: 1262931 rule_id: v8Unl0 - version_id: w8TRoRQ + rv_id: 1262931 url: https://semgrep.dev/playground/r/w8TRoRQ/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 - origin: community + version_id: w8TRoRQ + shortlink: https://sg.run/1ZAD + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 + source-rule-url: https://github.com/securego/gosec#available-rules + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: 'import "crypto/rc4" - - ... - - ' + - pattern-inside: "import \"crypto/rc4\"\n...\n" - pattern: rc4.NewCipher(...) + severity: WARNING - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 - message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not - suitable as a cryptographic signature. Use SHA256 or SHA3 instead. languages: - go - severity: WARNING + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore + not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-328: Use of Weak Hash' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-328: Use of Weak Hash' - source-rule-url: https://github.com/securego/gosec#available-rules - category: security - technology: - - go references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 - shortlink: https://sg.run/XBYA semgrep.dev: rule: + origin: community r_id: 9120 - rv_id: 1262929 rule_id: OrU31O - version_id: NdTzyz1 + rv_id: 1262929 url: https://semgrep.dev/playground/r/NdTzyz1/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 - origin: community + version_id: NdTzyz1 + shortlink: https://sg.run/XBYA + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 + source-rule-url: https://github.com/securego/gosec#available-rules + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Insecure Hashing Algorithm patterns: - - pattern-inside: 'import "crypto/sha1" - - ... - - ' + - pattern-inside: "import \"crypto/sha1\"\n...\n" - pattern-either: - - pattern: 'sha1.New() - - ' - - pattern: 'sha1.Sum(...) - - ' -- id: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key - message: RSA keys should be at least 2048 bits + - pattern: "sha1.New()\n" + - pattern: "sha1.Sum(...)\n" + severity: WARNING +- fix: "2048\n" + id: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key languages: - go - severity: WARNING + message: RSA keys should be at least 2048 bits metadata: + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/securego/gosec/blob/master/rules/rsa.go references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms - category: security - technology: - - go - confidence: HIGH - subcategory: - - audit - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key - shortlink: https://sg.run/9oY4 semgrep.dev: rule: + origin: community r_id: 9123 - rv_id: 1262932 rule_id: d8UjY3 + rv_id: 1262932 + url: + https://semgrep.dev/playground/r/xyTjz8L/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key version_id: xyTjz8L - url: https://semgrep.dev/playground/r/xyTjz8L/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key - origin: community + shortlink: https://sg.run/9oY4 + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key + source-rule-url: https://github.com/securego/gosec/blob/master/rules/rsa.go + subcategory: + - audit + technology: + - go + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern: 'rsa.GenerateKey(..., $BITS) - - ' - - pattern: 'rsa.GenerateMultiPrimeKey(..., $BITS) - - ' + - pattern: "rsa.GenerateKey(..., $BITS)\n" + - pattern: "rsa.GenerateMultiPrimeKey(..., $BITS)\n" - metavariable-comparison: - metavariable: $BITS comparison: $BITS < 2048 + metavariable: $BITS - focus-metavariable: - $BITS - fix: '2048 - - ' + severity: WARNING - id: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd - patterns: - - pattern-either: - - patterns: - - pattern: 'exec.Cmd {...,Path: $CMD,...} - - ' - - pattern-not: 'exec.Cmd {...,Path: "...",...} - - ' - - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); - - ... - - ' - - pattern-not-inside: '$CMD = "..."; - - ... - - ' - - patterns: - - pattern: 'exec.Cmd {...,Args: $ARGS,...} - - ' - - pattern-not: 'exec.Cmd {...,Args: []string{...},...} - - ' - - pattern-not-inside: '$ARGS = []string{"...",...}; - - ... - - ' - - pattern-not-inside: '$CMD = "..."; - - ... - - $ARGS = []string{$CMD,...}; - - ... - - ' - - pattern-not-inside: '$CMD = exec.LookPath("..."); - - ... - - $ARGS = []string{$CMD,...}; - - ... - - ' - - patterns: - - pattern: 'exec.Cmd {...,Args: []string{$CMD,...},...} - - ' - - pattern-not: 'exec.Cmd {...,Args: []string{"...",...},...} - - ' - - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); - - ... - - ' - - pattern-not-inside: '$CMD = "..."; - - ... - - ' - - patterns: - - pattern-either: - - pattern: 'exec.Cmd {...,Args: []string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...},...} - - ' - - patterns: - - pattern: 'exec.Cmd {...,Args: []string{$CMD,"-c",$EXE,...},...} - - ' - - pattern-inside: '$CMD,$ERR := exec.LookPath("=~/(sh|bash|ksh|csh|tcsh|zsh)/"); - - ... - - ' - - pattern-not: 'exec.Cmd {...,Args: []string{"...","...","...",...},...} - - ' - - pattern-not-inside: '$EXE = "..."; - - ... - - ' - - pattern-inside: 'import "os/exec" - - ... - - ' - message: Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this - call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary - code. + languages: + - go + message: Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach + this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute + arbitrary code. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - go - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - subcategory: - - audit - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd - shortlink: https://sg.run/Dorj semgrep.dev: rule: + origin: community r_id: 9108 - rv_id: 1262934 rule_id: 2ZUb8l - version_id: e1Tyjeg + rv_id: 1262934 url: https://semgrep.dev/playground/r/e1Tyjeg/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd - origin: community + version_id: e1Tyjeg + shortlink: https://sg.run/Dorj + source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd + subcategory: + - audit + technology: + - go + vulnerability_class: + - Code Injection + patterns: + - pattern-either: + - patterns: + - pattern: "exec.Cmd {...,Path: $CMD,...}\n" + - pattern-not: "exec.Cmd {...,Path: \"...\",...}\n" + - pattern-not-inside: "$CMD,$ERR := exec.LookPath(\"...\");\n...\n" + - pattern-not-inside: "$CMD = \"...\";\n...\n" + - patterns: + - pattern: "exec.Cmd {...,Args: $ARGS,...}\n" + - pattern-not: "exec.Cmd {...,Args: []string{...},...}\n" + - pattern-not-inside: "$ARGS = []string{\"...\",...};\n...\n" + - pattern-not-inside: "$CMD = \"...\";\n...\n$ARGS = []string{$CMD,...};\n...\n" + - pattern-not-inside: "$CMD = exec.LookPath(\"...\");\n...\n$ARGS = []string{$CMD,...};\n...\n" + - patterns: + - pattern: "exec.Cmd {...,Args: []string{$CMD,...},...}\n" + - pattern-not: "exec.Cmd {...,Args: []string{\"...\",...},...}\n" + - pattern-not-inside: "$CMD,$ERR := exec.LookPath(\"...\");\n...\n" + - pattern-not-inside: "$CMD = \"...\";\n...\n" + - patterns: + - pattern-either: + - pattern: "exec.Cmd {...,Args: []string{\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\",$EXE,...},...}\n" + - patterns: + - pattern: "exec.Cmd {...,Args: []string{$CMD,\"-c\",$EXE,...},...}\n" + - pattern-inside: "$CMD,$ERR := exec.LookPath(\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\");\n...\n" + - pattern-not: "exec.Cmd {...,Args: []string{\"...\",\"...\",\"...\",...},...}\n" + - pattern-not-inside: "$EXE = \"...\";\n...\n" + - pattern-inside: "import \"os/exec\"\n...\n" severity: ERROR - languages: - - go - id: go.lang.security.audit.md5-used-as-password.md5-used-as-password languages: - go - severity: WARNING - message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked - by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` - package. - options: - interfile: true + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be + cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can + use the `golang.org/x/crypto/bcrypt` package. metadata: category: security - technology: - - md5 - references: - - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html - - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords - - https://github.com/returntocorp/semgrep-rules/issues/1609 - - https://pkg.go.dev/golang.org/x/crypto/bcrypt - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM impact: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password - shortlink: https://sg.run/4eOE + likelihood: MEDIUM + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html + - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords + - https://github.com/returntocorp/semgrep-rules/issues/1609 + - https://pkg.go.dev/golang.org/x/crypto/bcrypt semgrep.dev: rule: + origin: community r_id: 14688 - rv_id: 1262938 rule_id: 4bU1Wj - version_id: nWT2L9r + rv_id: 1262938 url: https://semgrep.dev/playground/r/nWT2L9r/go.lang.security.audit.md5-used-as-password.md5-used-as-password - origin: community + version_id: nWT2L9r + shortlink: https://sg.run/4eOE + source: https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password + subcategory: + - vuln + technology: + - md5 + vulnerability_class: + - Cryptographic Issues mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: md5.New - - pattern: md5.Sum + options: + interfile: true pattern-sinks: - patterns: - pattern: $FUNCTION(...) - metavariable-regex: metavariable: $FUNCTION regex: (?i)(.*password.*) + pattern-sources: + - patterns: + - pattern-either: + - pattern: md5.New + - pattern: md5.Sum + severity: WARNING - id: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces - message: Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server - publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty - string. languages: - go - severity: WARNING + message: Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the + server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor + the empty string. metadata: + category: security + confidence: HIGH cwe: - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - source-rule-url: https://github.com/securego/gosec - category: security - technology: - - go - confidence: HIGH references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces - shortlink: https://sg.run/rdE0 semgrep.dev: rule: + origin: community r_id: 9125 - rv_id: 1262939 rule_id: nJUz3J - version_id: ExTExoK + rv_id: 1262939 url: https://semgrep.dev/playground/r/ExTExoK/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces - origin: community + version_id: ExTExoK + shortlink: https://sg.run/rdE0 + source: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces + source-rule-url: https://github.com/securego/gosec + subcategory: + - audit + technology: + - go + vulnerability_class: + - Mishandled Sensitive Information pattern-either: - pattern: tls.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) - pattern: net.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) - pattern: tls.Listen($NETWORK, "=~/^:.*$/", ...) - pattern: net.Listen($NETWORK, "=~/^:.*$/", ...) -- id: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly - patterns: - - pattern-not-inside: "http.Cookie{\n ...,\n HttpOnly: true,\n ...,\n}\n" - - pattern: "http.Cookie{\n ...,\n}\n" - message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the - browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by - setting 'HttpOnly' to 'true' in the Cookie. + severity: WARNING +- fix-regex: + regex: (HttpOnly\s*:\s+)false + replacement: \1true + id: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + languages: + - go + message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs + the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' + flag by setting 'HttpOnly' to 'true' in the Cookie. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go - https://golang.org/src/net/http/cookie.go - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - vuln - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly - shortlink: https://sg.run/b73e semgrep.dev: rule: + origin: community r_id: 9126 - rv_id: 1262940 rule_id: EwU2Z6 + rv_id: 1262940 + url: + https://semgrep.dev/playground/r/7ZTE3BW/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly version_id: 7ZTE3BW - url: https://semgrep.dev/playground/r/7ZTE3BW/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly - origin: community - fix-regex: - regex: (HttpOnly\s*:\s+)false - replacement: \1true + shortlink: https://sg.run/b73e + source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cookie Security + patterns: + - pattern-not-inside: "http.Cookie{\n ...,\n HttpOnly: true,\n ...,\n}\n" + - pattern: "http.Cookie{\n ...,\n}\n" severity: WARNING +- fix-regex: + regex: (Secure\s*:\s+)false + replacement: \1true + id: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure languages: - go -- id: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure - patterns: - - pattern-not-inside: "http.Cookie{\n ...,\n Secure: true,\n ...,\n}\n" - - pattern: "http.Cookie{\n ...,\n}\n" - message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client - from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' - in the Options struct. + message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the + client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' + to 'true' in the Options struct. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go - https://golang.org/src/net/http/cookie.go - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - vuln - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure - shortlink: https://sg.run/N4G7 semgrep.dev: rule: + origin: community r_id: 9127 - rv_id: 1262941 rule_id: 7KUQ8X + rv_id: 1262941 + url: + https://semgrep.dev/playground/r/LjTkgGE/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure version_id: LjTkgGE - url: https://semgrep.dev/playground/r/LjTkgGE/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure - origin: community - fix-regex: - regex: (Secure\s*:\s+)false - replacement: \1true + shortlink: https://sg.run/N4G7 + source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cookie Security + patterns: + - pattern-not-inside: "http.Cookie{\n ...,\n Secure: true,\n ...,\n}\n" + - pattern: "http.Cookie{\n ...,\n}\n" severity: WARNING +- id: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace languages: - go -- id: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace - message: Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for - '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events - occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined. + message: Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition + for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request + events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically + defined. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-913: Improper Control of Dynamically-Managed Code Resources' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://github.com/returntocorp/semgrep-rules/issues/518 - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - vuln - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace - shortlink: https://sg.run/kXEK semgrep.dev: rule: + origin: community r_id: 9128 - rv_id: 1262942 rule_id: L1Uyjp + rv_id: 1262942 + url: + https://semgrep.dev/playground/r/8KT5rNv/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace version_id: 8KT5rNv - url: https://semgrep.dev/playground/r/8KT5rNv/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace - origin: community + shortlink: https://sg.run/kXEK + source: https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Code Injection patterns: - - pattern-not-inside: 'package $PACKAGE - - ... - - &httptrace.ClientTrace { ... } - - ... - - ' + - pattern-not-inside: "package $PACKAGE\n...\n&httptrace.ClientTrace { ... }\n...\n" - pattern: httptrace.WithClientTrace($ANY, $TRACE) severity: WARNING +- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string languages: - go -- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string - message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely - sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. + message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be + absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may + have a XSS vulnerability. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://golang.org/pkg/html/template/#HTML - category: security - technology: - - go - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string - shortlink: https://sg.run/weE0 semgrep.dev: rule: + origin: community r_id: 9129 - rv_id: 1262943 rule_id: 8GUjDW + rv_id: 1262943 + url: + https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string version_id: gETB7Pe - url: https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string - origin: community - languages: - - go - severity: WARNING + shortlink: https://sg.run/weE0 + source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string + subcategory: + - audit + technology: + - go + vulnerability_class: + - Cross-Site-Scripting (XSS) patterns: - pattern-not: template.HTML("..." + "...") - pattern-either: - pattern: template.HTML($T + $X, ...) - pattern: template.HTML(fmt.$P("...", ...), ...) - - pattern: '$T = "..." - - ... - - $T = $FXN(..., $T, ...) - - ... - - template.HTML($T, ...) - - ' - - pattern: '$T = fmt.$P("...", ...) - - ... - - template.HTML($T, ...) - - ' - - pattern: '$T, $ERR = fmt.$P("...", ...) - - ... - - template.HTML($T, ...) - - ' - - pattern: '$T = $X + $Y - - ... - - template.HTML($T, ...) - - ' - - pattern: '$T = "..." - - ... - - $OTHER, $ERR = fmt.$P(..., $T, ...) - - ... - - template.HTML($OTHER, ...)' -- id: go.lang.security.audit.net.fs-directory-listing.fs-directory-listing - message: 'Detected usage of ''http.FileServer'' as handler: this allows directory listing and an attacker could navigate - through directories looking for sensitive files. Be sure to disable directory listing or restrict access to specific directories/files.' + - pattern: "$T = \"...\"\n...\n$T = $FXN(..., $T, ...)\n...\ntemplate.HTML($T, ...)\n" + - pattern: "$T = fmt.$P(\"...\", ...)\n...\ntemplate.HTML($T, ...)\n" + - pattern: "$T, $ERR = fmt.$P(\"...\", ...)\n...\ntemplate.HTML($T, ...)\n" + - pattern: "$T = $X + $Y\n...\ntemplate.HTML($T, ...)\n" + - pattern: "$T = \"...\"\n...\n$OTHER, $ERR = fmt.$P(..., $T, ...)\n...\ntemplate.HTML($OTHER, ...)" severity: WARNING +- id: go.lang.security.audit.net.fs-directory-listing.fs-directory-listing languages: - go - patterns: - - pattern-either: - - patterns: - - pattern-inside: '$FS := http.FileServer(...) - - ... - - ' - - pattern-either: - - pattern: 'http.ListenAndServe(..., $FS) - - ' - - pattern: 'http.ListenAndServeTLS(..., $FS) - - ' - - pattern: 'http.Handle(..., $FS) - - ' - - pattern: 'http.HandleFunc(..., $FS) - - ' - - patterns: - - pattern: 'http.$FN(..., http.FileServer(...)) - - ' - - metavariable-regex: - metavariable: $FN - regex: (ListenAndServe|ListenAndServeTLS|Handle|HandleFunc) + message: "Detected usage of 'http.FileServer' as handler: this allows directory listing and an attacker could navigate through + directories looking for sensitive files. Be sure to disable directory listing or restrict access to specific directories/files." metadata: category: security + confidence: MEDIUM cwe: - 'CWE-548: Exposure of Information Through Directory Listing' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A06:2017 - Security Misconfiguration - A01:2021 - Broken Access Control @@ -1887,357 +1553,294 @@ rules: references: - https://github.com/OWASP/Go-SCP - https://cwe.mitre.org/data/definitions/548.html - confidence: MEDIUM - technology: - - go - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing - shortlink: https://sg.run/4R8x semgrep.dev: rule: + origin: community r_id: 21300 - rv_id: 1262944 rule_id: 5rU9JO + rv_id: 1262944 + url: + https://semgrep.dev/playground/r/QkTGqX0/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing version_id: QkTGqX0 - url: https://semgrep.dev/playground/r/QkTGqX0/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing - origin: community -- id: go.lang.security.audit.net.use-tls.use-tls - pattern: http.ListenAndServe($ADDR, $HANDLER) - fix: http.ListenAndServeTLS($ADDR, certFile, keyFile, $HANDLER) + shortlink: https://sg.run/4R8x + source: https://semgrep.dev/r/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Mishandled Sensitive Information + patterns: + - pattern-either: + - patterns: + - pattern-inside: "$FS := http.FileServer(...)\n...\n" + - pattern-either: + - pattern: "http.ListenAndServe(..., $FS)\n" + - pattern: "http.ListenAndServeTLS(..., $FS)\n" + - pattern: "http.Handle(..., $FS)\n" + - pattern: "http.HandleFunc(..., $FS)\n" + - patterns: + - pattern: "http.$FN(..., http.FileServer(...))\n" + - metavariable-regex: + metavariable: $FN + regex: (ListenAndServe|ListenAndServeTLS|Handle|HandleFunc) + severity: WARNING +- fix: http.ListenAndServeTLS($ADDR, certFile, keyFile, $HANDLER) + id: go.lang.security.audit.net.use-tls.use-tls + languages: + - go + message: Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See + https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://golang.org/pkg/net/http/#ListenAndServeTLS - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls - shortlink: https://sg.run/dKbY semgrep.dev: rule: + origin: community r_id: 9134 - rv_id: 1262948 rule_id: PeUZ8X - version_id: JdTzxkn + rv_id: 1262948 url: https://semgrep.dev/playground/r/JdTzxkn/go.lang.security.audit.net.use-tls.use-tls - origin: community - message: Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS - for more information. - languages: - - go + version_id: JdTzxkn + shortlink: https://sg.run/dKbY + source: https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls + subcategory: + - audit + technology: + - go + vulnerability_class: + - Mishandled Sensitive Information + pattern: http.ListenAndServe($ADDR, $HANDLER) severity: WARNING - id: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf - patterns: - - pattern-inside: "func $FUNC(..., $W http.ResponseWriter, ...) {\n ...\n var $TEMPLATE = \"...\"\n ...\n $W.Write([]byte(fmt.$PRINTF($TEMPLATE,\ - \ ...)), ...)\n ...\n}\n" - - pattern-either: - - pattern: '$PARAMS = r.URL.Query() - - ... - - $DATA, $ERR := $PARAMS[...] - - ... - - $INTERM = $ANYTHING(..., $DATA, ...) - - ... - - $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - - ' - - pattern: '$PARAMS = r.URL.Query() - - ... - - $DATA, $ERR := $PARAMS[...] - - ... - - $INTERM = $DATA[...] - - ... - - $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - - ' - - pattern: '$DATA, $ERR := r.URL.Query()[...] - - ... - - $INTERM = $DATA[...] - - ... - - $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - - ' - - pattern: '$DATA, $ERR := r.URL.Query()[...] - - ... - - $INTERM = $ANYTHING(..., $DATA, ...) - - ... - - $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - - ' - - pattern: '$PARAMS = r.URL.Query() - - ... - - $DATA, $ERR := $PARAMS[...] - - ... - - $W.Write([]byte(fmt.$PRINTF(..., $DATA, ...))) - - ' - message: Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and - should not be done. If you must do this, ensure your data is sanitized or escaped. + languages: + - go + message: Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS + and should not be done. If you must do this, ensure your data is sanitized or escaped. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - go - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf - shortlink: https://sg.run/Zvon semgrep.dev: rule: + origin: community r_id: 9135 - rv_id: 1262949 rule_id: JDUyXB + rv_id: 1262949 + url: + https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf version_id: 5PTo1qr - url: https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf - origin: community + shortlink: https://sg.run/Zvon + source: + https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cross-Site-Scripting (XSS) + patterns: + - pattern-inside: "func $FUNC(..., $W http.ResponseWriter, ...) {\n ...\n var $TEMPLATE = \"...\"\n ...\n $W.Write([]byte(fmt.$PRINTF($TEMPLATE, + ...)), ...)\n ...\n}\n" + - pattern-either: + - pattern: "$PARAMS = r.URL.Query()\n...\n$DATA, $ERR := $PARAMS[...]\n...\n$INTERM = $ANYTHING(..., $DATA, ...)\n...\n\ + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))\n" + - pattern: "$PARAMS = r.URL.Query()\n...\n$DATA, $ERR := $PARAMS[...]\n...\n$INTERM = $DATA[...]\n...\n$W.Write([]byte(fmt.$PRINTF(..., + $INTERM, ...)))\n" + - pattern: "$DATA, $ERR := r.URL.Query()[...]\n...\n$INTERM = $DATA[...]\n...\n$W.Write([]byte(fmt.$PRINTF(..., $INTERM, + ...)))\n" + - pattern: "$DATA, $ERR := r.URL.Query()[...]\n...\n$INTERM = $ANYTHING(..., $DATA, ...)\n...\n$W.Write([]byte(fmt.$PRINTF(..., + $INTERM, ...)))\n" + - pattern: "$PARAMS = r.URL.Query()\n...\n$DATA, $ERR := $PARAMS[...]\n...\n$W.Write([]byte(fmt.$PRINTF(..., $DATA, ...)))\n" severity: WARNING - languages: - - go - id: go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface languages: - go - message: Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security vulnerabilities - (CWE-502). Use a concrete struct type instead. - severity: WARNING + message: Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security + vulnerabilities (CWE-502). Use a concrete struct type instead. metadata: + category: security + confidence: HIGH cwe: - 'CWE-502: Deserialization of Untrusted Data' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - category: security - technology: - - go - confidence: HIGH - likelihood: MEDIUM - impact: HIGH - subcategory: - - vuln references: - https://cwe.mitre.org/data/definitions/502.html - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface - shortlink: https://sg.run/6WbKL semgrep.dev: rule: + origin: community r_id: 274359 - rv_id: 1409387 rule_id: 4bUAQDG + rv_id: 1409387 + url: + https://semgrep.dev/playground/r/ZRTDkjk/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface version_id: ZRTDkjk - url: https://semgrep.dev/playground/r/ZRTDkjk/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface - origin: community + shortlink: https://sg.run/6WbKL + source: + https://semgrep.dev/r/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface + subcategory: + - vuln + technology: + - go + vulnerability_class: + - 'Insecure Deserialization ' patterns: - pattern-either: - - pattern: 'var $VAR interface{} - - ... - - json.Unmarshal($DATA, &$VAR) - - ' - - pattern: 'var $VAR interface{} - - ... - - yaml.Unmarshal($DATA, &$VAR) - - ' - - pattern: 'var $VAR interface{} - - ... - - xml.Unmarshal($DATA, &$VAR) - - ' -- id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse + - pattern: "var $VAR interface{}\n...\njson.Unmarshal($DATA, &$VAR)\n" + - pattern: "var $VAR interface{}\n...\nyaml.Unmarshal($DATA, &$VAR)\n" + - pattern: "var $VAR interface{}\n...\nxml.Unmarshal($DATA, &$VAR)\n" + severity: WARNING +- fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/"))) + id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse + languages: + - go message: '`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path, "/")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.' - severity: ERROR - languages: - - go - mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' - - metavariable-regex: - metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ - pattern-sinks: - - patterns: - - pattern-either: - - pattern: filepath.Clean($...INNER) - - pattern: path.Clean($...INNER) - pattern-sanitizers: - - pattern-either: - - pattern: '"/" + ... - - ' - fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/"))) - options: - interfile: true metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control references: - https://pkg.go.dev/path#Clean - http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html - https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/ - https://dzx.cz/2021/04/02/go_path_traversal/ - https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme - cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' - owasp: - - A05:2017 - Broken Access Control - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - category: security - technology: - - go - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse - shortlink: https://sg.run/ZKzw semgrep.dev: rule: + origin: community r_id: 18235 - rv_id: 1262967 rule_id: qNUQJe - version_id: jQTn5Bj + rv_id: 1262967 url: https://semgrep.dev/playground/r/jQTn5Bj/go.lang.security.filepath-clean-misuse.filepath-clean-misuse - origin: community + version_id: jQTn5Bj + shortlink: https://sg.run/ZKzw + source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Path Traversal + mode: taint + options: + interfile: true + pattern-sanitizers: + - pattern-either: + - pattern: "\"/\" + ...\n" + pattern-sinks: + - patterns: + - pattern-either: + - pattern: filepath.Clean($...INNER) + - pattern: path.Clean($...INNER) + pattern-sources: + - patterns: + - pattern-either: + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" + - metavariable-regex: + metavariable: $ANYTHING + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + severity: ERROR - id: go.lang.security.injection.open-redirect.open-redirect languages: - go - severity: WARNING - message: An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, - potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input - to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices - to restrict the URL to domains in an allowlist. - options: - interfile: true + message: An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect + vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where + possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is + recommended to follow OWASP best practices to restrict the URL to domains in an allowlist. metadata: - cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' - references: - - https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html category: security - technology: - - go confidence: HIGH + cwe: + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" description: An HTTP redirect was found to be crafted from user-input leading to an open redirect vulnerability - subcategory: - - vuln impact: MEDIUM - likelihood: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect - shortlink: https://sg.run/2ZW45 + likelihood: MEDIUM + references: + - https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html semgrep.dev: rule: + origin: community r_id: 113619 - rv_id: 945608 rule_id: DbU6RlN - version_id: GxTP7J7 + rv_id: 945608 url: https://semgrep.dev/playground/r/GxTP7J7/go.lang.security.injection.open-redirect.open-redirect - origin: community + version_id: GxTP7J7 + shortlink: https://sg.run/2ZW45 + source: https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Open Redirect mode: taint + options: + interfile: true + pattern-sinks: + - patterns: + - pattern: http.Redirect($W, $REQ, $URL, ...) + - focus-metavariable: $URL + requires: INPUT and not CLEAN pattern-sources: - label: INPUT patterns: - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" - metavariable-regex: metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ - label: CLEAN - requires: INPUT patterns: - pattern-either: - - pattern: '"$URLSTR" + $INPUT - - ' + - pattern: "\"$URLSTR\" + $INPUT\n" - patterns: - pattern-either: - pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...) @@ -2246,64 +1849,48 @@ rules: - metavariable-regex: metavariable: $URLSTR regex: .*//[a-zA-Z0-10]+\..* - pattern-sinks: - - requires: INPUT and not CLEAN - patterns: - - pattern: http.Redirect($W, $REQ, $URL, ...) - - focus-metavariable: $URL + requires: INPUT + severity: WARNING - id: go.lang.security.injection.raw-html-format.raw-html-format languages: - go - severity: WARNING - message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods - of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could - let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect - that the HTML is rendered safely. + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure + methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, + which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML + instead, or inspect that the HTML is rendered safely. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - go references: - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format - shortlink: https://sg.run/3r1G semgrep.dev: rule: + origin: community r_id: 14443 - rv_id: 1262968 rule_id: PeUonQ - version_id: 1QTyp2p + rv_id: 1262968 url: https://semgrep.dev/playground/r/1QTyp2p/go.lang.security.injection.raw-html-format.raw-html-format - origin: community + version_id: 1QTyp2p + shortlink: https://sg.run/3r1G + source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' - - metavariable-regex: - metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ pattern-sanitizers: - pattern: html.EscapeString(...) pattern-sinks: @@ -2314,21 +1901,37 @@ rules: - pattern: fmt.Fprintf($W, "$HTMLSTR", ...) - pattern: '"$HTMLSTR" + ...' - metavariable-pattern: - metavariable: $HTMLSTR language: generic + metavariable: $HTMLSTR pattern: <$TAG ... + pattern-sources: + - patterns: + - pattern-either: + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" + - metavariable-regex: + metavariable: $ANYTHING + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + severity: WARNING - id: go.lang.security.injection.tainted-sql-string.tainted-sql-string languages: - go - message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using - prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of - SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements - (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library. - options: - interfile: true + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings + using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible + indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use + prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library. metadata: + category: security + confidence: HIGH cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -2336,75 +1939,42 @@ rules: references: - https://golang.org/doc/database/sql-injection - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/ - category: security - technology: - - go - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/PbEq semgrep.dev: rule: + origin: community r_id: 14689 - rv_id: 1409388 rule_id: PeUoqy - version_id: nWTQ5qD + rv_id: 1409388 url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string - origin: community + version_id: nWTQ5qD + shortlink: https://sg.run/PbEq + source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - go + vulnerability_class: + - SQL Injection mode: taint - severity: ERROR - pattern-sources: - - patterns: - - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' - - metavariable-regex: - metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + options: + interfile: true + pattern-sanitizers: + - pattern-either: + - pattern: strconv.Atoi(...) + - pattern: "($X: bool)\n" pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - - pattern: '"$SQLSTR" + ... - - ' + - pattern: "\"$SQLSTR\" + ...\n" - patterns: - - pattern-inside: '$VAR = "$SQLSTR"; - - ... - - ' + - pattern-inside: "$VAR = \"$SQLSTR\";\n...\n" - pattern: $VAR += ... - patterns: - - pattern-inside: 'var $SB strings.Builder - - ... - - ' - - pattern-inside: '$SB.WriteString("$SQLSTR") - - ... - - $SB.String(...) - - ' - - pattern: '$SB.WriteString(...) - - ' + - pattern-inside: "var $SB strings.Builder\n...\n" + - pattern-inside: "$SB.WriteString(\"$SQLSTR\")\n...\n$SB.String(...)\n" + - pattern: "$SB.WriteString(...)\n" - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop).* @@ -2416,74 +1986,91 @@ rules: - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* - pattern-sanitizers: - - pattern-either: - - pattern: strconv.Atoi(...) - - pattern: '($X: bool) - - ' + pattern-sources: + - patterns: + - pattern-either: + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" + - metavariable-regex: + metavariable: $ANYTHING + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + severity: ERROR - id: go.lang.security.injection.tainted-url-host.tainted-url-host languages: - go - message: A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) - vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft - the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the - request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist. - options: - interfile: true + message: A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery + (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input + to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to + craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist. metadata: + category: security + confidence: HIGH cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://goteleport.com/blog/ssrf-attacks/ - category: security - technology: - - go - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host - shortlink: https://sg.run/5DjW semgrep.dev: rule: + origin: community r_id: 14391 - rv_id: 1262970 rule_id: AbUQLr - version_id: yeTxpOj + rv_id: 1262970 url: https://semgrep.dev/playground/r/yeTxpOj/go.lang.security.injection.tainted-url-host.tainted-url-host - origin: community + version_id: yeTxpOj + shortlink: https://sg.run/5DjW + source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint + options: + interfile: true + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - patterns: + - pattern-inside: "$CLIENT := &http.Client{...}\n...\n" + - pattern: $CLIENT.$METHOD($URL, ...) + - pattern: http.$METHOD($URL, ...) + - metavariable-regex: + metavariable: $METHOD + regex: ^(Get|Head|Post|PostForm)$ + - patterns: + - pattern: "http.NewRequest(\"$METHOD\", $URL, ...)\n" + - metavariable-regex: + metavariable: $METHOD + regex: ^(GET|HEAD|POST|POSTFORM)$ + - focus-metavariable: $URL + requires: INPUT and not CLEAN pattern-sources: - label: INPUT patterns: - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" - metavariable-regex: metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ - label: CLEAN - requires: INPUT patterns: - pattern-either: - - pattern: '"$URLSTR" + $INPUT - - ' + - pattern: "\"$URLSTR\" + $INPUT\n" - patterns: - pattern-either: - pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...) @@ -2492,73 +2079,44 @@ rules: - metavariable-regex: metavariable: $URLSTR regex: .*//[a-zA-Z0-10]+\..* - pattern-sinks: - - requires: INPUT and not CLEAN - patterns: - - pattern-either: - - patterns: - - pattern-either: - - patterns: - - pattern-inside: '$CLIENT := &http.Client{...} - - ... - - ' - - pattern: $CLIENT.$METHOD($URL, ...) - - pattern: http.$METHOD($URL, ...) - - metavariable-regex: - metavariable: $METHOD - regex: ^(Get|Head|Post|PostForm)$ - - patterns: - - pattern: 'http.NewRequest("$METHOD", $URL, ...) - - ' - - metavariable-regex: - metavariable: $METHOD - regex: ^(GET|HEAD|POST|POSTFORM)$ - - focus-metavariable: $URL + requires: INPUT severity: WARNING - id: go.lang.security.reverseproxy-director.reverseproxy-director - message: ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director. languages: - go - severity: WARNING - patterns: - - pattern-inside: 'import "net/http/httputil" - - ... - - ' - - pattern-either: - - pattern: $PROXY.Director = $FUNC - - patterns: - - pattern-inside: "httputil.ReverseProxy{\n ...\n}\n" - - pattern: 'Director: $FUNC - - ' + message: ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of + ReverseProxy.Director. metadata: - cwe: - - 'CWE-115: Misinterpretation of Input' category: security - subcategory: - - audit - technology: - - go confidence: MEDIUM - likelihood: LOW + cwe: + - 'CWE-115: Misinterpretation of Input' impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW references: - https://github.com/golang/go/issues/50580 - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director - shortlink: https://sg.run/9AYYR semgrep.dev: rule: + origin: community r_id: 146567 - rv_id: 945612 rule_id: zdUKzzA - version_id: DkTNpvx + rv_id: 945612 url: https://semgrep.dev/playground/r/DkTNpvx/go.lang.security.reverseproxy-director.reverseproxy-director - origin: community + version_id: DkTNpvx + shortlink: https://sg.run/9AYYR + source: https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director + subcategory: + - audit + technology: + - go + vulnerability_class: + - Other + patterns: + - pattern-inside: "import \"net/http/httputil\"\n...\n" + - pattern-either: + - pattern: $PROXY.Director = $FUNC + - patterns: + - pattern-inside: "httputil.ReverseProxy{\n ...\n}\n" + - pattern: "Director: $FUNC\n" + severity: WARNING diff --git a/.semgrep/registry/javascript.yaml b/.semgrep/registry/javascript.yaml index 58b096d..e67a1a5 100644 --- a/.semgrep/registry/javascript.yaml +++ b/.semgrep/registry/javascript.yaml @@ -5,47 +5,62 @@ # (the semgrep-registry-update workflow does this on a schedule). rules: - id: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint - message: Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It - is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved - it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize. + languages: + - javascript + - typescript + message: Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. + It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be + preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize. metadata: + category: security confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - references: - - https://docs.angularjs.org/api/ng/function/angular.element - - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf - category: security - technology: - - angularjs + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint - shortlink: https://sg.run/5AQ0 + references: + - https://docs.angularjs.org/api/ng/function/angular.element + - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf semgrep.dev: rule: + origin: community r_id: 21503 - rv_id: 1263091 rule_id: GdUP71 + rv_id: 1263091 + url: + https://semgrep.dev/playground/r/44TEj8L/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint version_id: 44TEj8L - url: https://semgrep.dev/playground/r/44TEj8L/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/5AQ0 + source: https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint + subcategory: + - vuln + technology: + - angularjs + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern: $sce.getTrustedHtml(...) + - pattern: $sanitize(...) + - pattern: DOMPurify.sanitize(...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "angular.element(...). ... .$SINK($QUERY)\n" + - pattern-inside: "$ANGULAR = angular.element(...)\n...\n$ANGULAR. ... .$SINK($QUERY)\n" + - metavariable-regex: + metavariable: $SINK + regex: ^(after|append|html|prepend|replaceWith|wrap)$ + - focus-metavariable: $QUERY pattern-sources: - patterns: - pattern-either: @@ -78,248 +93,193 @@ rules: metavariable: $METHOD regex: ^(get|delete|head|jsonp|post|put|patch) - pattern: $RES.data - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: 'angular.element(...). ... .$SINK($QUERY) - - ' - - pattern-inside: '$ANGULAR = angular.element(...) - - ... - - $ANGULAR. ... .$SINK($QUERY) - - ' - - metavariable-regex: - metavariable: $SINK - regex: ^(after|append|html|prepend|replaceWith|wrap)$ - - focus-metavariable: $QUERY - pattern-sanitizers: - - patterns: - - pattern-either: - - pattern: $sce.getTrustedHtml(...) - - pattern: $sanitize(...) - - pattern: DOMPurify.sanitize(...) + severity: WARNING - id: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled - message: $sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide - additional attack surface for XSS vulnerabilities. + languages: + - javascript + - typescript + message: $sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could + provide additional attack surface for XSS vulnerabilities. metadata: - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - references: - - https://docs.angularjs.org/api/ng/service/$sce - - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf category: security - technology: - - angular + confidence: HIGH + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled - shortlink: https://sg.run/N4DG + references: + - https://docs.angularjs.org/api/ng/service/$sce + - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf semgrep.dev: rule: + origin: community r_id: 9227 - rv_id: 1263094 rule_id: EwU20Z + rv_id: 1263094 + url: + https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled version_id: 5PTo1EW - url: https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled - origin: community + shortlink: https://sg.run/N4DG + source: https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled + subcategory: + - vuln + technology: + - angular + vulnerability_class: + - Cross-Site-Scripting (XSS) + pattern: "$sceProvider.enabled(false);\n" + severity: ERROR +- id: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method languages: - javascript - typescript - severity: ERROR - pattern: '$sceProvider.enabled(false); - - ' -- id: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method message: The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API. metadata: - references: - - https://docs.angularjs.org/api/ng/service/$sce - - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - technology: - - angular + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method - shortlink: https://sg.run/OPW2 + references: + - https://docs.angularjs.org/api/ng/service/$sce + - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf semgrep.dev: rule: + origin: community r_id: 9231 - rv_id: 1263098 rule_id: gxU1QX + rv_id: 1263098 + url: + https://semgrep.dev/playground/r/BjTkZv0/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method version_id: BjTkZv0 - url: https://semgrep.dev/playground/r/BjTkZv0/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/OPW2 + source: + https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method + subcategory: + - vuln + technology: + - angular + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-inside: 'app.controller(..., function($scope,$sce) { - - ... - - }); - - ' - - pattern: $scope.$X pattern-sinks: - pattern: $sce.trustAs(...) - pattern: $sce.trustAsHtml(...) + pattern-sources: + - patterns: + - pattern-inside: "app.controller(..., function($scope,$sce) {\n...\n});\n" + - pattern: $scope.$X + severity: WARNING - id: javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config - message: Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee - an adversary has no direct access to the computing environment. + languages: + - javascript + - typescript + message: Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can + guarantee an adversary has no direct access to the computing environment. metadata: - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html - - https://eprint.iacr.org/2016/759.pdf - - https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf - - https://datatracker.ietf.org/doc/html/rfc9106#section-4 category: security + confidence: MEDIUM cwe: - 'CWE-916: Use of Password Hash With Insufficient Computational Effort' - technology: - - argon2 - - cryptography + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - impact: LOW - likelihood: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config - shortlink: https://sg.run/ALq4 + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html + - https://eprint.iacr.org/2016/759.pdf + - https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf + - https://datatracker.ietf.org/doc/html/rfc9106#section-4 semgrep.dev: rule: + origin: community r_id: 20150 - rv_id: 1263103 rule_id: DbU2X8 + rv_id: 1263103 + url: + https://semgrep.dev/playground/r/qkTR7Jk/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config version_id: qkTR7Jk - url: https://semgrep.dev/playground/r/qkTR7Jk/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/ALq4 + source: https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config + subcategory: + - vuln + technology: + - argon2 + - cryptography + vulnerability_class: + - Insecure Hashing Algorithm mode: taint - pattern-sources: + pattern-sanitizers: - patterns: - - pattern-inside: '$ARGON = require(''argon2''); - - ... - - ' - - pattern: '{type: ...} - - ' + - pattern: '{type: $ARGON.argon2id}' pattern-sinks: - patterns: - - pattern: '$Y - - ' - - pattern-inside: '$ARGON.hash(...,$Y) - - ' - pattern-sanitizers: + - pattern: "$Y\n" + - pattern-inside: "$ARGON.hash(...,$Y)\n" + pattern-sources: - patterns: - - pattern: '{type: $ARGON.argon2id}' + - pattern-inside: "$ARGON = require('argon2');\n...\n" + - pattern: "{type: ...}\n" + severity: WARNING - id: javascript.aws-lambda.security.detect-child-process.detect-child-process - message: Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command - injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let - running arbitrary commands, use a white list for inputs. + languages: + - javascript + - typescript + message: Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a + command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then + do not let running arbitrary commands, use a white list for inputs. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - javascript - - aws-lambda - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process - shortlink: https://sg.run/Ggoq semgrep.dev: rule: + origin: community r_id: 18248 - rv_id: 1263105 rule_id: r6UDNQ + rv_id: 1263105 + url: + https://semgrep.dev/playground/r/YDTZe4o/javascript.aws-lambda.security.detect-child-process.detect-child-process version_id: YDTZe4o - url: https://semgrep.dev/playground/r/YDTZe4o/javascript.aws-lambda.security.detect-child-process.detect-child-process - origin: community - languages: - - javascript - - typescript - severity: ERROR - mode: taint - pattern-sources: - - patterns: - - pattern: $EVENT - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' + shortlink: https://sg.run/Ggoq + source: https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process + subcategory: + - vuln + technology: + - javascript + - aws-lambda + vulnerability_class: + - Command Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $CMD @@ -333,171 +293,121 @@ rules: - pattern: $CP.spawn($CMD,...) - pattern: $CP.spawnSync($CMD,...) - pattern-either: - - pattern-inside: 'require(''child_process'') - - ... - - ' - - pattern-inside: 'import ''child_process'' - - ... - - ' + - pattern-inside: "require('child_process')\n...\n" + - pattern-inside: "import 'child_process'\n...\n" + pattern-sources: + - patterns: + - pattern: $EVENT + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + severity: ERROR - id: javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object - message: Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable - is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly - to DynamoDB client. + languages: + - javascript + - typescript + message: Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the + variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from + `$EVENT` directly to DynamoDB client. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-943: Improper Neutralization of Special Elements in Data Query Logic' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - category: security - technology: - - javascript - - aws-lambda - - dynamodb - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object - shortlink: https://sg.run/X1e4 semgrep.dev: rule: + origin: community r_id: 21320 - rv_id: 945766 rule_id: 0oU1xk + rv_id: 945766 + url: + https://semgrep.dev/playground/r/GxTP7gN/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object version_id: GxTP7gN - url: https://semgrep.dev/playground/r/GxTP7gN/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/X1e4 + source: https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object + subcategory: + - vuln + technology: + - javascript + - aws-lambda + - dynamodb + vulnerability_class: + - Improper Validation mode: taint - pattern-sources: + pattern-sanitizers: - patterns: - - pattern: $EVENT - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' + - pattern: "{...}\n" pattern-sinks: - patterns: - focus-metavariable: $SINK - - pattern: '$DC.$METHOD($SINK, ...) - - ' + - pattern: "$DC.$METHOD($SINK, ...)\n" - metavariable-regex: metavariable: $METHOD - regex: (query|send|scan|delete|put|transactWrite|update|batchExecuteStatement|executeStatement|executeTransaction|transactWriteItems) - - pattern-either: - - pattern-inside: '$DC = new $AWS.DocumentClient(...); - - ... - - ' - - pattern-inside: '$DC = new $AWS.DynamoDB(...); - - ... - - ' - - pattern-inside: '$DC = new DynamoDBClient(...); - - ... - - ' - - pattern-inside: '$DC = DynamoDBDocumentClient.from(...); - - ... - - ' - pattern-sanitizers: + regex: + (query|send|scan|delete|put|transactWrite|update|batchExecuteStatement|executeStatement|executeTransaction|transactWriteItems) + - pattern-either: + - pattern-inside: "$DC = new $AWS.DocumentClient(...);\n...\n" + - pattern-inside: "$DC = new $AWS.DynamoDB(...);\n...\n" + - pattern-inside: "$DC = new DynamoDBClient(...);\n...\n" + - pattern-inside: "$DC = DynamoDBDocumentClient.from(...);\n...\n" + pattern-sources: - patterns: - - pattern: '{...} - - ' + - pattern: $EVENT + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + severity: ERROR - id: javascript.aws-lambda.security.knex-sqli.knex-sqli - message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + languages: + - javascript + - typescript + message: "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `knex.raw(''SELECT $1 from table'', [userinput])`' + instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`" metadata: - references: - - https://knexjs.org/#Builder-fromRaw - - https://knexjs.org/#Builder-whereRaw category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - knex - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli - shortlink: https://sg.run/RgWq + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://knexjs.org/#Builder-fromRaw + - https://knexjs.org/#Builder-whereRaw semgrep.dev: rule: + origin: community r_id: 18249 - rv_id: 1263106 rule_id: bwUBlj - version_id: JdTzxKg + rv_id: 1263106 url: https://semgrep.dev/playground/r/JdTzxKg/javascript.aws-lambda.security.knex-sqli.knex-sqli - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: JdTzxKg + shortlink: https://sg.run/RgWq + source: https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli + subcategory: + - vuln + technology: + - aws-lambda + - knex + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $QUERY @@ -506,78 +416,58 @@ rules: - pattern: $KNEX.whereRaw($QUERY, ...) - pattern: $KNEX.raw($QUERY, ...) - pattern-either: - - pattern-inside: 'require(''knex'') - - ... - - ' - - pattern-inside: 'import ''knex'' - - ... - - ' + - pattern-inside: "require('knex')\n...\n" + - pattern-inside: "import 'knex'\n...\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern: $EVENT + severity: WARNING - id: javascript.aws-lambda.security.mysql-sqli.mysql-sqli - message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + languages: + - javascript + - typescript + message: "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `connection.query(''SELECT $1 from table'', [userinput])`' + instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`" metadata: - references: - - https://www.npmjs.com/package/mysql2 category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://www.npmjs.com/package/mysql2 + semgrep.dev: + rule: + origin: community + r_id: 18250 + rule_id: NbUBJ2 + rv_id: 1263107 + url: https://semgrep.dev/playground/r/5PTo1En/javascript.aws-lambda.security.mysql-sqli.mysql-sqli + version_id: 5PTo1En + shortlink: https://sg.run/A502 + source: https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli + subcategory: + - vuln technology: - aws-lambda - mysql - mysql2 - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection - source: https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli - shortlink: https://sg.run/A502 - semgrep.dev: - rule: - r_id: 18250 - rv_id: 1263107 - rule_id: NbUBJ2 - version_id: 5PTo1En - url: https://semgrep.dev/playground/r/5PTo1En/javascript.aws-lambda.security.mysql-sqli.mysql-sqli - origin: community - languages: - - javascript - - typescript - severity: WARNING mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $QUERY @@ -585,418 +475,301 @@ rules: - pattern: $POOL.query($QUERY, ...) - pattern: $POOL.execute($QUERY, ...) - pattern-either: - - pattern-inside: 'require(''mysql'') - - ... - - ' - - pattern-inside: 'require(''mysql2'') - - ... - - ' - - pattern-inside: 'require(''mysql2/promise'') - - ... - - ' - - pattern-inside: 'import ''mysql'' - - ... - - ' - - pattern-inside: 'import ''mysql2'' - - ... - - ' - - pattern-inside: 'import ''mysql2/promise'' - - ... - - ' + - pattern-inside: "require('mysql')\n...\n" + - pattern-inside: "require('mysql2')\n...\n" + - pattern-inside: "require('mysql2/promise')\n...\n" + - pattern-inside: "import 'mysql'\n...\n" + - pattern-inside: "import 'mysql2'\n...\n" + - pattern-inside: "import 'mysql2/promise'\n...\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern: $EVENT + severity: WARNING - id: javascript.aws-lambda.security.pg-sqli.pg-sqli - message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + languages: + - javascript + - typescript + message: "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `connection.query(''SELECT $1 from table'', [userinput])`' + instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`" metadata: - references: - - https://node-postgres.com/features/queries category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://node-postgres.com/features/queries + semgrep.dev: + rule: + origin: community + r_id: 18251 + rule_id: kxU25P + rv_id: 1263108 + url: https://semgrep.dev/playground/r/GxTkeJL/javascript.aws-lambda.security.pg-sqli.pg-sqli + version_id: GxTkeJL + shortlink: https://sg.run/BGKA + source: https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli + subcategory: + - vuln technology: - aws-lambda - postgres - pg - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection - source: https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli - shortlink: https://sg.run/BGKA - semgrep.dev: - rule: - r_id: 18251 - rv_id: 1263108 - rule_id: kxU25P - version_id: GxTkeJL - url: https://semgrep.dev/playground/r/GxTkeJL/javascript.aws-lambda.security.pg-sqli.pg-sqli - origin: community - languages: - - javascript - - typescript - severity: WARNING mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern: $DB.query($QUERY, ...) - pattern-either: - - pattern-inside: 'require(''pg'') - - ... - - ' - - pattern-inside: 'import ''pg'' - - ... - - ' + - pattern-inside: "require('pg')\n...\n" + - pattern-inside: "import 'pg'\n...\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern: $EVENT + severity: WARNING - id: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli - message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is - user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `sequelize.query(''SELECT * FROM projects WHERE status = ?'', { - replacements: [''active''], type: QueryTypes.SELECT });`' + languages: + - javascript + - typescript + message: "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements + instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: + ['active'], type: QueryTypes.SELECT });`" metadata: - references: - - https://sequelize.org/master/manual/raw-queries.html category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - sequelize - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli - shortlink: https://sg.run/DAlP + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://sequelize.org/master/manual/raw-queries.html semgrep.dev: rule: + origin: community r_id: 18252 - rv_id: 1263109 rule_id: wdUA5o - version_id: RGT0LrD + rv_id: 1263109 url: https://semgrep.dev/playground/r/RGT0LrD/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: RGT0LrD + shortlink: https://sg.run/DAlP + source: https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli + subcategory: + - vuln + technology: + - aws-lambda + - sequelize + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern: $DB.query($QUERY, ...) - pattern-either: - - pattern-inside: 'require(''sequelize'') - - ... - - ' - - pattern-inside: 'import ''sequelize'' - - ... - - ' + - pattern-inside: "require('sequelize')\n...\n" + - pattern-inside: "import 'sequelize'\n...\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern: $EVENT + severity: WARNING - id: javascript.aws-lambda.security.tainted-html-response.tainted-html-response - message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering - HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers - steal sensitive user data. + languages: + - javascript + - typescript + message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of + rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - aws-lambda - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response - shortlink: https://sg.run/0Gvj semgrep.dev: rule: + origin: community r_id: 18254 - rv_id: 1263111 rule_id: OrUJBY + rv_id: 1263111 + url: + https://semgrep.dev/playground/r/BjTkZ8D/javascript.aws-lambda.security.tainted-html-response.tainted-html-response version_id: BjTkZ8D - url: https://semgrep.dev/playground/r/BjTkZ8D/javascript.aws-lambda.security.tainted-html-response.tainted-html-response - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/0Gvj + source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint + pattern-sinks: + - patterns: + - focus-metavariable: $BODY + - pattern-inside: "{..., headers: {..., 'Content-Type': 'text/html', ...}, body: $BODY, ... }\n" pattern-sources: - patterns: - pattern-either: - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" - pattern: $EVENT - pattern-sinks: - - patterns: - - focus-metavariable: $BODY - - pattern-inside: '{..., headers: {..., ''Content-Type'': ''text/html'', ...}, body: $BODY, ... } - - ' + severity: WARNING - id: javascript.aws-lambda.security.tainted-html-string.tainted-html-string - message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods - of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could - let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use - templates which will safely render HTML instead. + languages: + - javascript + - typescript + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure + methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, + which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered + safely. Otherwise, use templates which will safely render HTML instead. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - aws-lambda - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string - shortlink: https://sg.run/Lgqr semgrep.dev: rule: + origin: community r_id: 18483 - rv_id: 1263112 rule_id: PeUxwW + rv_id: 1263112 + url: + https://semgrep.dev/playground/r/DkTRbvp/javascript.aws-lambda.security.tainted-html-string.tainted-html-string version_id: DkTRbvp - url: https://semgrep.dev/playground/r/DkTRbvp/javascript.aws-lambda.security.tainted-html-string.tainted-html-string - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/Lgqr + source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern: $EVENT pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - - pattern: '"$HTMLSTR" + $EXPR - - ' - - pattern: '"$HTMLSTR".concat(...) - - ' + - pattern: "\"$HTMLSTR\" + $EXPR\n" + - pattern: "\"$HTMLSTR\".concat(...)\n" - pattern: $UTIL.format($HTMLSTR, ...) - pattern: format($HTMLSTR, ...) - metavariable-pattern: - metavariable: $HTMLSTR language: generic + metavariable: $HTMLSTR pattern: <$TAG ... - patterns: - - pattern: '`...${...}...` - - ' - - pattern-regex: '.*<\w+.* - - ' - - pattern-not-inside: 'console.$LOG(...) - - ' + - pattern: "`...${...}...`\n" + - pattern-regex: ".*<\\w+.*\n" + - pattern-not-inside: "console.$LOG(...)\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern: $EVENT + severity: WARNING - id: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection - message: The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a - security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input - it could result in command injection. Do not let user input in `vm` functions. + languages: + - javascript + - typescript + message: The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not + a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user + input it could result in command injection. Do not let user input in `vm` functions. metadata: - owasp: - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' category: security - technology: - - javascript - - aws-lambda + confidence: MEDIUM + cwe: + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" cwe2022-top25: true - subcategory: - - vuln - likelihood: MEDIUM impact: MEDIUM - confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A03:2021 - Injection + - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection - shortlink: https://sg.run/q9w7 semgrep.dev: rule: + origin: community r_id: 18256 - rv_id: 1263114 rule_id: v8UOdZ + rv_id: 1263114 + url: + https://semgrep.dev/playground/r/0bTKz9J/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection version_id: 0bTKz9J - url: https://semgrep.dev/playground/r/0bTKz9J/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/q9w7 + source: https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection + subcategory: + - vuln + technology: + - javascript + - aws-lambda + vulnerability_class: + - Code Injection mode: taint - pattern-sources: - - patterns: - - pattern: $EVENT - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' pattern-sinks: - patterns: - pattern-either: - - pattern-inside: 'require(''vm''); - - ... - - ' - - pattern-inside: 'import ''vm'' - - ... - - ' + - pattern-inside: "require('vm');\n...\n" + - pattern-inside: "import 'vm'\n...\n" - pattern-either: - pattern: $VM.runInContext($X,...) - pattern: $VM.runInNewContext($X,...) @@ -1010,111 +783,61 @@ rules: - pattern: compileFunction($X,...) - pattern: new Script($X,...) - pattern: new SourceTextModule($X,...) + pattern-sources: + - patterns: + - pattern: $EVENT + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + severity: ERROR - id: javascript.browser.security.open-redirect.js-open-redirect - message: The application accepts potentially user-controlled input `$PROP` which can control the location of the current - window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript - URIs. It is recommended to validate user-controllable input before allowing it to control the redirection. - options: - interfile: true + languages: + - javascript + - typescript + message: The application accepts potentially user-controlled input `$PROP` which can control the location of the + current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) + with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the + redirection. metadata: - interfile: true - cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control asvs: - section: V5 Validation, Sanitization and Encoding control_id: 5.5.1 Insecue Redirect - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation + section: V5 Validation, Sanitization and Encoding version: '4' category: security confidence: HIGH - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html - technology: - - browser - subcategory: - - vuln - likelihood: HIGH + cwe: + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" impact: MEDIUM + interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect - shortlink: https://sg.run/3xRe + likelihood: HIGH + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9243 - rv_id: 1263122 rule_id: WAUopl - version_id: pZT03x0 + rv_id: 1263122 url: https://semgrep.dev/playground/r/pZT03x0/javascript.browser.security.open-redirect.js-open-redirect - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: pZT03x0 + shortlink: https://sg.run/3xRe + source: https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect + subcategory: + - vuln + technology: + - browser + vulnerability_class: + - Open Redirect mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: 'new URLSearchParams($WINDOW. ... .location.search).get(''...'') - - ' - - pattern: 'new URLSearchParams(location.search).get(''...'') - - ' - - pattern: 'new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get(''...'') - - ' - - pattern: 'new URLSearchParams(location.hash.substring(1)).get(''...'') - - ' - - patterns: - - pattern-either: - - pattern-inside: '$PROPS = new URLSearchParams($WINDOW. ... .location.search) - - ... - - ' - - pattern-inside: '$PROPS = new URLSearchParams(location.search) - - ... - - ' - - pattern-inside: '$PROPS = new URLSearchParams($WINDOW. ... .location.hash.substring(1)) - - ... - - ' - - pattern-inside: '$PROPS = new URLSearchParams(location.hash.substring(1)) - - ... - - ' - - pattern: $PROPS.get('...') - - patterns: - - pattern-either: - - pattern-inside: '$PROPS = new URL($WINDOW. ... .location.href) - - ... - - ' - - pattern-inside: '$PROPS = new URL(location.href) - - ... - - ' - - pattern: $PROPS.searchParams.get('...') - - patterns: - - pattern-either: - - pattern: 'new URL($WINDOW. ... .location.href).searchParams.get(''...'') - - ' - - pattern: 'new URL(location.href).searchParams.get(''...'') - - ' + options: + interfile: true pattern-sinks: - patterns: - pattern-either: @@ -1126,62 +849,115 @@ rules: - pattern: $WINDOW. ... .location = $SINK - focus-metavariable: $SINK - metavariable-pattern: - patterns: - - pattern-not: '"..." + $VALUE - - ' - - pattern-not: '`...${$VALUE}` - - ' metavariable: $SINK + patterns: + - pattern-not: "\"...\" + $VALUE\n" + - pattern-not: "`...${$VALUE}`\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern: "new URLSearchParams($WINDOW. ... .location.search).get('...')\n" + - pattern: "new URLSearchParams(location.search).get('...')\n" + - pattern: "new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...')\n" + - pattern: "new URLSearchParams(location.hash.substring(1)).get('...')\n" + - patterns: + - pattern-either: + - pattern-inside: "$PROPS = new URLSearchParams($WINDOW. ... .location.search)\n...\n" + - pattern-inside: "$PROPS = new URLSearchParams(location.search)\n...\n" + - pattern-inside: "$PROPS = new URLSearchParams($WINDOW. ... .location.hash.substring(1))\n...\n" + - pattern-inside: "$PROPS = new URLSearchParams(location.hash.substring(1))\n...\n" + - pattern: $PROPS.get('...') + - patterns: + - pattern-either: + - pattern-inside: "$PROPS = new URL($WINDOW. ... .location.href)\n...\n" + - pattern-inside: "$PROPS = new URL(location.href)\n...\n" + - pattern: $PROPS.searchParams.get('...') + - patterns: + - pattern-either: + - pattern: "new URL($WINDOW. ... .location.href).searchParams.get('...')\n" + - pattern: "new URL(location.href).searchParams.get('...')\n" + severity: WARNING - id: javascript.browser.security.raw-html-concat.raw-html-concat + languages: + - javascript + - typescript message: User controlled data in a HTML string may result in XSS metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/www-community/attacks/xss/ - category: security - technology: - - browser - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat - shortlink: https://sg.run/4xAx semgrep.dev: rule: + origin: community r_id: 9244 - rv_id: 1263123 rule_id: 0oU5b5 - version_id: 2KTv2wp + rv_id: 1263123 url: https://semgrep.dev/playground/r/2KTv2wp/javascript.browser.security.raw-html-concat.raw-html-concat - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: 2KTv2wp + shortlink: https://sg.run/4xAx + source: https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat + subcategory: + - vuln + technology: + - browser + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: + pattern-sanitizers: - patterns: - pattern-either: - - pattern: location.href - - pattern: location.hash - - pattern: location.search - - pattern: $WINDOW. ... .location.href - - pattern: $WINDOW. ... .location.hash - - pattern: $WINDOW. ... .location.search + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "import * as $S from \"underscore.string\"\n...\n" + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "$S = require(\"underscore.string\")\n...\n" + - pattern-either: + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: "import $S from \"dompurify\"\n...\n" + - pattern-inside: "import { ..., $S,... } from \"dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"dompurify\"\n...\n" + - pattern-inside: "$S = require(\"dompurify\")\n...\n" + - pattern-inside: "import $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "$S = require(\"isomorphic-dompurify\")\n...\n" + - pattern-either: + - patterns: + - pattern-inside: "$VALUE = $S(...)\n...\n" + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: "$VALUE = $S.sanitize\n...\n" + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: "import $S from 'xss';\n...\n" + - pattern-inside: "import * as $S from 'xss';\n...\n" + - pattern-inside: "$S = require(\"xss\")\n...\n" + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: "import $S from 'sanitize-html';\n...\n" + - pattern-inside: "import * as $S from \"sanitize-html\";\n...\n" + - pattern-inside: "$S = require(\"sanitize-html\")\n...\n" + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: "$S = new Remarkable()\n...\n" + - pattern: $S.render(...) pattern-sinks: - patterns: - pattern-either: @@ -1189,1110 +965,683 @@ rules: - pattern: $STRING + $EXPR - pattern-not: $STRING + "..." - metavariable-pattern: + language: generic + metavariable: $STRING patterns: - pattern: <$TAG ... - pattern-not: <$TAG ...>...... - metavariable: $STRING - language: generic - patterns: - pattern: $EXPR + $STRING - pattern-not: '"..." + $STRING' - metavariable-pattern: + language: generic + metavariable: $STRING patterns: - pattern: '... ,...) - - pattern-not-inside: '$OPTS = <... {name:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.name = ...; - - ... - - $SESSION($OPTS,...); - - ' -- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain - message: 'Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare - against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.' + - pattern-not-inside: "$OPTS = <... {name:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.name = ...;\n...\n$SESSION($OPTS,...);\n" severity: WARNING +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain languages: - javascript - typescript + message: 'Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare + against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html - category: security - technology: - - express - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: LOW - confidence: MEDIUM references: - https://owasp.org/Top10/A04_2021-Insecure_Design - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain - shortlink: https://sg.run/rd41 semgrep.dev: rule: + origin: community r_id: 9269 - rv_id: 1263133 rule_id: ZqU5Pn + rv_id: 1263133 + url: + https://semgrep.dev/playground/r/w8TRoyd/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain version_id: w8TRoyd - url: https://semgrep.dev/playground/r/w8TRoyd/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain - origin: community + shortlink: https://sg.run/rd41 + source: + https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern-inside: '$SESSION = require(''cookie-session''); - - ... - - ' - - pattern-inside: '$SESSION = require(''express-session''); - - ... - - ' + - pattern-inside: "$SESSION = require('cookie-session');\n...\n" + - pattern-inside: "$SESSION = require('express-session');\n...\n" - pattern: $SESSION(...) - pattern-not-inside: $SESSION(<... {cookie:{domain:...}} ...>,...) - - pattern-not-inside: '$OPTS = <... {cookie:{domain:...}} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE = <... {domain:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie = <... {domain:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE.domain = ...; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie.domain = ...; - - ... - - $SESSION($OPTS,...); - - ' -- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires - message: 'Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.' + - pattern-not-inside: "$OPTS = <... {cookie:{domain:...}} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE = <... {domain:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie = <... {domain:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE.domain = ...;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie.domain = ...;\n...\n$SESSION($OPTS,...);\n" severity: WARNING +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires languages: - javascript - typescript + message: 'Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html - category: security - technology: - - express - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: LOW - confidence: MEDIUM references: - https://owasp.org/Top10/A04_2021-Insecure_Design - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires - shortlink: https://sg.run/N4eG semgrep.dev: rule: + origin: community r_id: 9271 - rv_id: 1263135 rule_id: EwU2DZ + rv_id: 1263135 + url: + https://semgrep.dev/playground/r/O9TpxRq/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires version_id: O9TpxRq - url: https://semgrep.dev/playground/r/O9TpxRq/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires - origin: community + shortlink: https://sg.run/N4eG + source: + https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern-inside: '$SESSION = require(''cookie-session''); - - ... - - ' - - pattern-inside: '$SESSION = require(''express-session''); - - ... - - ' + - pattern-inside: "$SESSION = require('cookie-session');\n...\n" + - pattern-inside: "$SESSION = require('express-session');\n...\n" - pattern: $SESSION(...) - pattern-not-inside: $SESSION(<... {cookie:{expires:...}} ...>,...) - - pattern-not-inside: '$OPTS = <... {cookie:{expires:...}} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE = <... {expires:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie = <... {expires:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE.expires = ...; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie.expires = ...; - - ... - - $SESSION($OPTS,...);' -- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly - message: 'Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not - client JavaScript, helping to protect against cross-site scripting attacks.' + - pattern-not-inside: "$OPTS = <... {cookie:{expires:...}} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE = <... {expires:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie = <... {expires:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE.expires = ...;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie.expires = ...;\n...\n$SESSION($OPTS,...);" severity: WARNING +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly languages: - javascript - typescript + message: 'Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not + client JavaScript, helping to protect against cross-site scripting attacks.' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html - category: security - technology: - - express - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: LOW - confidence: MEDIUM references: - https://owasp.org/Top10/A04_2021-Insecure_Design - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly - shortlink: https://sg.run/ydBO semgrep.dev: rule: + origin: community r_id: 9268 - rv_id: 1263132 rule_id: d8UjGo + rv_id: 1263132 + url: + https://semgrep.dev/playground/r/kbTzGev/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly version_id: kbTzGev - url: https://semgrep.dev/playground/r/kbTzGev/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly - origin: community + shortlink: https://sg.run/ydBO + source: + https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern-inside: '$SESSION = require(''cookie-session''); - - ... - - ' - - pattern-inside: '$SESSION = require(''express-session''); - - ... - - ' + - pattern-inside: "$SESSION = require('cookie-session');\n...\n" + - pattern-inside: "$SESSION = require('express-session');\n...\n" - pattern: $SESSION(...) - pattern-not-inside: $SESSION(<... {cookie:{httpOnly:true}} ...>,...) - - pattern-not-inside: '$OPTS = <... {cookie:{httpOnly:true}} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE = <... {httpOnly:true} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie = <... {httpOnly:true} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE.httpOnly = true; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie.httpOnly = true; - - ... - - $SESSION($OPTS,...); - - ' -- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path - message: 'Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against - the request path. If this and domain match, then send the cookie in the request.' + - pattern-not-inside: "$OPTS = <... {cookie:{httpOnly:true}} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE = <... {httpOnly:true} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie = <... {httpOnly:true} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE.httpOnly = true;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie.httpOnly = true;\n...\n$SESSION($OPTS,...);\n" severity: WARNING +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path languages: - javascript - typescript + message: 'Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against + the request path. If this and domain match, then send the cookie in the request.' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html - category: security - technology: - - express - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: LOW - confidence: MEDIUM references: - https://owasp.org/Top10/A04_2021-Insecure_Design - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path - shortlink: https://sg.run/b7pd semgrep.dev: rule: + origin: community r_id: 9270 - rv_id: 1263134 rule_id: nJUz4X + rv_id: 1263134 + url: + https://semgrep.dev/playground/r/xyTjzQD/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path version_id: xyTjzQD - url: https://semgrep.dev/playground/r/xyTjzQD/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path - origin: community + shortlink: https://sg.run/b7pd + source: + https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern-inside: '$SESSION = require(''cookie-session''); - - ... - - ' - - pattern-inside: '$SESSION = require(''express-session''); - - ... - - ' + - pattern-inside: "$SESSION = require('cookie-session');\n...\n" + - pattern-inside: "$SESSION = require('express-session');\n...\n" - pattern: $SESSION(...) - pattern-not-inside: $SESSION(<... {cookie:{path:...}} ...>,...) - - pattern-not-inside: '$OPTS = <... {cookie:{path:...}} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE = <... {path:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie = <... {path:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE.path = ...; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie.path = ...; - - ... - - $SESSION($OPTS,...); - - ' -- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure - message: 'Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.' + - pattern-not-inside: "$OPTS = <... {cookie:{path:...}} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE = <... {path:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie = <... {path:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE.path = ...;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie.path = ...;\n...\n$SESSION($OPTS,...);\n" severity: WARNING +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure languages: - javascript - typescript + message: 'Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html - category: security - technology: - - express - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: LOW - confidence: MEDIUM references: - https://owasp.org/Top10/A04_2021-Insecure_Design - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure - shortlink: https://sg.run/9oKz semgrep.dev: rule: + origin: community r_id: 9267 - rv_id: 1263131 rule_id: v8Unzw + rv_id: 1263131 + url: + https://semgrep.dev/playground/r/NdTzyrv/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure version_id: NdTzyrv - url: https://semgrep.dev/playground/r/NdTzyrv/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure - origin: community + shortlink: https://sg.run/9oKz + source: + https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern-inside: '$SESSION = require(''cookie-session''); - - ... - - ' - - pattern-inside: '$SESSION = require(''express-session''); - - ... - - ' + - pattern-inside: "$SESSION = require('cookie-session');\n...\n" + - pattern-inside: "$SESSION = require('express-session');\n...\n" - pattern: $SESSION(...) - pattern-not-inside: $SESSION(<... {cookie:{secure:true}} ...>,...) - - pattern-not-inside: '$OPTS = <... {cookie:{secure:true}} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE = <... {secure:true} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie = <... {secure:true} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE.secure = true; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie.secure = true; - - ... - - $SESSION($OPTS,...); - - ' + - pattern-not-inside: "$OPTS = <... {cookie:{secure:true}} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE = <... {secure:true} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie = <... {secure:true} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE.secure = true;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie.secure = true;\n...\n$SESSION($OPTS,...);\n" + severity: WARNING - id: javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked - message: No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider - using function as the `isRevoked` option. + languages: + - javascript + - typescript + message: No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. + Consider using function as the `isRevoked` option. metadata: - cwe: - - 'CWE-522: Insufficiently Protected Credentials' - owasp: - - A02:2017 - Broken Authentication - - A04:2021 - Insecure Design - - A06:2025 - Insecure Design - source-rule-url: https://github.com/goldbergyoni/nodebestpractices/blob/master/sections/security/expirejwt.md asvs: - section: 'V3: Session Management Verification Requirements' control_id: 3.5.3 Insecure Stateless Session Tokens - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' version: '4' category: security - technology: - - express + confidence: MEDIUM + cwe: + - 'CWE-522: Insufficiently Protected Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM impact: MEDIUM - confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design references: - https://owasp.org/Top10/A04_2021-Insecure_Design - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked - shortlink: https://sg.run/kXNo semgrep.dev: rule: + origin: community r_id: 9272 - rv_id: 1263137 rule_id: 7KUQ9k + rv_id: 1263137 + url: + https://semgrep.dev/playground/r/vdT06Bg/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked version_id: vdT06Bg - url: https://semgrep.dev/playground/r/vdT06Bg/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/kXNo + source: https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked + source-rule-url: https://github.com/goldbergyoni/nodebestpractices/blob/master/sections/security/expirejwt.md + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: '$JWT = require(''express-jwt''); - - ... - - ' + - pattern-inside: "$JWT = require('express-jwt');\n...\n" - pattern: $JWT(...) - pattern-not-inside: $JWT(<... {isRevoked:...} ...>,...) - - pattern-not-inside: '$OPTS = <... {isRevoked:...} ...>; - - ... - - $JWT($OPTS,...);' + - pattern-not-inside: "$OPTS = <... {isRevoked:...} ...>;\n...\n$JWT($OPTS,...);" + severity: WARNING - id: javascript.express.security.audit.express-libxml-noent.express-libxml-noent - message: The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable - to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure - you are protected. - options: - interfile: true + languages: + - javascript + - typescript + message: The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being + vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this + feature to ensure you are protected. metadata: - interfile: true - references: - - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html - technology: - - express category: security + confidence: HIGH cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent - shortlink: https://sg.run/Z75x + references: + - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 22079 - rv_id: 1263138 rule_id: pKUNeD + rv_id: 1263138 + url: + https://semgrep.dev/playground/r/d6TyxpX/javascript.express.security.audit.express-libxml-noent.express-libxml-noent version_id: d6TyxpX - url: https://semgrep.dev/playground/r/d6TyxpX/javascript.express.security.audit.express-libxml-noent.express-libxml-noent - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/Z75x + source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent + subcategory: + - vuln + technology: + - express + vulnerability_class: + - XML Injection mode: taint + options: + interfile: true + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: "$XML = require('$IMPORT')\n...\n" + - pattern-inside: "import $XML from '$IMPORT'\n ...\n" + - pattern-inside: "import * as $XML from '$IMPORT'\n...\n" + - metavariable-regex: + metavariable: $IMPORT + regex: ^(libxmljs|libxmljs2)$ + - pattern-inside: $XML.$FUNC($QUERY, {...,noent:true,...}) + - metavariable-regex: + metavariable: $FUNC + regex: ^(parseXmlString|parseXml)$ + - focus-metavariable: $QUERY pattern-sources: - patterns: - pattern-either: @@ -2315,14 +1664,8 @@ rules: - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -2332,117 +1675,60 @@ rules: - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') - pattern-sinks: - - pattern-either: - - patterns: - - pattern-either: - - pattern-inside: '$XML = require(''$IMPORT'') - - ... - - ' - - pattern-inside: "import $XML from '$IMPORT'\n ...\n" - - pattern-inside: 'import * as $XML from ''$IMPORT'' - - ... - - ' - - metavariable-regex: - metavariable: $IMPORT - regex: ^(libxmljs|libxmljs2)$ - - pattern-inside: $XML.$FUNC($QUERY, {...,noent:true,...}) - - metavariable-regex: - metavariable: $FUNC - regex: ^(parseXmlString|parseXml)$ - - focus-metavariable: $QUERY + severity: ERROR - id: javascript.express.security.audit.express-open-redirect.express-open-redirect - message: The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect - users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected - to a third-party website. + languages: + - javascript + - typescript + message: The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could + redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they + are being redirected to a third-party website. metadata: - technology: - - express - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html - cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' category: security + confidence: HIGH + cwe: + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect - shortlink: https://sg.run/EpoP + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 22081 - rv_id: 1263140 rule_id: X5ULkq + rv_id: 1263140 + url: + https://semgrep.dev/playground/r/nWT2L0v/javascript.express.security.audit.express-open-redirect.express-open-redirect version_id: nWT2L0v - url: https://semgrep.dev/playground/r/nWT2L0v/javascript.express.security.audit.express-open-redirect.express-open-redirect - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/EpoP + source: https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Open Redirect + mode: taint options: - taint_unify_mvars: true symbolic_propagation: true - mode: taint - pattern-sources: + taint_unify_mvars: true + pattern-sinks: - patterns: - pattern-either: - - pattern-inside: function ... ($REQ, $RES) {...} - - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - - patterns: - - pattern-either: - - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - - metavariable-regex: - metavariable: $METHOD - regex: ^(get|post|put|head|delete|options)$ - - pattern-either: - - pattern: $REQ.query - - pattern: $REQ.body - - pattern: $REQ.params - - pattern: $REQ.cookies - - pattern: $REQ.headers - - patterns: - - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' - - focus-metavariable: $REQ - - pattern-either: - - pattern: params - - pattern: query - - pattern: cookies - - pattern: headers - - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern: $RES.redirect("$HTTP"+$REQ. ... .$VALUE) - - pattern: $RES.redirect("$HTTP"+$REQ. ... .$VALUE + $...A) - - pattern: $RES.redirect(`$HTTP${$REQ. ... .$VALUE}...`) - - pattern: $RES.redirect("$HTTP"+$REQ.$VALUE[...]) - - pattern: $RES.redirect("$HTTP"+$REQ.$VALUE[...] + $...A) - - pattern: $RES.redirect(`$HTTP${$REQ.$VALUE[...]}...`) - - metavariable-regex: - metavariable: $HTTP - regex: ^https?:\/\/$ + - pattern: $RES.redirect("$HTTP"+$REQ. ... .$VALUE) + - pattern: $RES.redirect("$HTTP"+$REQ. ... .$VALUE + $...A) + - pattern: $RES.redirect(`$HTTP${$REQ. ... .$VALUE}...`) + - pattern: $RES.redirect("$HTTP"+$REQ.$VALUE[...]) + - pattern: $RES.redirect("$HTTP"+$REQ.$VALUE[...] + $...A) + - pattern: $RES.redirect(`$HTTP${$REQ.$VALUE[...]}...`) + - metavariable-regex: + metavariable: $HTTP + regex: ^https?:\/\/$ - pattern-either: - pattern: $REQ. ... .$VALUE - patterns: @@ -2459,73 +1745,113 @@ rules: - pattern: $REQ.$VALUE - patterns: - pattern-either: - - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE - - ... - - ' - - pattern-inside: '$ASSIGN = $REQ.$VALUE[''...''] - - ... - - ' - - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE + $...A - - ... - - ' + - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE\n...\n" + - pattern-inside: "$ASSIGN = $REQ.$VALUE['...']\n...\n" + - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE + $...A\n...\n" - pattern-inside: "$ASSIGN = $REQ.$VALUE['...'] + $...A\n... \n" - - pattern-inside: '$ASSIGN = `${$REQ. ... .$VALUE}...` - - ... - - ' + - pattern-inside: "$ASSIGN = `${$REQ. ... .$VALUE}...`\n...\n" - pattern-inside: "$ASSIGN = `${$REQ.$VALUE['...']}...`\n... \n" - pattern-either: - pattern: $RES.redirect($ASSIGN) - pattern: $RES.redirect($ASSIGN + $...FOO) - pattern: $RES.redirect(`${$ASSIGN}...`) - focus-metavariable: $ASSIGN + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + severity: WARNING - id: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal - message: Possible writing outside of the destination, make sure that the target path is nested in the intended destination + languages: + - javascript + - typescript + message: Possible writing outside of the destination, make sure that the target path is nested in the intended + destination metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' - category: security references: - https://owasp.org/www-community/attacks/Path_Traversal - technology: - - express - - node.js - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal - shortlink: https://sg.run/weRn semgrep.dev: rule: + origin: community r_id: 9273 - rv_id: 1263141 rule_id: L1Uyb8 + rv_id: 1263141 + url: + https://semgrep.dev/playground/r/ExTExX0/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal version_id: ExTExX0 - url: https://semgrep.dev/playground/r/ExTExX0/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/weRn + source: + https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal + subcategory: + - vuln + technology: + - express + - node.js + vulnerability_class: + - Path Traversal mode: taint + pattern-sanitizers: + - pattern: $Y.replace(...) + - pattern: $Y.indexOf(...) + - pattern: "function ... (...) {\n ...\n <... $Y.indexOf(...) ...>\n ...\n}\n" + - patterns: + - pattern: $FUNC(...) + - metavariable-regex: + metavariable: $FUNC + regex: sanitize + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern-either: + - pattern-inside: "$PATH = require('path');\n...\n" + - pattern-inside: "import $PATH from 'path';\n...\n" + - pattern-either: + - pattern: $PATH.join(...,$SINK,...) + - pattern: $PATH.resolve(...,$SINK,...) + - patterns: + - focus-metavariable: $SINK + - pattern-inside: "import 'path';\n...\n" + - pattern-either: + - pattern: path.join(...,$SINK,...) + - pattern: path.resolve(...,$SINK,...) pattern-sources: - patterns: - pattern-either: @@ -2546,14 +1872,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -2561,80 +1881,55 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - focus-metavariable: $SINK - - pattern-either: - - pattern-inside: '$PATH = require(''path''); - - ... - - ' - - pattern-inside: 'import $PATH from ''path''; - - ... - - ' - - pattern-either: - - pattern: $PATH.join(...,$SINK,...) - - pattern: $PATH.resolve(...,$SINK,...) - - patterns: - - focus-metavariable: $SINK - - pattern-inside: 'import ''path''; - - ... - - ' - - pattern-either: - - pattern: path.join(...,$SINK,...) - - pattern: path.resolve(...,$SINK,...) - pattern-sanitizers: - - pattern: $Y.replace(...) - - pattern: $Y.indexOf(...) - - pattern: "function ... (...) {\n ...\n <... $Y.indexOf(...) ...>\n ...\n}\n" - - patterns: - - pattern: $FUNC(...) - - metavariable-regex: - metavariable: $FUNC - regex: sanitize + severity: WARNING - id: javascript.express.security.audit.express-res-sendfile.express-res-sendfile - message: The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily - read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing - the path. This allows you to validate the path against the intended directory it should be accessing. + languages: + - javascript + - typescript + message: The application processes user-input, this is passed to res.sendFile which can allow an attacker to + arbitrarily read files on the system through path traversal. It is recommended to perform input validation in + addition to canonicalizing the path. This allows you to validate the path against the intended directory it should + be accessing. metadata: - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html - technology: - - express category: security + confidence: MEDIUM cwe: - 'CWE-73: External Control of File Name or Path' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile - shortlink: https://sg.run/7DJk + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 22082 - rv_id: 1263142 rule_id: j2UzDx + rv_id: 1263142 + url: + https://semgrep.dev/playground/r/7ZTE3X9/javascript.express.security.audit.express-res-sendfile.express-res-sendfile version_id: 7ZTE3X9 - url: https://semgrep.dev/playground/r/7ZTE3X9/javascript.express.security.audit.express-res-sendfile.express-res-sendfile - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/7DJk + source: https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Path Traversal mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.$METH($QUERY,...) + - pattern-not-inside: $RES.$METH($QUERY,$OPTIONS) + - metavariable-regex: + metavariable: $METH + regex: ^(sendfile|sendFile)$ + - focus-metavariable: $QUERY pattern-sources: - patterns: - pattern-either: @@ -2655,14 +1950,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - pattern-either: - pattern: params - pattern: query @@ -2673,187 +1962,116 @@ rules: - pattern-either: - patterns: - pattern-either: - - pattern-inside: 'function ... (...,$REQ: $TYPE, ...) {...} - - ' + - pattern-inside: "function ... (...,$REQ: $TYPE, ...) {...}\n" - metavariable-regex: metavariable: $TYPE regex: ^(string|String) - pattern-sinks: - - patterns: - - pattern-either: - - pattern: $RES.$METH($QUERY,...) - - pattern-not-inside: $RES.$METH($QUERY,$OPTIONS) - - metavariable-regex: - metavariable: $METH - regex: ^(sendfile|sendFile)$ - - focus-metavariable: $QUERY + severity: WARNING - id: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). - options: - interfile: true + languages: + - javascript + - typescript + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - interfile: true + category: security + confidence: HIGH cwe: - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - category: security - technology: - - express - - secrets - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: HIGH - confidence: HIGH + interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret - shortlink: https://sg.run/LYvG + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 22083 - rv_id: 1263143 rule_id: 10Uo39 + rv_id: 1263143 + url: + https://semgrep.dev/playground/r/LjTkgle/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret version_id: LjTkgle - url: https://semgrep.dev/playground/r/LjTkgle/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/LYvG + source: + https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret + subcategory: + - vuln + technology: + - express + - secrets + vulnerability_class: + - Hard-coded Secrets + options: + interfile: true patterns: - pattern-either: - - pattern-inside: '$SESSION = require(''express-session''); - - ... - - ' - - pattern-inside: 'import $SESSION from ''express-session'' - - ... - - ' - - pattern-inside: 'import {..., $SESSION, ...} from ''express-session'' - - ... - - ' - - pattern-inside: 'import * as $SESSION from ''express-session'' - - ... - - ' + - pattern-inside: "$SESSION = require('express-session');\n...\n" + - pattern-inside: "import $SESSION from 'express-session'\n...\n" + - pattern-inside: "import {..., $SESSION, ...} from 'express-session'\n...\n" + - pattern-inside: "import * as $SESSION from 'express-session'\n...\n" - patterns: - pattern-either: - pattern-inside: $APP.use($SESSION({...})) - - pattern: '$SECRET = $VALUE - - ... - - $APP.use($SESSION($SECRET)) - - ' - - pattern: 'secret: ''$Y'' - - ' + - pattern: "$SECRET = $VALUE\n...\n$APP.use($SESSION($SECRET))\n" + - pattern: "secret: '$Y'\n" + severity: WARNING - id: javascript.express.security.audit.express-ssrf.express-ssrf + languages: + - javascript + - typescript message: 'The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. ' metadata: - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' - technology: - - express - category: security - owasp: - - A10:2021 - Server-Side Request Forgery (SSRF) - - A01:2025 - Broken Access Control - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf - shortlink: https://sg.run/0PNw + likelihood: MEDIUM + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 22554 - rv_id: 1263144 rule_id: eqU9l2 - version_id: 8KT5rBr + rv_id: 1263144 url: https://semgrep.dev/playground/r/8KT5rBr/javascript.express.security.audit.express-ssrf.express-ssrf - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: 8KT5rBr + shortlink: https://sg.run/0PNw + source: https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint options: taint_unify_mvars: true - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: function ... ($REQ, ...) {...} - - pattern-either: - - pattern: $REQ.query - - pattern: $REQ.body - - pattern: $REQ.params - - pattern: $REQ.cookies - - pattern: $REQ.headers - - patterns: - - pattern-either: - - pattern-inside: '({ $REQ }: Request,...) => - - {...} - - ' - - pattern-inside: '({ $REQ }: $EXPRESS.Request,...) => {...} - - ' - - focus-metavariable: $REQ - - pattern-either: - - pattern: params - - pattern: query - - pattern: cookies - - pattern: headers - - pattern: body pattern-sinks: - patterns: - pattern-either: - - pattern-inside: '$REQUEST = require(''request'') - - ... - - ' - - pattern-inside: 'import * as $REQUEST from ''request'' - - ... - - ' - - pattern-inside: 'import $REQUEST from ''request'' - - ... - - ' + - pattern-inside: "$REQUEST = require('request')\n...\n" + - pattern-inside: "import * as $REQUEST from 'request'\n...\n" + - pattern-inside: "import $REQUEST from 'request'\n...\n" - pattern-either: - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE) - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE + $...A) @@ -2871,21 +2089,9 @@ rules: - pattern: $REQ. ... .$VALUE - patterns: - pattern-either: - - pattern-inside: '$REQUEST = require(''request'') - - ... - - ' - - pattern-inside: 'import * as $REQUEST from ''request'' - - ... - - ' - - pattern-inside: 'import $REQUEST from ''request'' - - ... - - ' + - pattern-inside: "$REQUEST = require('request')\n...\n" + - pattern-inside: "import * as $REQUEST from 'request'\n...\n" + - pattern-inside: "import $REQUEST from 'request'\n...\n" - pattern-either: - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE,...) - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE + $...A,...) @@ -2896,21 +2102,9 @@ rules: regex: ^(get|post|put|patch|del|head|delete)$ - patterns: - pattern-either: - - pattern-inside: '$REQUEST = require(''request'') - - ... - - ' - - pattern-inside: 'import * as $REQUEST from ''request'' - - ... - - ' - - pattern-inside: 'import $REQUEST from ''request'' - - ... - - ' + - pattern-inside: "$REQUEST = require('request')\n...\n" + - pattern-inside: "import * as $REQUEST from 'request'\n...\n" + - pattern-inside: "import $REQUEST from 'request'\n...\n" - pattern-either: - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'],...) - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'] + $...A,...) @@ -2921,71 +2115,23 @@ rules: regex: ^(get|post|put|patch|del|head|delete)$ - patterns: - pattern-either: - - pattern-inside: '$REQUEST = require(''request'') - - ... - - ' - - pattern-inside: 'import * as $REQUEST from ''request'' - - ... - - ' - - pattern-inside: 'import $REQUEST from ''request'' - - ... - - ' - - pattern-either: - - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE - - ... - - ' - - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE[''...''] - - ... - - ' - - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE + $...A - - ... - - ' + - pattern-inside: "$REQUEST = require('request')\n...\n" + - pattern-inside: "import * as $REQUEST from 'request'\n...\n" + - pattern-inside: "import $REQUEST from 'request'\n...\n" + - pattern-either: + - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE\n...\n" + - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE['...']\n...\n" + - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE + $...A\n...\n" - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE['...'] + $...A\n... \n" - - pattern-inside: '$ASSIGN = `${$REQ. ... .$VALUE}...` - - ... - - ' + - pattern-inside: "$ASSIGN = `${$REQ. ... .$VALUE}...`\n...\n" - pattern-inside: "$ASSIGN = `${$REQ. ... .$VALUE['...']}...`\n... \n" - patterns: - pattern-either: - - pattern-inside: '$ASSIGN = "$HTTP"+ $REQ. ... .$VALUE - - ... - - ' - - pattern-inside: '$ASSIGN = "$HTTP"+$REQ. ... .$VALUE + $...A - - ... - - ' - - pattern-inside: '$ASSIGN = "$HTTP"+$REQ.$VALUE[...] - - ... - - ' - - pattern-inside: '$ASSIGN = "$HTTP"+$REQ.$VALUE[...] + $...A - - ... - - ' - - pattern-inside: '$ASSIGN = `$HTTP${$REQ.$VALUE[...]}...` - - ... - - ' + - pattern-inside: "$ASSIGN = \"$HTTP\"+ $REQ. ... .$VALUE\n...\n" + - pattern-inside: "$ASSIGN = \"$HTTP\"+$REQ. ... .$VALUE + $...A\n...\n" + - pattern-inside: "$ASSIGN = \"$HTTP\"+$REQ.$VALUE[...]\n...\n" + - pattern-inside: "$ASSIGN = \"$HTTP\"+$REQ.$VALUE[...] + $...A\n...\n" + - pattern-inside: "$ASSIGN = `$HTTP${$REQ.$VALUE[...]}...`\n...\n" - metavariable-regex: metavariable: $HTTP regex: ^(https?:\/\/|//)$ @@ -3005,52 +2151,90 @@ rules: - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|patch|del|head|delete)$ -- id: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization - message: The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) - through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and - Buffer.from(). - options: - interfile: true + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, ...) {...} + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: "({ $REQ }: Request,...) =>\n{...}\n" + - pattern-inside: "({ $REQ }: $EXPRESS.Request,...) => {...}\n" + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + severity: WARNING +- id: + javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization + languages: + - javascript + - typescript + message: The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution + (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as + JSON.parse() and Buffer.from(). metadata: - interfile: true - technology: - - express category: security + confidence: HIGH cwe: - 'CWE-502: Deserialization of Untrusted Data' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html - source_rule_url: - - https://github.com/ajinabraham/njsscan/blob/75bfbeb9c8d72999e4d527dfa2548f7f0f3cc48a/njsscan/rules/semantic_grep/eval/eval_deserialize.yaml + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization - shortlink: https://sg.run/8W5j + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 22084 - rv_id: 1263145 rule_id: 9AUyqj + rv_id: 1263145 + url: + https://semgrep.dev/playground/r/gETB7nD/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization version_id: gETB7nD - url: https://semgrep.dev/playground/r/gETB7nD/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/8W5j + source: + https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization + source_rule_url: + - https://github.com/ajinabraham/njsscan/blob/75bfbeb9c8d72999e4d527dfa2548f7f0f3cc48a/njsscan/rules/semantic_grep/eval/eval_deserialize.yaml + subcategory: + - vuln + technology: + - express + vulnerability_class: + - 'Insecure Deserialization ' mode: taint + options: + interfile: true + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: "$SER = require('$IMPORT')\n...\n" + - pattern-inside: "import $SER from '$IMPORT'\n ...\n" + - pattern-inside: "import * as $SER from '$IMPORT'\n...\n" + - metavariable-regex: + metavariable: $IMPORT + regex: ^(node-serialize|serialize-to-js)$ + - pattern: $SER.$FUNC(...) + - metavariable-regex: + metavariable: $FUNC + regex: ^(unserialize|deserialize)$ pattern-sources: - patterns: - pattern-either: @@ -3073,14 +2257,8 @@ rules: - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -3090,68 +2268,55 @@ rules: - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') - pattern-sinks: - - pattern-either: - - patterns: - - pattern-either: - - pattern-inside: '$SER = require(''$IMPORT'') - - ... - - ' - - pattern-inside: "import $SER from '$IMPORT'\n ...\n" - - pattern-inside: 'import * as $SER from ''$IMPORT'' - - ... - - ' - - metavariable-regex: - metavariable: $IMPORT - regex: ^(node-serialize|serialize-to-js)$ - - pattern: $SER.$FUNC(...) - - metavariable-regex: - metavariable: $FUNC - regex: ^(unserialize|deserialize)$ + severity: WARNING - id: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event - message: Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it - can result in XML External or Internal Entity (XXE) Processing vulnerabilities + languages: + - javascript + - typescript + message: Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as + it can result in XML External or Internal Entity (XXE) Processing vulnerabilities metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - cwe: - - 'CWE-611: Improper Restriction of XML External Entity Reference' - category: security - technology: - - express references: - https://www.npmjs.com/package/xml2json - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event - shortlink: https://sg.run/x1AA semgrep.dev: rule: + origin: community r_id: 9274 - rv_id: 1263146 rule_id: 8GUjkk + rv_id: 1263146 + url: + https://semgrep.dev/playground/r/QkTGqgo/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event version_id: QkTGqgo - url: https://semgrep.dev/playground/r/QkTGqgo/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/x1AA + source: + https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event + subcategory: + - vuln + technology: + - express + vulnerability_class: + - XML Injection mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "require('xml2json');\n...\n" + - pattern-inside: "import 'xml2json';\n...\n" + - pattern: $REQ.on('...', function(...) { ... $EXPAT.toJson($INPUT,...); ... }) + - focus-metavariable: $INPUT pattern-sources: - patterns: - pattern-either: @@ -3172,12 +2337,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -3185,68 +2346,59 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: 'require(''xml2json''); - - ... - - ' - - pattern-inside: 'import ''xml2json''; - - ... - - ' - - pattern: $REQ.on('...', function(...) { ... $EXPAT.toJson($INPUT,...); ... }) - - focus-metavariable: $INPUT + severity: WARNING - id: javascript.express.security.audit.res-render-injection.res-render-injection - message: User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages - that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` - to access other HTML pages on the file system. Where possible, do not allow users to define what should be loaded in - $RES.render or use an allow list for the existing application. - options: - interfile: true + languages: + - javascript + - typescript + message: User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating + pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. + `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what + should be loaded in $RES.render or use an allow list for the existing application. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' + impact: MEDIUM interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' - category: security - technology: - - express references: - http://expressjs.com/en/4x/api.html#res.render - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection - shortlink: https://sg.run/eLjd semgrep.dev: rule: + origin: community r_id: 9276 - rv_id: 1263149 rule_id: QrUzrq + rv_id: 1263149 + url: + https://semgrep.dev/playground/r/PkTR3OY/javascript.express.security.audit.res-render-injection.res-render-injection version_id: PkTR3OY - url: https://semgrep.dev/playground/r/PkTR3OY/javascript.express.security.audit.res-render-injection.res-render-injection - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/eLjd + source: https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Improper Authorization mode: taint - pattern-sources: + options: + interfile: true + pattern-sinks: - patterns: - pattern-either: - - pattern-inside: function ... ($REQ, $RES) {...} - - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - pattern: $RES.render($SINK, ...) + - focus-metavariable: $SINK + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) @@ -3262,14 +2414,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -3277,261 +2423,102 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern: $RES.render($SINK, ...) - - focus-metavariable: $SINK + severity: WARNING - id: javascript.express.security.audit.xss.direct-response-write.direct-response-write - message: Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may - expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped - HTML. - options: - interfile: true + languages: + - javascript + - typescript + message: Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and + may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render + safely escaped HTML. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM interfile: true - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - category: security - technology: - - express - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - vulnerability_class: - - Cross-Site-Scripting (XSS) - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write - shortlink: https://sg.run/vzGl + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9277 - rv_id: 1263150 rule_id: 3qUPA1 + rv_id: 1263150 + url: + https://semgrep.dev/playground/r/JdTzxeg/javascript.express.security.audit.xss.direct-response-write.direct-response-write version_id: JdTzxeg - url: https://semgrep.dev/playground/r/JdTzxeg/javascript.express.security.audit.xss.direct-response-write.direct-response-write - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/vzGl + source: https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: function ... ($REQ, $RES) {...} - - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - - patterns: - - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - - metavariable-regex: - metavariable: $METHOD - regex: ^(get|post|put|head|delete|options) - - pattern-not-inside: "function ... ($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" - - pattern-not-inside: "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n\ - })\n" - - pattern-not-inside: "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" - - pattern-not-inside: "function ... ($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n}\n" - - pattern-not-inside: "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n})\n" - - pattern-not-inside: "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.set('$TYPE')\n}\n" - - pattern-either: - - pattern: $REQ.query - - pattern: $REQ.body - - pattern: $REQ.params - - patterns: - - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' - - pattern-not-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.$SET('Content-Type',\ - \ '$TYPE')\n}\n" - - pattern-not-inside: "({ $REQ }: Request,$RES: Response) => {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" - - pattern-not-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.set('$TYPE')\n\ - }\n" - - focus-metavariable: $REQ - - pattern-either: - - pattern: params - - pattern: query - - pattern: body - pattern-sinks: - - patterns: - - pattern-inside: function ... (..., $RES,...) {...} - - pattern-either: - - pattern: $RES.write($ARG) - - pattern: $RES.send($ARG) - - pattern-not: $RES. ... .set('...'). ... .send($ARG) - - pattern-not: $RES. ... .type('...'). ... .send($ARG) - - pattern-not-inside: $RES.$METHOD({ ... }) - - focus-metavariable: $ARG + options: + interfile: true pattern-sanitizers: - patterns: - pattern-either: - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import * as $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: '$S = require("underscore.string") - - ... - - ' + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "import * as $S from \"underscore.string\"\n...\n" + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "$S = require(\"underscore.string\")\n...\n" - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from "dompurify" - - ... - - ' - - pattern-inside: 'import { ..., $S,... } from "dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "dompurify" - - ... - - ' - - pattern-inside: '$S = require("dompurify") - - ... - - ' - - pattern-inside: 'import $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: '$S = require("isomorphic-dompurify") - - ... - - ' + - pattern-inside: "import $S from \"dompurify\"\n...\n" + - pattern-inside: "import { ..., $S,... } from \"dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"dompurify\"\n...\n" + - pattern-inside: "$S = require(\"dompurify\")\n...\n" + - pattern-inside: "import $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "$S = require(\"isomorphic-dompurify\")\n...\n" - pattern-either: - patterns: - - pattern-inside: '$VALUE = $S(...) - - ... - - ' + - pattern-inside: "$VALUE = $S(...)\n...\n" - pattern: $VALUE.sanitize(...) - patterns: - - pattern-inside: '$VALUE = $S.sanitize - - ... - - ' + - pattern-inside: "$VALUE = $S.sanitize\n...\n" - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''xss''; - - ... - - ' - - pattern-inside: 'import * as $S from ''xss''; - - ... - - ' - - pattern-inside: '$S = require("xss") - - ... - - ' + - pattern-inside: "import $S from 'xss';\n...\n" + - pattern-inside: "import * as $S from 'xss';\n...\n" + - pattern-inside: "$S = require(\"xss\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''sanitize-html''; - - ... - - ' - - pattern-inside: 'import * as $S from "sanitize-html"; - - ... - - ' - - pattern-inside: '$S = require("sanitize-html") - - ... - - ' + - pattern-inside: "import $S from 'sanitize-html';\n...\n" + - pattern-inside: "import * as $S from \"sanitize-html\";\n...\n" + - pattern-inside: "$S = require(\"sanitize-html\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: '$S = new Remarkable() - - ... - - ' + - pattern-inside: "$S = new Remarkable()\n...\n" - pattern: $S.render(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''express-xss-sanitizer''; - - ... - - ' - - pattern-inside: 'import * as $S from "express-xss-sanitizer"; - - ... - - ' - - pattern-inside: 'const { ..., $S, ... } = require(''express-xss-sanitizer''); - - ... - - ' - - pattern-inside: 'var { ..., $S, ... } = require(''express-xss-sanitizer''); - - ... - - ' - - pattern-inside: 'let { ...,$S,... } = require(''express-xss-sanitizer''); - - ... - - ' - - pattern-inside: '$S = require("express-xss-sanitizer") - - ... - - ' + - pattern-inside: "import $S from 'express-xss-sanitizer';\n...\n" + - pattern-inside: "import * as $S from \"express-xss-sanitizer\";\n...\n" + - pattern-inside: "const { ..., $S, ... } = require('express-xss-sanitizer');\n...\n" + - pattern-inside: "var { ..., $S, ... } = require('express-xss-sanitizer');\n...\n" + - pattern-inside: "let { ...,$S,... } = require('express-xss-sanitizer');\n...\n" + - pattern-inside: "$S = require(\"express-xss-sanitizer\")\n...\n" - pattern: $S(...) - patterns: - pattern: $RES. ... .type('$F'). ... .send(...) @@ -3539,149 +2526,104 @@ rules: metavariable: $F regex: (?!.*text/html) - patterns: - - pattern-inside: '$X = [...]; - - ... - - ' + - pattern-inside: "$X = [...];\n...\n" - pattern: "if(<... !$X.includes($SOURCE)...>) {\n ...\n return ...\n}\n...\n" - pattern: $SOURCE -- id: javascript.express.security.cors-misconfiguration.cors-misconfiguration - message: By letting user input control CORS parameters, there is a risk that software does not properly verify that the - source of data or communication is valid. Use literal values for CORS settings. - metadata: - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - cwe: - - 'CWE-346: Origin Validation Error' - category: security - references: - - https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS - technology: - - express - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration - shortlink: https://sg.run/nKXO - semgrep.dev: - rule: - r_id: 13580 - rv_id: 1263162 - rule_id: 5rULJQ - version_id: YDTZe8Y - url: https://semgrep.dev/playground/r/YDTZe8Y/javascript.express.security.cors-misconfiguration.cors-misconfiguration - origin: community - languages: - - javascript - - typescript - severity: WARNING - mode: taint + pattern-sinks: + - patterns: + - pattern-inside: function ... (..., $RES,...) {...} + - pattern-either: + - pattern: $RES.write($ARG) + - pattern: $RES.send($ARG) + - pattern-not: $RES. ... .set('...'). ... .send($ARG) + - pattern-not: $RES. ... .type('...'). ... .send($ARG) + - pattern-not-inside: $RES.$METHOD({ ... }) + - focus-metavariable: $ARG pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - - pattern-either: - - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - metavariable-regex: metavariable: $METHOD - regex: ^(get|post|put|head|delete|options)$ + regex: ^(get|post|put|head|delete|options) + - pattern-not-inside: "function ... ($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" + - pattern-not-inside: "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n\ + })\n" + - pattern-not-inside: "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" + - pattern-not-inside: "function ... ($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n}\n" + - pattern-not-inside: "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n})\n" + - pattern-not-inside: "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.set('$TYPE')\n}\n" - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - - pattern: $REQ.cookies - - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" + - pattern-not-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.$SET('Content-Type', + '$TYPE')\n}\n" + - pattern-not-inside: "({ $REQ }: Request,$RES: Response) => {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" + - pattern-not-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.set('$TYPE')\n\ + }\n" - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - - pattern: cookies - - pattern: headers - pattern: body + severity: WARNING +- id: javascript.express.security.cors-misconfiguration.cors-misconfiguration + languages: + - javascript + - typescript + message: By letting user input control CORS parameters, there is a risk that software does not properly verify that + the source of data or communication is valid. Use literal values for CORS settings. + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-346: Origin Validation Error' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS + semgrep.dev: + rule: + origin: community + r_id: 13580 + rule_id: 5rULJQ + rv_id: 1263162 + url: + https://semgrep.dev/playground/r/YDTZe8Y/javascript.express.security.cors-misconfiguration.cors-misconfiguration + version_id: YDTZe8Y + shortlink: https://sg.run/nKXO + source: https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Improper Authentication + mode: taint pattern-sinks: - patterns: - pattern-either: - pattern: $RES.set($HEADER, $X) - pattern: $RES.header($HEADER, $X) - pattern: $RES.setHeader($HEADER, $X) - - pattern: '$RES.set({$HEADER: $X}, ...) - - ' - - pattern: '$RES.writeHead($STATUS, {$HEADER: $X}, ...) - - ' + - pattern: "$RES.set({$HEADER: $X}, ...)\n" + - pattern: "$RES.writeHead($STATUS, {$HEADER: $X}, ...)\n" - focus-metavariable: $X - metavariable-regex: metavariable: $HEADER regex: .*(Access-Control-Allow-Origin|access-control-allow-origin).* -- id: javascript.express.security.express-expat-xxe.express-expat-xxe - message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal - Entity (XXE) Processing vulnerabilities. - options: - interfile: true - metadata: - interfile: true - owasp: - - A04:2017 - XML External Entities (XXE) - - A05:2021 - Security Misconfiguration - - A02:2025 - Security Misconfiguration - cwe: - - 'CWE-611: Improper Restriction of XML External Entity Reference' - asvs: - section: V5 Validation, Sanitization and Encoding - control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention - version: '4' - references: - - https://github.com/astro/node-expat - category: security - technology: - - express - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe - shortlink: https://sg.run/BkXx - semgrep.dev: - rule: - r_id: 9251 - rv_id: 1263164 - rule_id: zdUkJl - version_id: o5TbD5l - url: https://semgrep.dev/playground/r/o5TbD5l/javascript.express.security.express-expat-xxe.express-expat-xxe - origin: community - languages: - - javascript - - typescript - severity: ERROR - mode: taint pattern-sources: - patterns: - pattern-either: @@ -3702,14 +2644,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -3717,94 +2653,67 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '$XML = require(''node-expat'') - - ... - - ' - - pattern-inside: 'import $XML from ''node-expat'' - - ... - - ' - - pattern-inside: 'import * as $XML from ''node-expat'' - - ... - - ' - - pattern-either: - - pattern-inside: '$PARSER = new $XML.Parser(...); - - ... - - ' - - pattern-either: - - pattern: $PARSER.parse($QUERY) - - pattern: $PARSER.write($QUERY) - - focus-metavariable: $QUERY -- id: javascript.express.security.express-insecure-template-usage.express-insecure-template-usage - message: User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) - vulnerability. - options: - interfile: true + severity: WARNING +- id: javascript.express.security.express-expat-xxe.express-expat-xxe + languages: + - javascript + - typescript + message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or + Internal Entity (XXE) Processing vulnerabilities. metadata: - interfile: true + asvs: + control_id: 5.5.2 Insecue XML Deserialization + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding + version: '4' category: security + confidence: MEDIUM cwe: - - 'CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine' - owasp: - - A03:2021 - Injection - - A01:2017 - Injection - - A05:2025 - Injection - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html - technology: - - javascript - - typescript - - express - - pug - - jade - - dot - - ejs - - nunjucks - - lodash - - handlbars - - mustache - - hogan.js - - eta - - squirrelly - source_rule_url: - - https://github.com/github/codeql/blob/2ba2642c7ab29b9eedef33bcc2b8cd1d203d0c10/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/template-sinks.js - subcategory: - - vuln - likelihood: MEDIUM + - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM + interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage - shortlink: https://sg.run/b49v + likelihood: MEDIUM + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://github.com/astro/node-expat semgrep.dev: rule: - r_id: 19226 - rv_id: 1263165 - rule_id: EwUr9k - version_id: zyTb2eD - url: https://semgrep.dev/playground/r/zyTb2eD/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage origin: community - languages: - - javascript - - typescript - severity: WARNING + r_id: 9251 + rule_id: zdUkJl + rv_id: 1263164 + url: https://semgrep.dev/playground/r/o5TbD5l/javascript.express.security.express-expat-xxe.express-expat-xxe + version_id: o5TbD5l + shortlink: https://sg.run/BkXx + source: https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe + subcategory: + - vuln + technology: + - express + vulnerability_class: + - XML Injection mode: taint - pattern-propagators: - - pattern: $MODEL.$FIND($E).then((...,$S,...)=>{...}) - from: $E - to: $S + options: + interfile: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "$XML = require('node-expat')\n...\n" + - pattern-inside: "import $XML from 'node-expat'\n...\n" + - pattern-inside: "import * as $XML from 'node-expat'\n...\n" + - pattern-either: + - pattern-inside: "$PARSER = new $XML.Parser(...);\n...\n" + - pattern-either: + - pattern: $PARSER.parse($QUERY) + - pattern: $PARSER.write($QUERY) + - focus-metavariable: $QUERY pattern-sources: - patterns: - pattern-either: @@ -3825,14 +2734,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -3840,30 +2743,76 @@ rules: - pattern: cookies - pattern: headers - pattern: body + severity: ERROR +- id: javascript.express.security.express-insecure-template-usage.express-insecure-template-usage + languages: + - javascript + - typescript + message: User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection + (SSTI) vulnerability. + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine' + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A03:2021 - Injection + - A01:2017 - Injection + - A05:2025 - Injection + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html + semgrep.dev: + rule: + origin: community + r_id: 19226 + rule_id: EwUr9k + rv_id: 1263165 + url: + https://semgrep.dev/playground/r/zyTb2eD/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage + version_id: zyTb2eD + shortlink: https://sg.run/b49v + source: + https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage + source_rule_url: + - https://github.com/github/codeql/blob/2ba2642c7ab29b9eedef33bcc2b8cd1d203d0c10/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/template-sinks.js + subcategory: + - vuln + technology: + - javascript + - typescript + - express + - pug + - jade + - dot + - ejs + - nunjucks + - lodash + - handlbars + - mustache + - hogan.js + - eta + - squirrelly + vulnerability_class: + - Code Injection + mode: taint + options: + interfile: true + pattern-propagators: + - from: $E + pattern: $MODEL.$FIND($E).then((...,$S,...)=>{...}) + to: $S pattern-sinks: - pattern-either: - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''pug'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''pug'' - - ... - - ' - - pattern-inside: '$PUG = require(''jade'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''jade'' - - ... - - ' + - pattern-inside: "$PUG = require('pug')\n...\n" + - pattern-inside: "import * as $PUG from 'pug'\n...\n" + - pattern-inside: "$PUG = require('jade')\n...\n" + - pattern-inside: "import * as $PUG from 'jade'\n...\n" - pattern-either: - pattern: $PUG.compile(...) - pattern: $PUG.compileClient(...) @@ -3871,234 +2820,47 @@ rules: - pattern: $PUG.render(...) - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''dot'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''dot'' - - ... - - ' + - pattern-inside: "$PUG = require('dot')\n...\n" + - pattern-inside: "import * as $PUG from 'dot'\n...\n" - pattern-either: - pattern: $PUG.template(...) - pattern: $PUG.compile(...) - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''ejs'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''ejs'' - - ... - - ' + - pattern-inside: "$PUG = require('ejs')\n...\n" + - pattern-inside: "import * as $PUG from 'ejs'\n...\n" - pattern-either: - pattern: $PUG.render(...) - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''nunjucks'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''nunjucks'' - - ... - - ' + - pattern-inside: "$PUG = require('nunjucks')\n...\n" + - pattern-inside: "import * as $PUG from 'nunjucks'\n...\n" - pattern-either: - pattern: $PUG.renderString(...) - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''lodash'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''lodash'' - - ... - - ' + - pattern-inside: "$PUG = require('lodash')\n...\n" + - pattern-inside: "import * as $PUG from 'lodash'\n...\n" - pattern-either: - pattern: $PUG.template(...) - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''mustache'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''mustache'' - - ... - - ' - - pattern-inside: '$PUG = require(''eta'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''eta'' - - ... - - ' - - pattern-inside: '$PUG = require(''squirrelly'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''squirrelly'' - - ... - - ' + - pattern-inside: "$PUG = require('mustache')\n...\n" + - pattern-inside: "import * as $PUG from 'mustache'\n...\n" + - pattern-inside: "$PUG = require('eta')\n...\n" + - pattern-inside: "import * as $PUG from 'eta'\n...\n" + - pattern-inside: "$PUG = require('squirrelly')\n...\n" + - pattern-inside: "import * as $PUG from 'squirrelly'\n...\n" - pattern-either: - pattern: $PUG.render(...) - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''hogan.js'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''hogan.js'' - - ... - - ' - - pattern-inside: '$PUG = require(''handlebars'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''handlebars'' - - ... - - ' + - pattern-inside: "$PUG = require('hogan.js')\n...\n" + - pattern-inside: "import * as $PUG from 'hogan.js'\n...\n" + - pattern-inside: "$PUG = require('handlebars')\n...\n" + - pattern-inside: "import * as $PUG from 'handlebars'\n...\n" - pattern-either: - pattern: $PUG.compile(...) -- id: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). - options: - interfile: true - metadata: - interfile: true - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - category: security - technology: - - express - - secrets - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret - shortlink: https://sg.run/Do1d - semgrep.dev: - rule: - r_id: 9252 - rv_id: 1263166 - rule_id: pKUOjy - version_id: pZT03Q0 - url: https://semgrep.dev/playground/r/pZT03Q0/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret - origin: community - languages: - - javascript - - typescript - severity: WARNING - patterns: - - pattern-either: - - pattern-inside: '$JWT = require(''express-jwt''); - - ... - - ' - - pattern-inside: 'import $JWT from ''express-jwt''; - - ... - - ' - - pattern-inside: 'import * as $JWT from ''express-jwt''; - - ... - - ' - - pattern-inside: 'import { ..., $JWT, ... } from ''express-jwt''; - - ... - - ' - - pattern-either: - - pattern: '$JWT({...,secret: "$Y",...},...) - - ' - - pattern: '$OPTS = "$Y"; - - ... - - $JWT({...,secret: $OPTS},...); - - ' - - focus-metavariable: $Y -- id: javascript.express.security.express-phantom-injection.express-phantom-injection - message: If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities - metadata: - owasp: - - A10:2021 - Server-Side Request Forgery (SSRF) - - A01:2025 - Broken Access Control - cwe: - - 'CWE-918: Server-Side Request Forgery (SSRF)' - category: security - technology: - - express - references: - - https://phantomjs.org/page-automation.html - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection - shortlink: https://sg.run/W8BL - semgrep.dev: - rule: - r_id: 9253 - rv_id: 1263167 - rule_id: 2ZUbx3 - version_id: 2KTv26p - url: https://semgrep.dev/playground/r/2KTv26p/javascript.express.security.express-phantom-injection.express-phantom-injection - origin: community - languages: - - javascript - - typescript - severity: ERROR - mode: taint pattern-sources: - patterns: - pattern-either: @@ -4119,14 +2881,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -4134,64 +2890,113 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: 'require(''phantom''); - - ... - - ' - - pattern-inside: 'import ''phantom''; - - ... - - ' - - pattern-either: - - pattern: $PAGE.open($SINK,...) - - pattern: $PAGE.setContent($SINK,...) - - pattern: $PAGE.openUrl($SINK,...) - - pattern: $PAGE.evaluateJavaScript($SINK,...) - - pattern: $PAGE.property("content",$SINK,...) - - focus-metavariable: $SINK -- id: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection - message: If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities + severity: WARNING +- id: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret + languages: + - javascript + - typescript + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - owasp: - - A10:2021 - Server-Side Request Forgery (SSRF) - - A01:2025 - Broken Access Control - cwe: - - 'CWE-918: Server-Side Request Forgery (SSRF)' category: security - technology: - - express - references: - - https://pptr.dev/api/puppeteer.page - cwe2022-top25: true + confidence: HIGH + cwe: + - 'CWE-798: Use of Hard-coded Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM + interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection - shortlink: https://sg.run/0QJB + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: - r_id: 9254 - rv_id: 1263168 - rule_id: X5U8Nz - version_id: X0TzyJY - url: https://semgrep.dev/playground/r/X0TzyJY/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection origin: community + r_id: 9252 + rule_id: pKUOjy + rv_id: 1263166 + url: + https://semgrep.dev/playground/r/pZT03Q0/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret + version_id: pZT03Q0 + shortlink: https://sg.run/Do1d + source: https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret + subcategory: + - audit + technology: + - express + - secrets + vulnerability_class: + - Hard-coded Secrets + options: + interfile: true + patterns: + - pattern-either: + - pattern-inside: "$JWT = require('express-jwt');\n...\n" + - pattern-inside: "import $JWT from 'express-jwt';\n...\n" + - pattern-inside: "import * as $JWT from 'express-jwt';\n...\n" + - pattern-inside: "import { ..., $JWT, ... } from 'express-jwt';\n...\n" + - pattern-either: + - pattern: "$JWT({...,secret: \"$Y\",...},...)\n" + - pattern: "$OPTS = \"$Y\";\n...\n$JWT({...,secret: $OPTS},...);\n" + - focus-metavariable: $Y + severity: WARNING +- id: javascript.express.security.express-phantom-injection.express-phantom-injection languages: - javascript - typescript - severity: ERROR + message: If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery + vulnerabilities + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://phantomjs.org/page-automation.html + semgrep.dev: + rule: + origin: community + r_id: 9253 + rule_id: 2ZUbx3 + rv_id: 1263167 + url: + https://semgrep.dev/playground/r/2KTv26p/javascript.express.security.express-phantom-injection.express-phantom-injection + version_id: 2KTv26p + shortlink: https://sg.run/W8BL + source: https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "require('phantom');\n...\n" + - pattern-inside: "import 'phantom';\n...\n" + - pattern-either: + - pattern: $PAGE.open($SINK,...) + - pattern: $PAGE.setContent($SINK,...) + - pattern: $PAGE.openUrl($SINK,...) + - pattern: $PAGE.evaluateJavaScript($SINK,...) + - pattern: $PAGE.property("content",$SINK,...) + - focus-metavariable: $SINK pattern-sources: - patterns: - pattern-either: @@ -4212,14 +3017,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -4227,19 +3026,51 @@ rules: - pattern: cookies - pattern: headers - pattern: body + severity: ERROR +- id: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection + languages: + - javascript + - typescript + message: If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery + vulnerabilities + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://pptr.dev/api/puppeteer.page + semgrep.dev: + rule: + origin: community + r_id: 9254 + rule_id: X5U8Nz + rv_id: 1263168 + url: + https://semgrep.dev/playground/r/X0TzyJY/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection + version_id: X0TzyJY + shortlink: https://sg.run/0QJB + source: https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Server-Side Request Forgery (SSRF) + mode: taint pattern-sinks: - patterns: - pattern-either: - - pattern-inside: 'require(''puppeteer''); - - ... - - ' - - pattern-inside: 'import ''puppeteer''; - - ... - - ' + - pattern-inside: "require('puppeteer');\n...\n" + - pattern-inside: "import 'puppeteer';\n...\n" - pattern-either: - pattern: $PAGE.goto($SINK,...) - pattern: $PAGE.setContent($SINK,...) @@ -4250,43 +3081,82 @@ rules: - pattern: $PAGE.evaluateOnNewDocument($SINK,...) - pattern: $PAGE.evaluateOnNewDocument($CODE,$SINK,...) - focus-metavariable: $SINK + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + severity: ERROR - id: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection + languages: + - javascript + - typescript message: Make sure that unverified user data can not reach `sandbox`. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html - cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' - category: security - technology: - - express - cwe2022-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection - shortlink: https://sg.run/KlwL semgrep.dev: rule: + origin: community r_id: 9255 - rv_id: 1263169 rule_id: j2UvXB + rv_id: 1263169 + url: + https://semgrep.dev/playground/r/jQTn59D/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection version_id: jQTn59D - url: https://semgrep.dev/playground/r/jQTn59D/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/KlwL + source: https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Code Injection mode: taint + pattern-sinks: + - patterns: + - pattern-inside: "$SANDBOX = require('sandbox');\n...\n" + - pattern-either: + - patterns: + - pattern-inside: "$S = new $SANDBOX(...);\n...\n" + - pattern: "$S.run(...)\n" + - pattern: "new $SANDBOX($OPTS).run(...)\n" + - pattern: new $SANDBOX().run(...) pattern-sources: - patterns: - pattern-either: @@ -4307,14 +3177,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -4322,64 +3186,53 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-inside: '$SANDBOX = require(''sandbox''); - - ... - - ' - - pattern-either: - - patterns: - - pattern-inside: '$S = new $SANDBOX(...); - - ... - - ' - - pattern: '$S.run(...) - - ' - - pattern: 'new $SANDBOX($OPTS).run(...) - - ' - - pattern: new $SANDBOX().run(...) + severity: ERROR - id: javascript.express.security.express-vm-injection.express-vm-injection + languages: + - javascript + - typescript message: Make sure that unverified user data can not reach `$VM`. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html - cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' - category: security - technology: - - express - cwe2022-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection - shortlink: https://sg.run/jkqJ semgrep.dev: rule: + origin: community r_id: 12821 - rv_id: 1263170 rule_id: DbUKPX + rv_id: 1263170 + url: + https://semgrep.dev/playground/r/1QTypXQ/javascript.express.security.express-vm-injection.express-vm-injection version_id: 1QTypXQ - url: https://semgrep.dev/playground/r/1QTypXQ/javascript.express.security.express-vm-injection.express-vm-injection - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/jkqJ + source: https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Code Injection mode: taint + pattern-sinks: + - patterns: + - pattern-inside: "$VM = require('vm');\n...\n" + - pattern-either: + - pattern: "$VM.runInContext(...)\n" + - pattern: "$VM.runInNewContext(...)\n" + - pattern: "$VM.compileFunction(...)\n" + - pattern: "$VM.runInThisContext(...)\n" + - pattern: new $VM.Script(...) pattern-sources: - patterns: - pattern-either: @@ -4400,14 +3253,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -4415,64 +3262,58 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-inside: '$VM = require(''vm''); - - ... - - ' - - pattern-either: - - pattern: '$VM.runInContext(...) - - ' - - pattern: '$VM.runInNewContext(...) - - ' - - pattern: '$VM.compileFunction(...) - - ' - - pattern: '$VM.runInThisContext(...) - - ' - - pattern: new $VM.Script(...) + severity: ERROR - id: javascript.express.security.express-vm2-injection.express-vm2-injection + languages: + - javascript + - typescript message: Make sure that unverified user data can not reach `vm2`. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html - cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' - category: security - technology: - - express - cwe2022-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection - shortlink: https://sg.run/1GWv semgrep.dev: rule: + origin: community r_id: 12822 - rv_id: 1263171 rule_id: WAUPXJ + rv_id: 1263171 + url: + https://semgrep.dev/playground/r/9lT4bnX/javascript.express.security.express-vm2-injection.express-vm2-injection version_id: 9lT4bnX - url: https://semgrep.dev/playground/r/9lT4bnX/javascript.express.security.express-vm2-injection.express-vm2-injection - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/1GWv + source: https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Code Injection mode: taint + pattern-sinks: + - patterns: + - pattern-inside: "require('vm2')\n...\n" + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: "$VM = new VM(...)\n...\n" + - pattern-inside: "$VM = new NodeVM(...)\n...\n" + - pattern: "$VM.run(...)\n" + - pattern: "new VM(...).run(...)\n" + - pattern: "new NodeVM(...).run(...)\n" + - pattern: "new VMScript(...)\n" + - pattern: "new VM(...)\n" + - pattern: new NodeVM(...) pattern-sources: - patterns: - pattern-either: @@ -4493,14 +3334,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -4508,87 +3343,60 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-inside: 'require(''vm2'') - - ... - - ' - - pattern-either: - - patterns: - - pattern-either: - - pattern-inside: '$VM = new VM(...) - - ... - - ' - - pattern-inside: '$VM = new NodeVM(...) - - ... - - ' - - pattern: '$VM.run(...) - - ' - - pattern: 'new VM(...).run(...) - - ' - - pattern: 'new NodeVM(...).run(...) - - ' - - pattern: 'new VMScript(...) - - ' - - pattern: 'new VM(...) - - ' - - pattern: new NodeVM(...) + severity: WARNING - id: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe - message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal - Entity (XXE) Processing vulnerabilities + languages: + - javascript + - typescript + message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or + Internal Entity (XXE) Processing vulnerabilities metadata: - owasp: - - A04:2017 - XML External Entities (XXE) - - A05:2021 - Security Misconfiguration - - A02:2025 - Security Misconfiguration - cwe: - - 'CWE-611: Improper Restriction of XML External Entity Reference' asvs: - section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding version: '4' category: security - technology: - - express - references: - - https://www.npmjs.com/package/xml2json - cwe2022-top25: true + confidence: MEDIUM + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe - shortlink: https://sg.run/XBD4 + likelihood: MEDIUM + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://www.npmjs.com/package/xml2json semgrep.dev: rule: + origin: community r_id: 9264 - rv_id: 1263174 rule_id: x8Uneb + rv_id: 1263174 + url: + https://semgrep.dev/playground/r/bZT534J/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe version_id: bZT534J - url: https://semgrep.dev/playground/r/bZT534J/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/XBD4 + source: https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe + subcategory: + - vuln + technology: + - express + vulnerability_class: + - XML Injection mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "require('xml2json');\n...\n" + - pattern-inside: "import 'xml2json';\n...\n" + - pattern: $EXPAT.toJson($SINK,...) + - focus-metavariable: $SINK pattern-sources: - patterns: - pattern-either: @@ -4611,14 +3419,8 @@ rules: - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -4628,62 +3430,64 @@ rules: - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: 'require(''xml2json''); - - ... - - ' - - pattern-inside: 'import ''xml2json''; - - ... - - ' - - pattern: $EXPAT.toJson($SINK,...) - - focus-metavariable: $SINK + severity: ERROR - id: javascript.express.security.injection.raw-html-format.raw-html-format - message: User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting - (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to - sanitize the HTML within. + languages: + - javascript + - typescript + message: User data flows into the host portion of this manually-constructed HTML. This can introduce a + Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization + library such as DOMPurify to sanitize the HTML within. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html - category: security - technology: - - express - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format - shortlink: https://sg.run/5DO3 semgrep.dev: rule: + origin: community r_id: 14691 - rv_id: 1263175 rule_id: 5rUL0X + rv_id: 1263175 + url: + https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format version_id: NdTzyQv - url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/5DO3 + source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$HTMLSTR" + $EXPR' + - pattern: '"$HTMLSTR".concat(...)' + - pattern: util.format($HTMLSTR, ...) + - metavariable-pattern: + language: generic + metavariable: $HTMLSTR + pattern: <$TAG ... + - patterns: + - pattern: "`...`\n" + - pattern-regex: ".*<\\w+.*\n" + requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN) pattern-sources: - label: EXPRESS patterns: @@ -4706,14 +3510,8 @@ rules: - label: EXPRESSTS patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -4721,8 +3519,8 @@ rules: - pattern: cookies - pattern: headers - pattern: body - - label: CLEAN - by-side-effect: true + - by-side-effect: true + label: CLEAN patterns: - pattern-either: - pattern: $A($SOURCE) @@ -4732,67 +3530,51 @@ rules: - metavariable-regex: metavariable: $A regex: (?i)(.*valid|.*sanitiz) - pattern-sinks: - - requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN) - patterns: - - pattern-either: - - patterns: - - pattern-either: - - pattern: '"$HTMLSTR" + $EXPR' - - pattern: '"$HTMLSTR".concat(...)' - - pattern: util.format($HTMLSTR, ...) - - metavariable-pattern: - metavariable: $HTMLSTR - language: generic - pattern: <$TAG ... - - patterns: - - pattern: '`...` - - ' - - pattern-regex: '.*<\w+.* - - ' + severity: WARNING - id: javascript.express.security.require-request.require-request - message: If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the - server. - options: - interfile: true + languages: + - javascript + - typescript + message: If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on + the server. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' + impact: MEDIUM interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' - source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html - category: security - technology: - - express references: - https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/javascript.express.security.require-request.require-request - shortlink: https://sg.run/jRbl semgrep.dev: rule: + origin: community r_id: 9265 - rv_id: 1263177 rule_id: OrU3WK - version_id: w8TRo0d + rv_id: 1263177 url: https://semgrep.dev/playground/r/w8TRo0d/javascript.express.security.require-request.require-request - origin: community - languages: - - javascript - - typescript - severity: ERROR + version_id: w8TRo0d + shortlink: https://sg.run/jRbl + source: https://semgrep.dev/r/javascript.express.security.require-request.require-request + source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Improper Authorization mode: taint + options: + interfile: true + pattern-sinks: + - patterns: + - pattern: require($SINK) + - focus-metavariable: $SINK pattern-sources: - patterns: - pattern-either: @@ -4813,14 +3595,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -4828,47 +3604,56 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern: require($SINK) - - focus-metavariable: $SINK + severity: ERROR - id: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration - message: By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify - whether or not a browser should be allowed to render a page in an `iframe`. + languages: + - javascript + - typescript + message: By letting user input control `X-Frame-Options` header, there is a risk that software does not properly + verify whether or not a browser should be allowed to render a page in an `iframe`. metadata: - references: - - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options - owasp: - - A04:2021 - Insecure Design - - A06:2025 - Insecure Design + category: security + confidence: MEDIUM cwe: - 'CWE-451: User Interface (UI) Misrepresentation of Critical Information' - category: security - technology: - - express - subcategory: - - vuln - likelihood: MEDIUM impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration - shortlink: https://sg.run/EvjA + likelihood: MEDIUM + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options semgrep.dev: rule: + origin: community r_id: 13581 - rv_id: 1263178 rule_id: GdUrLy + rv_id: 1263178 + url: + https://semgrep.dev/playground/r/xyTjz3D/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration version_id: xyTjz3D - url: https://semgrep.dev/playground/r/xyTjz3D/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/EvjA + source: + https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Other mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.set($HEADER, ...) + - pattern: $RES.header($HEADER, ...) + - pattern: $RES.setHeader($HEADER, ...) + - pattern: "$RES.set({$HEADER: ...}, ...)\n" + - pattern: "$RES.writeHead($STATUS, {$HEADER: ...}, ...)\n" + - metavariable-regex: + metavariable: $HEADER + regex: .*(X-Frame-Options|x-frame-options).* pattern-sources: - patterns: - pattern-either: @@ -4889,14 +3674,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -4904,520 +3683,391 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern: $RES.set($HEADER, ...) - - pattern: $RES.header($HEADER, ...) - - pattern: $RES.setHeader($HEADER, ...) - - pattern: '$RES.set({$HEADER: ...}, ...) - - ' - - pattern: '$RES.writeHead($STATUS, {$HEADER: ...}, ...) - - ' - - metavariable-regex: - metavariable: $HEADER - regex: .*(X-Frame-Options|x-frame-options).* -- id: javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash - patterns: - - pattern-either: - - pattern: 'window.intercomSettings = {..., email: $EMAIL, ...}; - - ' - - pattern: 'window.intercomSettings = {..., user_id: $USER_ID, ...}; - - ' - - pattern: 'Intercom(''boot'', {..., email: $EMAIL, ...}); - - ' - - pattern: 'Intercom(''boot'', {..., user_id: $USER_ID, ...}); - - ' - - pattern: '$VAR = {..., email: $EMAIL, ...}; - - ... - - Intercom(''boot'', $VAR); - - ' - - pattern: '$VAR = {..., user_id: $EMAIL, ...}; - - ... - - Intercom(''boot'', $VAR); - - ' - - pattern-not: 'window.intercomSettings = {..., user_hash: $USER_HASH, ...}; - - ' - - pattern-not: 'Intercom(''boot'', {..., user_hash: $USER_HASH, ...}); - - ' - - pattern-not: '$VAR = {..., user_hash: $USER_HASH, ...}; - - ... - - Intercom(''boot'', $VAR); - - ' - message: Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This - configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile + severity: WARNING +- id: + javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash languages: - js - severity: WARNING + message: Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. + This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more + context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile metadata: category: security - subcategory: - - audit + confidence: MEDIUM cwe: - 'CWE-287: Improper Authentication' - confidence: MEDIUM - likelihood: MEDIUM impact: HIGH - technology: - - intercom + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM references: - https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash - shortlink: https://sg.run/Eb5w semgrep.dev: rule: + origin: community r_id: 60237 - rv_id: 945842 rule_id: QrU96W + rv_id: 945842 + url: + https://semgrep.dev/playground/r/nWTpzDk/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash version_id: nWTpzDk - url: https://semgrep.dev/playground/r/nWTpzDk/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash - origin: community + shortlink: https://sg.run/Eb5w + source: + https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash + subcategory: + - audit + technology: + - intercom + vulnerability_class: + - Improper Authentication + patterns: + - pattern-either: + - pattern: "window.intercomSettings = {..., email: $EMAIL, ...};\n" + - pattern: "window.intercomSettings = {..., user_id: $USER_ID, ...};\n" + - pattern: "Intercom('boot', {..., email: $EMAIL, ...});\n" + - pattern: "Intercom('boot', {..., user_id: $USER_ID, ...});\n" + - pattern: "$VAR = {..., email: $EMAIL, ...};\n...\nIntercom('boot', $VAR);\n" + - pattern: "$VAR = {..., user_id: $EMAIL, ...};\n...\nIntercom('boot', $VAR);\n" + - pattern-not: "window.intercomSettings = {..., user_hash: $USER_HASH, ...};\n" + - pattern-not: "Intercom('boot', {..., user_hash: $USER_HASH, ...});\n" + - pattern-not: "$VAR = {..., user_hash: $USER_HASH, ...};\n...\nIntercom('boot', $VAR);\n" + severity: WARNING - id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + languages: + - javascript + - typescript + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - interfile: true - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures asvs: - section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' version: '4' category: security - technology: - - jose - - jwt - - secrets - cwe2022-top25: true + confidence: HIGH + cwe: + - 'CWE-798: Use of Hard-coded Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: HIGH + interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret - shortlink: https://sg.run/Ro1g + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9293 - rv_id: 1263182 rule_id: JDUyRl - version_id: d6TyxbX + rv_id: 1263182 url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: d6TyxbX + shortlink: https://sg.run/Ro1g + source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret + subcategory: + - vuln + technology: + - jose + - jwt + - secrets + vulnerability_class: + - Hard-coded Secrets + options: + interfile: true + symbolic_propagation: true patterns: - - pattern-inside: '$JOSE = require("jose"); - - ... - - ' + - pattern-inside: "$JOSE = require(\"jose\");\n...\n" - pattern-either: - - pattern-inside: 'var {JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'var {JWK, JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'const {JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'const {JWK, JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'let {JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'let {JWK, JWT} = $JOSE; - - ... - - ' + - pattern-inside: "var {JWT} = $JOSE;\n...\n" + - pattern-inside: "var {JWK, JWT} = $JOSE;\n...\n" + - pattern-inside: "const {JWT} = $JOSE;\n...\n" + - pattern-inside: "const {JWK, JWT} = $JOSE;\n...\n" + - pattern-inside: "let {JWT} = $JOSE;\n...\n" + - pattern-inside: "let {JWK, JWT} = $JOSE;\n...\n" - pattern-either: - - pattern: 'JWT.verify($P, "...", ...); - - ' - - pattern: 'JWT.sign($P, "...", ...); - - ' + - pattern: "JWT.verify($P, \"...\", ...);\n" + - pattern: "JWT.sign($P, \"...\", ...);\n" - pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...); \n" - - pattern: '$JWT.sign($P, JWK.asKey("..."), ...); - - ' - options: - symbolic_propagation: true - interfile: true + - pattern: "$JWT.sign($P, JWK.asKey(\"...\"), ...);\n" + severity: WARNING - id: javascript.jose.security.jwt-none-alg.jwt-none-alg - message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has - already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do - not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + languages: + - javascript + - typescript + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token + has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be + verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: + asvs: + control_id: 3.5.3 Insecue Stateless Session Tokens + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - asvs: - section: 'V3: Session Management Verification Requirements' - control_id: 3.5.3 Insecue Stateless Session Tokens - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management - version: '4' - category: security - technology: - - jose - - jwt - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg - shortlink: https://sg.run/AvRL semgrep.dev: rule: + origin: community r_id: 9294 - rv_id: 1263183 rule_id: 5rUOGN - version_id: ZRTKAyb + rv_id: 1263183 url: https://semgrep.dev/playground/r/ZRTKAyb/javascript.jose.security.jwt-none-alg.jwt-none-alg - origin: community + version_id: ZRTKAyb + shortlink: https://sg.run/AvRL + source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - vuln + technology: + - jose + - jwt + vulnerability_class: + - Cryptographic Issues + pattern-either: + - pattern: "var $JOSE = require(\"jose\");\n...\nvar { JWK, JWT } = $JOSE;\n...\nvar $T = JWT.verify($P, JWK.None,...);\n" + - pattern: "var $JOSE = require(\"jose\");\n...\nvar { JWK, JWT } = $JOSE;\n...\n$T = JWT.verify($P, JWK.None,...);\n" + - pattern: "var $JOSE = require(\"jose\");\n...\nvar { JWK, JWT } = $JOSE;\n...\nJWT.verify($P, JWK.None,...);\n" + severity: ERROR +- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret languages: - javascript - typescript - severity: ERROR - pattern-either: - - pattern: 'var $JOSE = require("jose"); - - ... - - var { JWK, JWT } = $JOSE; - - ... - - var $T = JWT.verify($P, JWK.None,...); - - ' - - pattern: 'var $JOSE = require("jose"); - - ... - - var { JWK, JWT } = $JOSE; - - ... - - $T = JWT.verify($P, JWK.None,...); - - ' - - pattern: 'var $JOSE = require("jose"); - - ... - - var { JWK, JWT } = $JOSE; - - ... - - JWT.verify($P, JWK.None,...); - - ' -- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures asvs: - section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' version: '4' category: security - technology: - - jwt - - javascript - - secrets - cwe2022-top25: true + confidence: HIGH + cwe: + - 'CWE-798: Use of Hard-coded Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret - shortlink: https://sg.run/4xN9 + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9300 - rv_id: 1263189 rule_id: WAUon7 - version_id: gETB75D + rv_id: 1263189 url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: gETB75D + shortlink: https://sg.run/4xN9 + source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret + subcategory: + - vuln + technology: + - jwt + - javascript + - secrets + vulnerability_class: + - Hard-coded Secrets mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "$JWT = require(\"jsonwebtoken\")\n...\n" + - pattern-inside: "import $JWT from \"jsonwebtoken\"\n...\n" + - pattern-inside: "import * as $JWT from \"jsonwebtoken\"\n...\n" + - pattern-inside: "import {...,$JWT,...} from \"jsonwebtoken\"\n...\n" + - pattern-either: + - pattern-inside: "$JWT.sign($DATA,$VALUE,...);\n" + - pattern-inside: "$JWT.verify($DATA,$VALUE,...);\n" + - focus-metavariable: $VALUE pattern-sources: - patterns: - pattern: "$X = '...' \n" - pattern: "$X = '$Y' \n" - patterns: - pattern-either: - - pattern-inside: '$JWT.sign($DATA,"...",...); - - ' - - pattern-inside: '$JWT.verify($DATA,"...",...); - - ' - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '$JWT = require("jsonwebtoken") - - ... - - ' - - pattern-inside: 'import $JWT from "jsonwebtoken" - - ... - - ' - - pattern-inside: 'import * as $JWT from "jsonwebtoken" - - ... - - ' - - pattern-inside: 'import {...,$JWT,...} from "jsonwebtoken" - - ... - - ' - - pattern-either: - - pattern-inside: '$JWT.sign($DATA,$VALUE,...); - - ' - - pattern-inside: '$JWT.verify($DATA,$VALUE,...); - - ' - - focus-metavariable: $VALUE + - pattern-inside: "$JWT.sign($DATA,\"...\",...);\n" + - pattern-inside: "$JWT.verify($DATA,\"...\",...);\n" + severity: WARNING - id: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg - message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has - already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do - not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + languages: + - javascript + - typescript + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token + has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be + verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: + asvs: + control_id: 3.5.3 Insecue Stateless Session Tokens + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' + version: '4' + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - asvs: - section: 'V3: Session Management Verification Requirements' - control_id: 3.5.3 Insecue Stateless Session Tokens - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management - version: '4' - category: security - technology: - - jwt - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg - shortlink: https://sg.run/PJXv semgrep.dev: rule: + origin: community r_id: 9301 - rv_id: 1263190 rule_id: 0oU53g - version_id: QkTGqQo + rv_id: 1263190 url: https://semgrep.dev/playground/r/QkTGqQo/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg - origin: community - languages: - - javascript - - typescript - severity: ERROR + version_id: QkTGqQo + shortlink: https://sg.run/PJXv + source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - vuln + technology: + - jwt + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: '$JWT = require("jsonwebtoken"); - - ... - - ' + - pattern-inside: "$JWT = require(\"jsonwebtoken\");\n...\n" - pattern: $JWT.verify($P, $X, {algorithms:[...,'none',...]},...) -- id: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify - message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the - token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` - before using the token. severity: ERROR +- id: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify + languages: + - javascript + - typescript + message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise + the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' + to `true` before using the token. metadata: - owasp: - - A05:2021 - Security Misconfiguration - - A07:2021 - Identification and Authentication Failures - - A02:2025 - Security Misconfiguration - - A07:2025 - Authentication Failures + category: security + confidence: HIGH cwe: - 'CWE-287: Improper Authentication' - 'CWE-345: Insufficient Verification of Data Authenticity' - 'CWE-347: Improper Verification of Cryptographic Signature' - category: security - subcategory: - - vuln - technology: - - jwt-simple - - jwt - confidence: HIGH - likelihood: MEDIUM impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A05:2021 - Security Misconfiguration + - A07:2021 - Identification and Authentication Failures + - A02:2025 - Security Misconfiguration + - A07:2025 - Authentication Failures references: - https://www.npmjs.com/package/jwt-simple - https://cwe.mitre.org/data/definitions/287 - https://cwe.mitre.org/data/definitions/345 - https://cwe.mitre.org/data/definitions/347 - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - - Improper Authentication - source: https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify - shortlink: https://sg.run/zdjod semgrep.dev: rule: + origin: community r_id: 120561 - rv_id: 1263191 rule_id: r6UyNLy + rv_id: 1263191 + url: + https://semgrep.dev/playground/r/3ZT4Xxv/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify version_id: 3ZT4Xxv - url: https://semgrep.dev/playground/r/3ZT4Xxv/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify - origin: community - languages: - - javascript - - typescript + shortlink: https://sg.run/zdjod + source: https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify + subcategory: + - vuln + technology: + - jwt-simple + - jwt + vulnerability_class: + - Cryptographic Issues + - Improper Authentication patterns: - - pattern-inside: '$JWT = require(''jwt-simple''); - - ... - - ' + - pattern-inside: "$JWT = require('jwt-simple');\n...\n" - pattern: $JWT.decode($TOKEN, $SECRET, $NOVERIFY, ...) - metavariable-pattern: metavariable: $NOVERIFY patterns: - pattern-either: - - pattern: 'true - - ' - - pattern: '"..." - - ' + - pattern: "true\n" + - pattern: "\"...\"\n" + severity: ERROR - id: javascript.lang.security.audit.code-string-concat.code-string-concat - message: Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead - to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible. - options: - interfile: true + languages: + - javascript + - typescript + message: Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can + lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever + possible. metadata: - interfile: true + category: security confidence: HIGH + cwe: + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' references: - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval - https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback - https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/ - https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html - category: security + semgrep.dev: + rule: + origin: community + r_id: 13023 + rule_id: DbUKEz + rv_id: 1263192 + url: + https://semgrep.dev/playground/r/44TEjYX/javascript.lang.security.audit.code-string-concat.code-string-concat + version_id: 44TEjYX + shortlink: https://sg.run/96Yk + source: https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat + subcategory: + - vuln technology: - node.js - Express - Next.js - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection - source: https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat - shortlink: https://sg.run/96Yk - semgrep.dev: - rule: - r_id: 13023 - rv_id: 1263192 - rule_id: DbUKEz - version_id: 44TEjYX - url: https://semgrep.dev/playground/r/44TEjYX/javascript.lang.security.audit.code-string-concat.code-string-concat - origin: community - languages: - - javascript - - typescript - severity: ERROR mode: taint + options: + interfile: true + pattern-sinks: + - patterns: + - pattern: "eval(...)\n" pattern-sources: - pattern-either: - patterns: @@ -5439,100 +4089,80 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: 'import { ...,$IMPORT,... } from ''next/router'' - - ... - - ' - - pattern-inside: 'import $IMPORT from ''next/router''; - - ... - - ' + - pattern-inside: "import { ...,$IMPORT,... } from 'next/router'\n...\n" + - pattern-inside: "import $IMPORT from 'next/router';\n...\n" - pattern-either: - patterns: - - pattern-inside: '$ROUTER = $IMPORT() - - ... - - ' + - pattern-inside: "$ROUTER = $IMPORT()\n...\n" - pattern-either: - - pattern-inside: 'const { ...,$PROPS,... } = $ROUTER.query - - ... - - ' - - pattern-inside: 'var { ...,$PROPS,... } = $ROUTER.query - - ... - - ' - - pattern-inside: 'let { ...,$PROPS,... } = $ROUTER.query - - ... - - ' + - pattern-inside: "const { ...,$PROPS,... } = $ROUTER.query\n...\n" + - pattern-inside: "var { ...,$PROPS,... } = $ROUTER.query\n...\n" + - pattern-inside: "let { ...,$PROPS,... } = $ROUTER.query\n...\n" - focus-metavariable: $PROPS - patterns: - - pattern-inside: '$ROUTER = $IMPORT() - - ... - - ' + - pattern-inside: "$ROUTER = $IMPORT()\n...\n" - pattern: "$ROUTER.query.$VALUE \n" - patterns: - pattern: $IMPORT().query.$VALUE - pattern-sinks: - - patterns: - - pattern: 'eval(...) - - ' + severity: ERROR - id: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli - message: 'Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled + languages: + - javascript + - typescript + message: "Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared - statements. An example of parameterized queries like so: `knex.raw(''SELECT $1 from table'', [userinput])` can help prevent - SQLi.' + statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent + SQLi." metadata: - confidence: MEDIUM - references: - - https://knexjs.org/#Builder-fromRaw - - https://knexjs.org/#Builder-whereRaw - - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://knexjs.org/#Builder-fromRaw + - https://knexjs.org/#Builder-whereRaw + - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html + semgrep.dev: + rule: + origin: community + r_id: 18257 + rule_id: d8UKLD + rv_id: 1263205 + url: https://semgrep.dev/playground/r/l4TJRey/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli + version_id: l4TJRey + shortlink: https://sg.run/l9eE + source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli + subcategory: + - vuln technology: - express - nodejs - knex - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection - source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli - shortlink: https://sg.run/l9eE - semgrep.dev: - rule: - r_id: 18257 - rv_id: 1263205 - rule_id: d8UKLD - version_id: l4TJRey - url: https://semgrep.dev/playground/r/l4TJRey/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli - origin: community - languages: - - javascript - - typescript - severity: WARNING mode: taint + pattern-sanitizers: + - patterns: + - pattern: parseInt(...) + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern-inside: $KNEX.fromRaw($QUERY, ...) + - pattern-inside: $KNEX.whereRaw($QUERY, ...) + - pattern-inside: $KNEX.raw($QUERY, ...) + - pattern-either: + - pattern-inside: "require('knex')\n...\n" + - pattern-inside: "import 'knex'\n...\n" pattern-sources: - patterns: - pattern-either: @@ -5555,14 +4185,8 @@ rules: - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -5572,65 +4196,66 @@ rules: - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') - pattern-sinks: - - patterns: - - focus-metavariable: $QUERY - - pattern-either: - - pattern-inside: $KNEX.fromRaw($QUERY, ...) - - pattern-inside: $KNEX.whereRaw($QUERY, ...) - - pattern-inside: $KNEX.raw($QUERY, ...) - - pattern-either: - - pattern-inside: 'require(''knex'') - - ... - - ' - - pattern-inside: 'import ''knex'' - - ... - - ' - pattern-sanitizers: - - patterns: - - pattern: parseInt(...) + severity: WARNING - id: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression - message: Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting - (XSS). Where possible avoid including user-input in functions which dynamically execute user-input. + languages: + - javascript + - typescript + message: Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to + Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute + user-input. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js references: - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval! - category: security - technology: - - javascript - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression - shortlink: https://sg.run/6nwK semgrep.dev: rule: + origin: community r_id: 9315 - rv_id: 1263214 rule_id: yyUngo + rv_id: 1263214 + url: + https://semgrep.dev/playground/r/WrTqKkJ/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression version_id: WrTqKkJ - url: https://semgrep.dev/playground/r/WrTqKkJ/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/6nwK + source: https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression + source-rule-url: + https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js + subcategory: + - vuln + technology: + - javascript + vulnerability_class: + - Code Injection mode: taint + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern: location.href = $FUNC(...) + - pattern: location.hash = $FUNC(...) + - pattern: location.search = $FUNC(...) + - pattern: $WINDOW. ... .location.href = $FUNC(...) + - pattern: $WINDOW. ... .location.hash = $FUNC(...) + - pattern: $WINDOW. ... .location.search = $FUNC(...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: eval(<... $SINK ...>) + - pattern: window.eval(<... $SINK ...>) + - pattern: new Function(<... $SINK ...>) + - pattern: new Function(<... $SINK ...>)(...) + - pattern: setTimeout(<... $SINK ...>,...) + - pattern: setInterval(<... $SINK ...>,...) + - focus-metavariable: $SINK pattern-sources: - patterns: - pattern-either: @@ -5644,11 +4269,7 @@ rules: - pattern-inside: "$PROPS = new URLSearchParams($WINDOW. ... .location.search)\n ...\n" - pattern-inside: "$PROPS = new URLSearchParams(location.search)\n ...\n" - pattern-inside: "$PROPS = new\nURLSearchParams($WINDOW. ... .location.hash.substring(1))\n ...\n" - - pattern-inside: '$PROPS = new URLSearchParams(location.hash.substring(1)) - - ... - - ' + - pattern-inside: "$PROPS = new URLSearchParams(location.hash.substring(1))\n...\n" - pattern: $PROPS.get('...') - focus-metavariable: $PROPS - patterns: @@ -5659,361 +4280,282 @@ rules: - pattern: $WINDOW. ... .location.href - pattern: $WINDOW. ... .location.hash - pattern: $WINDOW. ... .location.search - pattern-sinks: - - patterns: - - pattern-either: - - pattern: eval(<... $SINK ...>) - - pattern: window.eval(<... $SINK ...>) - - pattern: new Function(<... $SINK ...>) - - pattern: new Function(<... $SINK ...>)(...) - - pattern: setTimeout(<... $SINK ...>,...) - - pattern: setInterval(<... $SINK ...>,...) - - focus-metavariable: $SINK - pattern-sanitizers: - - patterns: - - pattern-either: - - pattern: location.href = $FUNC(...) - - pattern: location.hash = $FUNC(...) - - pattern: location.search = $FUNC(...) - - pattern: $WINDOW. ... .location.href = $FUNC(...) - - pattern: $WINDOW. ... .location.hash = $FUNC(...) - - pattern: $WINDOW. ... .location.search = $FUNC(...) + severity: WARNING - id: javascript.node-crypto.security.aead-no-final.aead-no-final - message: The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing - to call 'final' will invalidate all integrity guarantees of the released ciphertext. + languages: + - javascript + - typescript + message: The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. + Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext. metadata: + category: security + confidence: HIGH cwe: - 'CWE-310: CWE CATEGORY: Cryptographic Issues' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - category: security - subcategory: - - vuln - technology: - - node-crypto - likelihood: HIGH - impact: MEDIUM - confidence: HIGH references: - https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/ - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final - shortlink: https://sg.run/r6EEA semgrep.dev: rule: + origin: community r_id: 146569 - rv_id: 1263222 rule_id: 2ZUz884 - version_id: zyTb2X0 + rv_id: 1263222 url: https://semgrep.dev/playground/r/zyTb2X0/javascript.node-crypto.security.aead-no-final.aead-no-final - origin: community - languages: - - javascript - - typescript - severity: ERROR + version_id: zyTb2X0 + shortlink: https://sg.run/r6EEA + source: https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final + subcategory: + - vuln + technology: + - node-crypto + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: '$DECIPHER = $CRYPTO.createDecipheriv(''$ALGO'', ...) - - ... - - $DECIPHER.update(...) - - ' - - pattern-not-inside: '$DECIPHER = $CRYPTO.createDecipheriv(''$ALGO'', ...) - - ... - - $DECIPHER.final(...) - - ' + - pattern: "$DECIPHER = $CRYPTO.createDecipheriv('$ALGO', ...)\n...\n$DECIPHER.update(...)\n" + - pattern-not-inside: "$DECIPHER = $CRYPTO.createDecipheriv('$ALGO', ...)\n...\n$DECIPHER.final(...)\n" - metavariable-regex: metavariable: $ALGO regex: .*(-gcm|-ccm|-ocb|chacha20-poly1305)$ + severity: ERROR - id: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv - message: The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. - For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used - more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' - or 'createDecipheriv' instead. + languages: + - javascript + - typescript + message: The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every + time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the + key is used more than once. Other modes are still affected in their strength, though they're not completely broken. + Use 'createCipheriv' or 'createDecipheriv' instead. metadata: + category: security + confidence: HIGH cwe: - 'CWE-1204: Generation of Weak Initialization Vector (IV)' - category: security - subcategory: - - vuln - technology: - - node-crypto - likelihood: HIGH impact: MEDIUM - confidence: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH references: - https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options - https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv - shortlink: https://sg.run/bw33r semgrep.dev: rule: + origin: community r_id: 146570 - rv_id: 945898 rule_id: X5UQRR7 + rv_id: 945898 + url: + https://semgrep.dev/playground/r/ZRT3510/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv version_id: ZRT3510 - url: https://semgrep.dev/playground/r/ZRT3510/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/bw33r + source: https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv + subcategory: + - vuln + technology: + - node-crypto + vulnerability_class: + - Other patterns: - pattern-either: - - pattern: '$CRYPTO.createCipher(...) - - ' - - pattern: '$CRYPTO.createDecipher(...) - - ' + - pattern: "$CRYPTO.createCipher(...)\n" + - pattern: "$CRYPTO.createDecipher(...)\n" + severity: ERROR - id: javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length - message: The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication - tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be - tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts - or recover the implicit authentication key of GCM, allowing arbitrary forgeries. + languages: + - javascript + - typescript + message: The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected + authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the + application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an + attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-310: CWE CATEGORY: Cryptographic Issues' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - category: security - subcategory: - - vuln - technology: - - node-crypto - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM references: - https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/ - https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/ - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length - shortlink: https://sg.run/NbGG1 semgrep.dev: rule: + origin: community r_id: 146571 - rv_id: 1263223 rule_id: j2UgPP3 + rv_id: 1263223 + url: + https://semgrep.dev/playground/r/pZT03qd/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length version_id: pZT03qd - url: https://semgrep.dev/playground/r/pZT03qd/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/NbGG1 + source: https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length + subcategory: + - vuln + technology: + - node-crypto + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: '$CRYPTO.createDecipheriv(''$ALGO'', $KEY, $IV) - - ' + - pattern: "$CRYPTO.createDecipheriv('$ALGO', $KEY, $IV)\n" - metavariable-regex: metavariable: $ALGO regex: .*(-gcm)$ + severity: ERROR - id: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + languages: + - javascript + - typescript + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures asvs: - section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' version: '4' category: security - technology: - - jwt - - nodejs - - secrets - cwe2022-top25: true + confidence: HIGH + cwe: + - 'CWE-798: Use of Hard-coded Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret - shortlink: https://sg.run/vz70 + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9333 - rv_id: 1263225 rule_id: QrUzq6 + rv_id: 1263225 + url: + https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret version_id: X0TzyoE - url: https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/vz70 + source: https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret + subcategory: + - vuln + technology: + - jwt + - nodejs + - secrets + vulnerability_class: + - Hard-coded Secrets mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "$F = require(\"$I\").Strategy\n...\n" + - pattern-inside: "$F = require(\"$I\")\n...\n" + - pattern-inside: "import { $STRAT as $F } from '$I'\n...\n" + - pattern-inside: "import $F from '$I'\n...\n" + - metavariable-regex: + metavariable: $I + regex: (passport-.*) + - pattern-inside: "new $F($VALUE,...)\n" + - focus-metavariable: $VALUE pattern-sources: - by-side-effect: true patterns: - pattern-either: - - pattern: '{..., clientSecret: "...", ...} - - ' - - pattern: '{..., secretOrKey: "...", ...} - - ' - - pattern: '{..., consumerSecret: "...", ...} - - ' + - pattern: "{..., clientSecret: \"...\", ...}\n" + - pattern: "{..., secretOrKey: \"...\", ...}\n" + - pattern: "{..., consumerSecret: \"...\", ...}\n" - patterns: - - pattern-inside: '$OBJ = {} - - ... - - ' + - pattern-inside: "$OBJ = {}\n...\n" - pattern-either: - - pattern: '$OBJ.clientSecret = "..." - - ' - - pattern: '$OBJ.secretOrKey = "..." - - ' - - pattern: '$OBJ.consumerSecret = "..." - - ' + - pattern: "$OBJ.clientSecret = \"...\"\n" + - pattern: "$OBJ.secretOrKey = \"...\"\n" + - pattern: "$OBJ.consumerSecret = \"...\"\n" - pattern: $OBJ - patterns: - - pattern-inside: '$SECRET = ''...'' - - ... - - ' + - pattern-inside: "$SECRET = '...'\n...\n" - pattern-either: - - pattern: '{..., clientSecret: $SECRET, ...} - - ' - - pattern: '{..., secretOrKey: $SECRET, ...} - - ' - - pattern: '{..., consumerSecret: $SECRET, ...} - - ' + - pattern: "{..., clientSecret: $SECRET, ...}\n" + - pattern: "{..., secretOrKey: $SECRET, ...}\n" + - pattern: "{..., consumerSecret: $SECRET, ...}\n" - patterns: - - pattern-inside: '$SECRET = ''...'' - - ... - - ' + - pattern-inside: "$SECRET = '...'\n...\n" - pattern-either: - - pattern-inside: '$VALUE = {..., clientSecret: $SECRET, ...} - - ... - - ' - - pattern-inside: '$VALUE = {..., secretOrKey: $SECRET, ...} - - ... - - ' - - pattern-inside: '$VALUE = {..., consumerSecret: $SECRET, ...} - - ... - - ' + - pattern-inside: "$VALUE = {..., clientSecret: $SECRET, ...}\n...\n" + - pattern-inside: "$VALUE = {..., secretOrKey: $SECRET, ...}\n...\n" + - pattern-inside: "$VALUE = {..., consumerSecret: $SECRET, ...}\n...\n" - pattern: $VALUE - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '$F = require("$I").Strategy - - ... - - ' - - pattern-inside: '$F = require("$I") - - ... - - ' - - pattern-inside: 'import { $STRAT as $F } from ''$I'' - - ... - - ' - - pattern-inside: 'import $F from ''$I'' - - ... - - ' - - metavariable-regex: - metavariable: $I - regex: (passport-.*) - - pattern-inside: 'new $F($VALUE,...) - - ' - - focus-metavariable: $VALUE + severity: WARNING - id: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection - message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable - is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized - queries or prepared statements. - options: - interfile: true + languages: + - javascript + - typescript + message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the + variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to + use parameterized queries or prepared statements. metadata: - interfile: true - references: - - https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements category: security - technology: - - express + confidence: HIGH cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection - shortlink: https://sg.run/gjoe + references: + - https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements semgrep.dev: rule: + origin: community r_id: 22085 - rv_id: 1263241 rule_id: yyU0GX + rv_id: 1263241 + url: + https://semgrep.dev/playground/r/nWT2Llx/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection version_id: nWT2Llx - url: https://semgrep.dev/playground/r/nWT2Llx/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/gjoe + source: + https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - SQL Injection mode: taint + options: + interfile: true + pattern-sanitizers: + - pattern-either: + - pattern: parseInt(...) + - pattern: $FUNC. ... .hash(...) + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sequelize.query($QUERY,...) + - pattern: $DB.sequelize.query($QUERY,...) + - focus-metavariable: $QUERY pattern-sources: - patterns: - pattern-either: @@ -6036,14 +4578,8 @@ rules: - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -6053,766 +4589,513 @@ rules: - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') - pattern-sinks: - - pattern-either: - - patterns: - - pattern-either: - - pattern: sequelize.query($QUERY,...) - - pattern: $DB.sequelize.query($QUERY,...) - - focus-metavariable: $QUERY - pattern-sanitizers: - - pattern-either: - - pattern: parseInt(...) - - pattern: $FUNC. ... .hash(...) + severity: ERROR - id: problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification - message: Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. - This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification - against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, - and should not be used. - severity: WARNING + languages: + - javascript + - typescript + message: Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS + verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false + bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to + vulnerability to MTM attacks, and should not be used. metadata: - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM category: security + confidence: MEDIUM cwe: 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: A03:2017 - Sensitive Data Exposure references: - https://nodejs.org/api/https.html#https_https_request_options_callback - https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100 + semgrep.dev: + rule: + origin: community + r_id: 9423 + rule_id: OrU3Y6 + rv_id: 946067 + url: + https://semgrep.dev/playground/r/JdTDybO/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification + version_id: JdTDybO + shortlink: https://sg.run/9oxr + source: + https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification subcategory: - vuln technology: - node.js vulnerability: Insecure Transport - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information - source: https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification - shortlink: https://sg.run/9oxr - semgrep.dev: - rule: - r_id: 9423 - rv_id: 946067 - rule_id: OrU3Y6 - version_id: JdTDybO - url: https://semgrep.dev/playground/r/JdTDybO/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification - origin: community - languages: - - javascript - - typescript pattern-either: - - pattern: 'process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = 0; - - ' - - pattern: '{rejectUnauthorized:false} - - ' + - pattern: "process.env[\"NODE_TLS_REJECT_UNAUTHORIZED\"] = 0;\n" + - pattern: "{rejectUnauthorized:false}\n" + severity: WARNING - id: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust - message: Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from - user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention - mechanism e.g. input validation or sanitization depending on the context. + languages: + - typescript + message: Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes + from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the + appropriate prevention mechanism e.g. input validation or sanitization depending on the context. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - references: - - https://angular.io/api/platform-browser/DomSanitizer - - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - confidence: MEDIUM - category: security - technology: - - angular - - browser - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust - shortlink: https://sg.run/KWxP + references: + - https://angular.io/api/platform-browser/DomSanitizer + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9755 - rv_id: 1263902 rule_id: oqUzgA + rv_id: 1263902 + url: + https://semgrep.dev/playground/r/5PTo1zk/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust version_id: 5PTo1zk - url: https://semgrep.dev/playground/r/5PTo1zk/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust - origin: community - languages: - - typescript - severity: WARNING + shortlink: https://sg.run/KWxP + source: https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust + subcategory: + - vuln + technology: + - angular + - browser + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: 'function ...({..., $X: string, ...}) { ... } - - ' - - pattern-inside: 'function ...(..., $X: string, ...) { ... } - - ' - - focus-metavariable: $X - pattern-sinks: - - patterns: - - pattern-either: - - pattern: $X.$TRUST($Y) - - focus-metavariable: $Y - - pattern-not: '$X.$TRUST(`...`) - - ' - - pattern-not: '$X.$TRUST("...") - - ' - - metavariable-regex: - metavariable: $TRUST - regex: (bypassSecurityTrustHtml|bypassSecurityTrustStyle|bypassSecurityTrustScript|bypassSecurityTrustUrl|bypassSecurityTrustResourceUrl) pattern-sanitizers: - patterns: - pattern-either: - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import * as $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: '$S = require("underscore.string") - - ... - - ' + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "import * as $S from \"underscore.string\"\n...\n" + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "$S = require(\"underscore.string\")\n...\n" - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from "dompurify" - - ... - - ' - - pattern-inside: 'import { ..., $S,... } from "dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "dompurify" - - ... - - ' - - pattern-inside: '$S = require("dompurify") - - ... - - ' - - pattern-inside: 'import $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: '$S = require("isomorphic-dompurify") - - ... - - ' + - pattern-inside: "import $S from \"dompurify\"\n...\n" + - pattern-inside: "import { ..., $S,... } from \"dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"dompurify\"\n...\n" + - pattern-inside: "$S = require(\"dompurify\")\n...\n" + - pattern-inside: "import $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "$S = require(\"isomorphic-dompurify\")\n...\n" - pattern-either: - patterns: - - pattern-inside: '$VALUE = $S(...) - - ... - - ' + - pattern-inside: "$VALUE = $S(...)\n...\n" - pattern: $VALUE.sanitize(...) - patterns: - - pattern-inside: '$VALUE = $S.sanitize - - ... - - ' + - pattern-inside: "$VALUE = $S.sanitize\n...\n" - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''xss''; - - ... - - ' - - pattern-inside: 'import * as $S from ''xss''; - - ... - - ' - - pattern-inside: '$S = require("xss") - - ... - - ' + - pattern-inside: "import $S from 'xss';\n...\n" + - pattern-inside: "import * as $S from 'xss';\n...\n" + - pattern-inside: "$S = require(\"xss\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''sanitize-html''; - - ... - - ' - - pattern-inside: 'import * as $S from "sanitize-html"; - - ... - - ' - - pattern-inside: '$S = require("sanitize-html") - - ... - - ' + - pattern-inside: "import $S from 'sanitize-html';\n...\n" + - pattern-inside: "import * as $S from \"sanitize-html\";\n...\n" + - pattern-inside: "$S = require(\"sanitize-html\")\n...\n" - pattern: $S(...) - patterns: - pattern: sanitizer.sanitize(...) - pattern-not: sanitizer.sanitize(SecurityContext.NONE, ...); + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $X.$TRUST($Y) + - focus-metavariable: $Y + - pattern-not: "$X.$TRUST(`...`)\n" + - pattern-not: "$X.$TRUST(\"...\")\n" + - metavariable-regex: + metavariable: $TRUST + regex: + (bypassSecurityTrustHtml|bypassSecurityTrustStyle|bypassSecurityTrustScript|bypassSecurityTrustUrl|bypassSecurityTrustResourceUrl) + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "function ...({..., $X: string, ...}) { ... }\n" + - pattern-inside: "function ...(..., $X: string, ...) { ... }\n" + - focus-metavariable: $X + severity: WARNING - id: typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption + languages: + - typescript message: 'Add "encryption: $Y.BucketEncryption.KMS_MANAGED" or "encryption: $Y.BucketEncryption.S3_MANAGED" to the bucket props for Bucket construct $X' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-311: Missing Encryption of Sensitive Data' - category: security - technology: - - AWS-CDK - references: - - https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A04:2021 - Insecure Design - A06:2025 - Insecure Design - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption - shortlink: https://sg.run/eowX + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html semgrep.dev: rule: + origin: community r_id: 15276 - rv_id: 1263903 rule_id: bwU8qz + rv_id: 1263903 + url: + https://semgrep.dev/playground/r/GxTkeRx/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption version_id: GxTkeRx - url: https://semgrep.dev/playground/r/GxTkeRx/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption - origin: community - languages: - - typescript - severity: ERROR + shortlink: https://sg.run/eowX + source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption + subcategory: + - vuln + technology: + - AWS-CDK + vulnerability_class: + - Cryptographic Issues pattern-either: - patterns: - - pattern-inside: 'import {Bucket} from ''@aws-cdk/aws-s3'' - - ... - - ' + - pattern-inside: "import {Bucket} from '@aws-cdk/aws-s3'\n...\n" - pattern: const $X = new Bucket(...) - - pattern-not: 'const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS_MANAGED, ...}) - - ' - - pattern-not: 'const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS, ...}) - - ' - - pattern-not: 'const $X = new Bucket(..., {..., encryption: BucketEncryption.S3_MANAGED, ...}) - - ' - - patterns: - - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-s3'' - - ... - - ' + - pattern-not: "const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS_MANAGED, ...})\n" + - pattern-not: "const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS, ...})\n" + - pattern-not: "const $X = new Bucket(..., {..., encryption: BucketEncryption.S3_MANAGED, ...})\n" + - patterns: + - pattern-inside: "import * as $Y from '@aws-cdk/aws-s3'\n...\n" - pattern: const $X = new $Y.Bucket(...) - - pattern-not: 'const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS_MANAGED, ...}) - - ' - - pattern-not: 'const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS, ...}) - - ' - - pattern-not: 'const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.S3_MANAGED, ...}) - - ' + - pattern-not: "const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS_MANAGED, ...})\n" + - pattern-not: "const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS, ...})\n" + - pattern-not: "const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.S3_MANAGED, ...})\n" + severity: ERROR - id: typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl - message: Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the - property "enforceSSL" should be set to true + languages: + - ts + message: Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - + the property "enforceSSL" should be set to true metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' - category: security - technology: - - AWS-CDK - references: - - https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl - shortlink: https://sg.run/vqBX + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html semgrep.dev: rule: + origin: community r_id: 15277 - rv_id: 1263904 rule_id: NbUN8B + rv_id: 1263904 + url: + https://semgrep.dev/playground/r/RGT0Llg/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl version_id: RGT0Llg - url: https://semgrep.dev/playground/r/RGT0Llg/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl - origin: community - languages: - - ts - severity: ERROR + shortlink: https://sg.run/vqBX + source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl + subcategory: + - vuln + technology: + - AWS-CDK + vulnerability_class: + - Mishandled Sensitive Information pattern-either: - patterns: - - pattern-inside: 'import {Bucket} from ''@aws-cdk/aws-s3''; - - ... - - ' + - pattern-inside: "import {Bucket} from '@aws-cdk/aws-s3';\n...\n" - pattern: const $X = new Bucket(...) - - pattern-not: 'const $X = new Bucket(..., {enforceSSL: true}, ...) - - ' - - patterns: - - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-s3''; - - ... - - ' + - pattern-not: "const $X = new Bucket(..., {enforceSSL: true}, ...)\n" + - patterns: + - pattern-inside: "import * as $Y from '@aws-cdk/aws-s3';\n...\n" - pattern: const $X = new $Y.Bucket(...) - - pattern-not: 'const $X = new $Y.Bucket(..., {..., enforceSSL: true, ...}) - - ' + - pattern-not: "const $X = new $Y.Bucket(..., {..., enforceSSL: true, ...})\n" + severity: ERROR - id: typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue + languages: + - ts message: 'Queue $X is missing encryption at rest. Add "encryption: $Y.QueueEncryption.KMS" or "encryption: $Y.QueueEncryption.KMS_MANAGED" to the queue props to enable encryption at rest for the queue.' metadata: category: security + confidence: MEDIUM cwe: - 'CWE-311: Missing Encryption of Sensitive Data' - technology: - - AWS-CDK - references: - - https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A04:2021 - Insecure Design - A06:2025 - Insecure Design - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue - shortlink: https://sg.run/d23P + references: + - https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html semgrep.dev: rule: + origin: community r_id: 15278 - rv_id: 1263905 rule_id: kxUwqO + rv_id: 1263905 + url: + https://semgrep.dev/playground/r/A8Tgd2W/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue version_id: A8Tgd2W - url: https://semgrep.dev/playground/r/A8Tgd2W/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue - origin: community - languages: - - ts - severity: WARNING + shortlink: https://sg.run/d23P + source: + https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue + subcategory: + - vuln + technology: + - AWS-CDK + vulnerability_class: + - Cryptographic Issues pattern-either: - patterns: - - pattern-inside: 'import {Queue} from ''@aws-cdk/aws-sqs'' - - ... - - ' + - pattern-inside: "import {Queue} from '@aws-cdk/aws-sqs'\n...\n" - pattern: const $X = new Queue(...) - - pattern-not: 'const $X = new Queue(..., {..., encryption: QueueEncryption.KMS_MANAGED, ...}) - - ' - - pattern-not: 'const $X = new Queue(..., {..., encryption: QueueEncryption.KMS, ...}) - - ' - - patterns: - - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-sqs'' - - ... - - ' + - pattern-not: "const $X = new Queue(..., {..., encryption: QueueEncryption.KMS_MANAGED, ...})\n" + - pattern-not: "const $X = new Queue(..., {..., encryption: QueueEncryption.KMS, ...})\n" + - patterns: + - pattern-inside: "import * as $Y from '@aws-cdk/aws-sqs'\n...\n" - pattern: const $X = new $Y.Queue(...) - - pattern-not: 'const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS_MANAGED, ...}) - - ' - - pattern-not: 'const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS, ...}) - - ' + - pattern-not: "const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS_MANAGED, ...})\n" + - pattern-not: "const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS, ...})\n" + severity: WARNING - id: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod - message: Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. - Verify if this is intentional. + languages: + - ts + message: Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world + accessible. Verify if this is intentional. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-306: Missing Authentication for Critical Function' - category: security - technology: - - AWS-CDK - references: - - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod - shortlink: https://sg.run/Z4p7 + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html semgrep.dev: rule: + origin: community r_id: 15279 - rv_id: 1263906 rule_id: wdUjZK + rv_id: 1263906 + url: + https://semgrep.dev/playground/r/BjTkZA7/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod version_id: BjTkZA7 - url: https://semgrep.dev/playground/r/BjTkZA7/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod - origin: community - languages: - - ts - severity: WARNING + shortlink: https://sg.run/Z4p7 + source: + https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod + subcategory: + - vuln + technology: + - AWS-CDK + vulnerability_class: + - Improper Authentication pattern-either: - patterns: - - pattern-inside: 'import {Bucket} from ''@aws-cdk/aws-s3'' - - ... - - ' - - pattern: 'const $X = new Bucket(...) - - ... - - $X.grantPublicAccess(...) - - ' - - patterns: - - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-s3'' - - ... - - ' - - pattern: 'const $X = new $Y.Bucket(...) - - ... - - $X.grantPublicAccess(...) - - ' + - pattern-inside: "import {Bucket} from '@aws-cdk/aws-s3'\n...\n" + - pattern: "const $X = new Bucket(...)\n...\n$X.grantPublicAccess(...)\n" + - patterns: + - pattern-inside: "import * as $Y from '@aws-cdk/aws-s3'\n...\n" + - pattern: "const $X = new $Y.Bucket(...)\n...\n$X.grantPublicAccess(...)\n" + severity: WARNING - id: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public - message: CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically - accessible, including builds prior to the project being public. Ensure this is acceptable for the project. + languages: + - ts + message: CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts + publically accessible, including builds prior to the project being public. Ensure this is acceptable for the + project. metadata: category: security + confidence: MEDIUM cwe: - 'CWE-306: Missing Authentication for Critical Function' - technology: - - AWS-CDK - references: - - https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public - shortlink: https://sg.run/nK7G + likelihood: MEDIUM + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html semgrep.dev: rule: + origin: community r_id: 15280 - rv_id: 1263907 rule_id: x8UxXZ + rv_id: 1263907 + url: + https://semgrep.dev/playground/r/DkTRbj1/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public version_id: DkTRbj1 - url: https://semgrep.dev/playground/r/DkTRbj1/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public - origin: community - languages: - - ts - severity: WARNING + shortlink: https://sg.run/nK7G + source: + https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public + subcategory: + - vuln + technology: + - AWS-CDK + vulnerability_class: + - Improper Authentication pattern-either: - patterns: - - pattern-inside: 'import {Project} from ''@aws-cdk/aws-codebuild'' - - ... - - ' - - pattern: 'const $X = new Project(..., {..., badge: true, ...}) - - ' - - patterns: - - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-codebuild'' - - ... - - ' - - pattern: 'const $X = new $Y.Project(..., {..., badge: true, ...}) - - ' + - pattern-inside: "import {Project} from '@aws-cdk/aws-codebuild'\n...\n" + - pattern: "const $X = new Project(..., {..., badge: true, ...})\n" + - patterns: + - pattern-inside: "import * as $Y from '@aws-cdk/aws-codebuild'\n...\n" + - pattern: "const $X = new $Y.Project(..., {..., badge: true, ...})\n" + severity: WARNING - id: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml - message: Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site - scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using - a sanitization library such as DOMPurify to sanitize your HTML. + languages: + - typescript + - javascript + message: Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to + cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use + dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html - category: security - confidence: MEDIUM - technology: - - react - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml - shortlink: https://sg.run/rAx6 semgrep.dev: rule: + origin: community r_id: 9769 - rv_id: 1263912 rule_id: x8UWvK + rv_id: 1263912 + url: + https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml version_id: l4TJR0v - url: https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml - origin: community - languages: - - typescript - - javascript - severity: WARNING + shortlink: https://sg.run/rAx6 + source: + https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml + subcategory: + - vuln + technology: + - react + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: 'function ...({..., $X, ...}) { ... } - - ' - - pattern-inside: 'function ...(..., $X, ...) { ... } - - ' - - focus-metavariable: $X - - pattern-not-inside: '$F. ... .$SANITIZEUNC(...) - - ' - pattern-sinks: - - patterns: - - focus-metavariable: $X - - pattern-either: - - pattern: '{...,dangerouslySetInnerHTML: {__html: $X},...} - - ' - - pattern: '<$Y ... dangerouslySetInnerHTML={{__html: $X}} /> - - ' - - pattern-not: '<$Y ... dangerouslySetInnerHTML={{__html: "..."}} /> - - ' - - pattern-not: '{...,dangerouslySetInnerHTML:{__html: "..."},...} - - ' - - metavariable-pattern: - patterns: - - pattern-not: '{...} - - ' - metavariable: $X - - pattern-not: '<... {__html: "..."} ...> - - ' - - pattern-not: '<... {__html: `...`} ...> - - ' pattern-sanitizers: - patterns: - pattern-either: - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import * as $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: '$S = require("underscore.string") - - ... - - ' + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "import * as $S from \"underscore.string\"\n...\n" + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "$S = require(\"underscore.string\")\n...\n" - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from "dompurify" - - ... - - ' - - pattern-inside: 'import { ..., $S,... } from "dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "dompurify" - - ... - - ' - - pattern-inside: '$S = require("dompurify") - - ... - - ' - - pattern-inside: 'import $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: '$S = require("isomorphic-dompurify") - - ... - - ' + - pattern-inside: "import $S from \"dompurify\"\n...\n" + - pattern-inside: "import { ..., $S,... } from \"dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"dompurify\"\n...\n" + - pattern-inside: "$S = require(\"dompurify\")\n...\n" + - pattern-inside: "import $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "$S = require(\"isomorphic-dompurify\")\n...\n" - pattern-either: - patterns: - - pattern-inside: '$VALUE = $S(...) - - ... - - ' + - pattern-inside: "$VALUE = $S(...)\n...\n" - pattern: $VALUE.sanitize(...) - patterns: - - pattern-inside: '$VALUE = $S.sanitize - - ... - - ' + - pattern-inside: "$VALUE = $S.sanitize\n...\n" - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''xss''; - - ... - - ' - - pattern-inside: 'import * as $S from ''xss''; - - ... - - ' - - pattern-inside: '$S = require("xss") - - ... - - ' + - pattern-inside: "import $S from 'xss';\n...\n" + - pattern-inside: "import * as $S from 'xss';\n...\n" + - pattern-inside: "$S = require(\"xss\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''sanitize-html''; - - ... - - ' - - pattern-inside: 'import * as $S from "sanitize-html"; - - ... - - ' - - pattern-inside: '$S = require("sanitize-html") - - ... - - ' + - pattern-inside: "import $S from 'sanitize-html';\n...\n" + - pattern-inside: "import * as $S from \"sanitize-html\";\n...\n" + - pattern-inside: "$S = require(\"sanitize-html\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: '$S = new Remarkable() - - ... - - ' + - pattern-inside: "$S = new Remarkable()\n...\n" - pattern: $S.render(...) + pattern-sinks: + - patterns: + - focus-metavariable: $X + - pattern-either: + - pattern: "{...,dangerouslySetInnerHTML: {__html: $X},...}\n" + - pattern: "<$Y ... dangerouslySetInnerHTML={{__html: $X}} />\n" + - pattern-not: "<$Y ... dangerouslySetInnerHTML={{__html: \"...\"}} />\n" + - pattern-not: "{...,dangerouslySetInnerHTML:{__html: \"...\"},...}\n" + - metavariable-pattern: + metavariable: $X + patterns: + - pattern-not: "{...}\n" + - pattern-not: "<... {__html: \"...\"} ...>\n" + - pattern-not: "<... {__html: `...`} ...>\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "function ...({..., $X, ...}) { ... }\n" + - pattern-inside: "function ...(..., $X, ...) { ... }\n" + - focus-metavariable: $X + - pattern-not-inside: "$F. ... .$SANITIZEUNC(...)\n" + severity: WARNING - id: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method - message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) - attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as - DOMPurify to sanitize your HTML. + languages: + - typescript + - javascript + message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting + (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization + library such as DOMPurify to sanitize your HTML. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection @@ -6821,47 +5104,67 @@ rules: - https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln - https://developer.mozilla.org/en-US/docs/Web/API/Document/write - https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML - category: security - confidence: MEDIUM - technology: - - react - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method - shortlink: https://sg.run/E5x8 semgrep.dev: rule: + origin: community r_id: 9781 - rv_id: 1263916 rule_id: QrU68w + rv_id: 1263916 + url: + https://semgrep.dev/playground/r/GxTkeRl/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method version_id: GxTkeRl - url: https://semgrep.dev/playground/r/GxTkeRl/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method - origin: community - languages: - - typescript - - javascript - severity: WARNING + shortlink: https://sg.run/E5x8 + source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method + subcategory: + - vuln + technology: + - react + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: + pattern-sanitizers: - patterns: - pattern-either: - - pattern-inside: 'function ...({..., $X, ...}) { ... } - - ' - - pattern-inside: 'function ...(..., $X, ...) { ... } - - ' - - focus-metavariable: $X + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "import * as $S from \"underscore.string\"\n...\n" + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "$S = require(\"underscore.string\")\n...\n" - pattern-either: - - pattern: $X.$Y - - pattern: $X[...] + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: "import $S from \"dompurify\"\n...\n" + - pattern-inside: "import { ..., $S,... } from \"dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"dompurify\"\n...\n" + - pattern-inside: "$S = require(\"dompurify\")\n...\n" + - pattern-inside: "import $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "$S = require(\"isomorphic-dompurify\")\n...\n" + - pattern-either: + - patterns: + - pattern-inside: "$VALUE = $S(...)\n...\n" + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: "$VALUE = $S.sanitize\n...\n" + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: "import $S from 'xss';\n...\n" + - pattern-inside: "import * as $S from 'xss';\n...\n" + - pattern-inside: "$S = require(\"xss\")\n...\n" + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: "import $S from 'sanitize-html';\n...\n" + - pattern-inside: "import * as $S from \"sanitize-html\";\n...\n" + - pattern-inside: "$S = require(\"sanitize-html\")\n...\n" + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: "$S = new Remarkable()\n...\n" + - pattern: $S.render(...) pattern-sinks: - patterns: - pattern-either: @@ -6879,216 +5182,109 @@ rules: metavariable: $HTML regex: (insertAdjacentHTML) - focus-metavariable: $SINK + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "function ...({..., $X, ...}) { ... }\n" + - pattern-inside: "function ...(..., $X, ...) { ... }\n" + - focus-metavariable: $X + - pattern-either: + - pattern: $X.$Y + - pattern: $X[...] + severity: WARNING +- id: typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property + languages: + - typescript + - javascript + message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting + (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization + library such as DOMPurify to sanitize your HTML. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html + semgrep.dev: + rule: + origin: community + r_id: 9782 + rule_id: 3qUBl4 + rv_id: 1263917 + url: + https://semgrep.dev/playground/r/RGT0Lln/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property + version_id: RGT0Lln + shortlink: https://sg.run/70Zv + source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property + subcategory: + - vuln + technology: + - react + vulnerability_class: + - Cross-Site-Scripting (XSS) + mode: taint pattern-sanitizers: - patterns: - pattern-either: - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import * as $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: '$S = require("underscore.string") - - ... - - ' + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "import * as $S from \"underscore.string\"\n...\n" + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "$S = require(\"underscore.string\")\n...\n" - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from "dompurify" - - ... - - ' - - pattern-inside: 'import { ..., $S,... } from "dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "dompurify" - - ... - - ' - - pattern-inside: '$S = require("dompurify") - - ... - - ' - - pattern-inside: 'import $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: '$S = require("isomorphic-dompurify") - - ... - - ' + - pattern-inside: "import $S from \"dompurify\"\n...\n" + - pattern-inside: "import { ..., $S,... } from \"dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"dompurify\"\n...\n" + - pattern-inside: "$S = require(\"dompurify\")\n...\n" + - pattern-inside: "import $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "$S = require(\"isomorphic-dompurify\")\n...\n" - pattern-either: - patterns: - - pattern-inside: '$VALUE = $S(...) - - ... - - ' + - pattern-inside: "$VALUE = $S(...)\n...\n" - pattern: $VALUE.sanitize(...) - patterns: - - pattern-inside: '$VALUE = $S.sanitize - - ... - - ' + - pattern-inside: "$VALUE = $S.sanitize\n...\n" - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''xss''; - - ... - - ' - - pattern-inside: 'import * as $S from ''xss''; - - ... - - ' - - pattern-inside: '$S = require("xss") - - ... - - ' + - pattern-inside: "import $S from 'xss';\n...\n" + - pattern-inside: "import * as $S from 'xss';\n...\n" + - pattern-inside: "$S = require(\"xss\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''sanitize-html''; - - ... - - ' - - pattern-inside: 'import * as $S from "sanitize-html"; - - ... - - ' - - pattern-inside: '$S = require("sanitize-html") - - ... - - ' + - pattern-inside: "import $S from 'sanitize-html';\n...\n" + - pattern-inside: "import * as $S from \"sanitize-html\";\n...\n" + - pattern-inside: "$S = require(\"sanitize-html\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: '$S = new Remarkable() - - ... - - ' + - pattern-inside: "$S = new Remarkable()\n...\n" - pattern: $S.render(...) -- id: typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property - message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) - attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as - DOMPurify to sanitize your HTML. - metadata: - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - owasp: - - A07:2017 - Cross-Site Scripting (XSS) - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html - category: security - confidence: MEDIUM - technology: - - react - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property - shortlink: https://sg.run/70Zv - semgrep.dev: - rule: - r_id: 9782 - rv_id: 1263917 - rule_id: 3qUBl4 - version_id: RGT0Lln - url: https://semgrep.dev/playground/r/RGT0Lln/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property - origin: community - languages: - - typescript - - javascript - severity: WARNING - mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: 'function ...({..., $X, ...}) { ... } - - ' - - pattern-inside: 'function ...(..., $X, ...) { ... } - - ' - - focus-metavariable: $X - - pattern-either: - - pattern: $X.$Y - - pattern: $X[...] pattern-sinks: - patterns: - pattern-either: - - pattern-inside: '$BODY = $REACT.useRef(...) - - ... - - ' - - pattern-inside: '$BODY = useRef(...) - - ... - - ' - - pattern-inside: '$BODY = findDOMNode(...) - - ... - - ' - - pattern-inside: '$BODY = createRef(...) - - ... - - ' - - pattern-inside: '$BODY = $REACT.findDOMNode(...) - - ... - - ' - - pattern-inside: '$BODY = $REACT.createRef(...) - - ... - - ' + - pattern-inside: "$BODY = $REACT.useRef(...)\n...\n" + - pattern-inside: "$BODY = useRef(...)\n...\n" + - pattern-inside: "$BODY = findDOMNode(...)\n...\n" + - pattern-inside: "$BODY = createRef(...)\n...\n" + - pattern-inside: "$BODY = $REACT.findDOMNode(...)\n...\n" + - pattern-inside: "$BODY = $REACT.createRef(...)\n...\n" - pattern-either: - pattern: "$BODY. ... .$HTML = $SINK \n" - pattern: "$BODY.$HTML = $SINK \n" @@ -7103,214 +5299,72 @@ rules: metavariable: $HTML regex: (innerHTML|outerHTML) - focus-metavariable: $SINK - pattern-sanitizers: - - patterns: - - pattern-either: - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import * as $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: '$S = require("underscore.string") - - ... - - ' - - pattern-either: - - pattern: $S.escapeHTML(...) - - patterns: - - pattern-either: - - pattern-inside: 'import $S from "dompurify" - - ... - - ' - - pattern-inside: 'import { ..., $S,... } from "dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "dompurify" - - ... - - ' - - pattern-inside: '$S = require("dompurify") - - ... - - ' - - pattern-inside: 'import $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: '$S = require("isomorphic-dompurify") - - ... - - ' - - pattern-either: - - patterns: - - pattern-inside: '$VALUE = $S(...) - - ... - - ' - - pattern: $VALUE.sanitize(...) - - patterns: - - pattern-inside: '$VALUE = $S.sanitize - - ... - - ' - - pattern: $S(...) - - pattern: $S.sanitize(...) - - pattern: $S(...) - - patterns: - - pattern-either: - - pattern-inside: 'import $S from ''xss''; - - ... - - ' - - pattern-inside: 'import * as $S from ''xss''; - - ... - - ' - - pattern-inside: '$S = require("xss") - - ... - - ' - - pattern: $S(...) + pattern-sources: - patterns: - pattern-either: - - pattern-inside: 'import $S from ''sanitize-html''; - - ... - - ' - - pattern-inside: 'import * as $S from "sanitize-html"; - - ... - - ' - - pattern-inside: '$S = require("sanitize-html") - - ... - - ' - - pattern: $S(...) - - patterns: + - pattern-inside: "function ...({..., $X, ...}) { ... }\n" + - pattern-inside: "function ...(..., $X, ...) { ... }\n" + - focus-metavariable: $X - pattern-either: - - pattern-inside: '$S = new Remarkable() - - ... - - ' - - pattern: $S.render(...) + - pattern: $X.$Y + - pattern: $X[...] + severity: WARNING - id: typescript.react.security.react-insecure-request.react-insecure-request + languages: + - typescript + - javascript message: Unencrypted request over HTTP detected. metadata: - vulnerability: Insecure Transport + category: security + confidence: MEDIUM + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-319: Cleartext Transmission of Sensitive Information' references: - https://www.npmjs.com/package/axios - category: security - technology: - - react - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request - shortlink: https://sg.run/1n0b semgrep.dev: rule: + origin: community r_id: 9766 - rv_id: 1263918 rule_id: NbUA3O + rv_id: 1263918 + url: + https://semgrep.dev/playground/r/A8Tgd2p/typescript.react.security.react-insecure-request.react-insecure-request version_id: A8Tgd2p - url: https://semgrep.dev/playground/r/A8Tgd2p/typescript.react.security.react-insecure-request.react-insecure-request - origin: community - languages: - - typescript - - javascript - severity: ERROR + shortlink: https://sg.run/1n0b + source: https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request + subcategory: + - vuln + technology: + - react + vulnerability: Insecure Transport + vulnerability_class: + - Mishandled Sensitive Information patterns: - pattern-either: - patterns: - pattern-either: - - pattern-inside: 'import $AXIOS from ''axios''; - - ... - - $AXIOS.$METHOD(...) - - ' - - pattern-inside: '$AXIOS = require(''axios''); - - ... - - $AXIOS.$METHOD(...) - - ' + - pattern-inside: "import $AXIOS from 'axios';\n...\n$AXIOS.$METHOD(...)\n" + - pattern-inside: "$AXIOS = require('axios');\n...\n$AXIOS.$METHOD(...)\n" - pattern: $AXIOS.$VERB("$URL",...) - metavariable-regex: metavariable: $VERB regex: ^(get|post|delete|head|patch|put|options) - patterns: - pattern-either: - - pattern-inside: 'import $AXIOS from ''axios''; - - ... - - $AXIOS(...) - - ' - - pattern-inside: '$AXIOS = require(''axios''); - - ... - - $AXIOS(...) - - ' + - pattern-inside: "import $AXIOS from 'axios';\n...\n$AXIOS(...)\n" + - pattern-inside: "$AXIOS = require('axios');\n...\n$AXIOS(...)\n" - pattern-either: - pattern: '$AXIOS({url: "$URL"}, ...)' - - pattern: '$OPTS = {url: "$URL"} - - ... - - $AXIOS($OPTS, ...) - - ' + - pattern: "$OPTS = {url: \"$URL\"}\n...\n$AXIOS($OPTS, ...)\n" - pattern: fetch("$URL", ...) - metavariable-regex: metavariable: $URL regex: ^([Hh][Tt][Tt][Pp]:\/\/(?!localhost).*) + severity: ERROR diff --git a/.semgrep/registry/owasp-top-ten.yaml b/.semgrep/registry/owasp-top-ten.yaml index 551d4e2..a4aad93 100644 --- a/.semgrep/registry/owasp-top-ten.yaml +++ b/.semgrep/registry/owasp-top-ten.yaml @@ -5,165 +5,155 @@ # (the semgrep-registry-update workflow does this on a schedule). rules: - id: bash.curl.security.curl-eval.curl-eval - severity: WARNING languages: - bash - message: Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could - inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If - you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity. + message: Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command + could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you + can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its + integrity. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' - category: security - technology: - - bash - - curl - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval - shortlink: https://sg.run/0yqJ semgrep.dev: rule: + origin: community r_id: 14554 - rv_id: 1262601 rule_id: KxU7Rq - version_id: JdTzxL2 + rv_id: 1262601 url: https://semgrep.dev/playground/r/JdTzxL2/bash.curl.security.curl-eval.curl-eval - origin: community + version_id: JdTzxL2 + shortlink: https://sg.run/0yqJ + source: https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval + subcategory: + - vuln + technology: + - bash + - curl + vulnerability_class: + - Code Injection mode: taint - pattern-sources: - - pattern: '$(curl ...) - - ' - - pattern: '`curl ...` - - ' pattern-sinks: - pattern: eval ... + pattern-sources: + - pattern: "$(curl ...)\n" + - pattern: "`curl ...`\n" + severity: WARNING - id: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe languages: - clojure - severity: ERROR + message: DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity + declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature + "http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively, allow DOCTYPE declarations and only + prohibit external entities declarations. This can be done by setting the features + "http://xml.org/sax/features/external-general-entities" and + "http://xml.org/sax/features/external-parameter-entities" to false. metadata: + asvs: + control_id: 5.5.2 Insecue XML Deserialization + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - asvs: - section: V5 Validation, Sanitization and Encoding - control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention - version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://xerces.apache.org/xerces2-j/features.html - source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/xxe-clojure-xml/xxe-clojure-xml.yml - category: security - technology: - - clojure - - xml - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe - shortlink: https://sg.run/v7An semgrep.dev: rule: + origin: community r_id: 71533 - rv_id: 1262608 rule_id: bwU3Gj + rv_id: 1262608 + url: + https://semgrep.dev/playground/r/WrTqKyD/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe version_id: WrTqKyD - url: https://semgrep.dev/playground/r/WrTqKyD/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe - origin: community - message: DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, - this is vulnerable to XML external entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" - to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done - by setting the features "http://xml.org/sax/features/external-general-entities" and "http://xml.org/sax/features/external-parameter-entities" - to false. - patterns: - - pattern-inside: '(ns ... (:require [clojure.xml :as ...])) - - ... - - ' + shortlink: https://sg.run/v7An + source: https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe + source-rule-url: + https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/xxe-clojure-xml/xxe-clojure-xml.yml + subcategory: + - vuln + technology: + - clojure + - xml + vulnerability_class: + - XML Injection + patterns: + - pattern-inside: "(ns ... (:require [clojure.xml :as ...]))\n...\n" - pattern-either: - - pattern-inside: '(def ... ... ( ... )) - - ' - - pattern-inside: '(defn ... ... ( ... )) - - ' + - pattern-inside: "(def ... ... ( ... ))\n" + - pattern-inside: "(defn ... ... ( ... ))\n" - pattern-either: - pattern: (clojure.xml/parse $INPUT) - patterns: - - pattern-inside: '(doto (javax.xml.parsers.SAXParserFactory/newInstance) ...) - - ' + - pattern-inside: "(doto (javax.xml.parsers.SAXParserFactory/newInstance) ...)\n" - pattern: (.setFeature "http://apache.org/xml/features/disallow-doctype-decl" false) - pattern-not-inside: "(doto (javax.xml.parsers.SAXParserFactory/newInstance)\n ...\n (.setFeature \"http://xml.org/sax/features/external-general-entities\"\ \ false)\n ...\n (.setFeature \"http://xml.org/sax/features/external-parameter-entities\" false)\n ...)\n" - pattern-not-inside: "(doto (javax.xml.parsers.SAXParserFactory/newInstance)\n ...\n (.setFeature \"http://xml.org/sax/features/external-parameter-entities\"\ \ false)\n ...\n (.setFeature \"http://xml.org/sax/features/external-general-entities\" false)\n ...)\n" + severity: ERROR - id: clojure.lang.security.use-of-md5.use-of-md5 languages: - clojure - severity: WARNING - message: MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace - with current recommended hashing algorithms. + message: MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. + Replace with current recommended hashing algorithms. metadata: - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html - - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html - technology: - - clojure - source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/weak-hash-function-md5.yml - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-328: Use of Weak Hash' author: Gabriel Marquet category: security - subcategory: - - vuln confidence: HIGH - likelihood: MEDIUM + cwe: + - 'CWE-328: Use of Weak Hash' impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5 - shortlink: https://sg.run/BgPx + likelihood: MEDIUM + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html + - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 52195 - rv_id: 1262609 rule_id: nJU1ep - version_id: 0bTKz2B + rv_id: 1262609 url: https://semgrep.dev/playground/r/0bTKz2B/clojure.lang.security.use-of-md5.use-of-md5 - origin: community + version_id: 0bTKz2B + shortlink: https://sg.run/BgPx + source: https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5 + source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/weak-hash-function-md5.yml + subcategory: + - vuln + technology: + - clojure + vulnerability_class: + - Insecure Hashing Algorithm pattern-either: - pattern: (MessageDigest/getInstance "MD5") - pattern: (MessageDigest/getInstance MessageDigestAlgorithms/MD5) @@ -171,46 +161,46 @@ rules: - pattern: (java.security.MessageDigest/getInstance "MD5") - pattern: (java.security.MessageDigest/getInstance MessageDigestAlgorithms/MD5) - pattern: (java.security.MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5) + severity: WARNING - id: clojure.lang.security.use-of-sha1.use-of-sha1 languages: - clojure - severity: WARNING - message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not - suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function - applications. + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore + not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other + hash function applications. metadata: - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html - - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html - technology: - - clojure - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - 'CWE-328: Use of Weak Hash' - category: security - subcategory: - - vuln - confidence: HIGH - likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1 - shortlink: https://sg.run/dvwX + likelihood: MEDIUM + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html + - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 71534 - rv_id: 1262610 rule_id: NbUy12 - version_id: K3TKk7E + rv_id: 1262610 url: https://semgrep.dev/playground/r/K3TKk7E/clojure.lang.security.use-of-sha1.use-of-sha1 - origin: community + version_id: K3TKk7E + shortlink: https://sg.run/dvwX + source: https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1 + subcategory: + - vuln + technology: + - clojure + vulnerability_class: + - Cryptographic Issues + - Insecure Hashing Algorithm patterns: - pattern-either: - pattern: (MessageDigest/getInstance $ALGO) @@ -218,17 +208,20 @@ rules: - metavariable-regex: metavariable: $ALGO regex: (((org\.apache\.commons\.codec\.digest\.)?MessageDigestAlgorithms/)?"?(SHA-1|SHA1)"?) + severity: WARNING - id: csharp.dotnet.security.audit.ldap-injection.ldap-injection - message: LDAP queries are constructed dynamically on user-controlled input. This vulnerability in code could lead to an - arbitrary LDAP query execution. - severity: ERROR + languages: + - csharp + message: LDAP queries are constructed dynamically on user-controlled input. This vulnerability in code could lead to + an arbitrary LDAP query execution. metadata: - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM category: security + confidence: MEDIUM cwe: - - 'CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (''LDAP Injection'')' + - "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -237,110 +230,106 @@ rules: - https://owasp.org/Top10/A03_2021-Injection/ - https://cwe.mitre.org/data/definitions/90 - https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html#safe-c-sharp-net-tba-example + semgrep.dev: + rule: + origin: community + r_id: 27692 + rule_id: 2ZUv3R + rv_id: 1262612 + url: https://semgrep.dev/playground/r/l4TJR8G/csharp.dotnet.security.audit.ldap-injection.ldap-injection + version_id: l4TJR8G + shortlink: https://sg.run/GJ9z + source: https://semgrep.dev/r/csharp.dotnet.security.audit.ldap-injection.ldap-injection subcategory: - vuln technology: - .net - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - LDAP Injection - source: https://semgrep.dev/r/csharp.dotnet.security.audit.ldap-injection.ldap-injection - shortlink: https://sg.run/GJ9z - semgrep.dev: - rule: - r_id: 27692 - rv_id: 1262612 - rule_id: 2ZUv3R - version_id: l4TJR8G - url: https://semgrep.dev/playground/r/l4TJR8G/csharp.dotnet.security.audit.ldap-injection.ldap-injection - origin: community - languages: - - csharp mode: taint options: taint_unify_mvars: true - pattern-sources: - - patterns: - - focus-metavariable: $INPUT - - pattern-inside: $T $M(...,$INPUT,...) {...} + pattern-sanitizers: + - pattern-either: + - pattern: Regex.Replace($INPUT, ...) + - pattern: $ENCODER.LdapFilterEncode($INPUT) + - pattern: $ENCODER.LdapDistinguishedNameEncode($INPUT) pattern-sinks: - patterns: - pattern-either: - pattern: $S.Filter = ... + $INPUT + ... - pattern: $S.Filter = String.Format(...,$INPUT) - pattern: $S.Filter = String.Concat(...,$INPUT) - pattern-sanitizers: - - pattern-either: - - pattern: Regex.Replace($INPUT, ...) - - pattern: $ENCODER.LdapFilterEncode($INPUT) - - pattern: $ENCODER.LdapDistinguishedNameEncode($INPUT) + pattern-sources: + - patterns: + - focus-metavariable: $INPUT + - pattern-inside: $T $M(...,$INPUT,...) {...} + severity: ERROR - id: csharp.dotnet.security.audit.mass-assignment.mass-assignment - message: Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which - could create a new parameter in the binding request and manipulate the underlying object in the application. - severity: WARNING + languages: + - csharp + message: Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, + which could create a new parameter in the binding request and manipulate the underlying object in the application. metadata: - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM category: security + confidence: MEDIUM cwe: - 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://cwe.mitre.org/data/definitions/915.html - https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md + semgrep.dev: + rule: + origin: community + r_id: 26838 + rule_id: x8Up5B + rv_id: 1262613 + url: https://semgrep.dev/playground/r/YDTZeD9/csharp.dotnet.security.audit.mass-assignment.mass-assignment + version_id: YDTZeD9 + shortlink: https://sg.run/7B3e + source: https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment subcategory: - vuln technology: - .net - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mass Assignment - source: https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment - shortlink: https://sg.run/7B3e - semgrep.dev: - rule: - r_id: 26838 - rv_id: 1262613 - rule_id: x8Up5B - version_id: YDTZeD9 - url: https://semgrep.dev/playground/r/YDTZeD9/csharp.dotnet.security.audit.mass-assignment.mass-assignment - origin: community - languages: - - csharp mode: taint + pattern-sinks: + - pattern: View(...) pattern-sources: - patterns: - pattern-either: - pattern: "public IActionResult $METHOD(..., $TYPE $ARG, ...){\n ...\n}\n" - pattern: "public ActionResult $METHOD(..., $TYPE $ARG, ...){\n ...\n}\n" - - pattern-inside: 'using Microsoft.AspNetCore.Mvc; - - ... - - ' + - pattern-inside: "using Microsoft.AspNetCore.Mvc;\n...\n" - pattern-not: "public IActionResult $METHOD(..., [Bind(...)] $TYPE $ARG, ...){\n ...\n}\n" - pattern-not: "public ActionResult $METHOD(..., [Bind(...)] $TYPE $ARG, ...){\n ...\n}\n" - focus-metavariable: $ARG - pattern-sinks: - - pattern: View(...) + severity: WARNING - id: csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization - message: Anonymous access shouldn't be allowed unless explicit by design. Access control checks are missing and potentially - can be bypassed. This finding violates the principle of least privilege or deny by default, where access should only be - permitted for a specific set of roles or conforms to a custom policy or users. - severity: INFO + languages: + - csharp + message: Anonymous access shouldn't be allowed unless explicit by design. Access control checks are missing and + potentially can be bypassed. This finding violates the principle of least privilege or deny by default, where access + should only be permitted for a specific set of roles or conforms to a custom policy or users. metadata: - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM category: security + confidence: MEDIUM cwe: - 'CWE-862: Missing Authorization' cwe2021-top25: true cwe2022-top25: true cwe2023-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control @@ -348,47 +337,45 @@ rules: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - https://cwe.mitre.org/data/definitions/862.html - https://docs.microsoft.com/en-us/aspnet/core/security/authorization/simple?view=aspnetcore-7.0 + semgrep.dev: + rule: + origin: community + r_id: 26335 + rule_id: eqU32Y + rv_id: 1262615 + url: + https://semgrep.dev/playground/r/o5TbD41/csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization + version_id: o5TbD41 + shortlink: https://sg.run/Z8GA + source: + https://semgrep.dev/r/csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization subcategory: - vuln technology: - .net - mvc - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization - source: https://semgrep.dev/r/csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization - shortlink: https://sg.run/Z8GA - semgrep.dev: - rule: - r_id: 26335 - rv_id: 1262615 - rule_id: eqU32Y - version_id: o5TbD41 - url: https://semgrep.dev/playground/r/o5TbD41/csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization - origin: community - languages: - - csharp patterns: - pattern: "public class $CLASS : Controller {\n ...\n}\n" - - pattern-inside: 'using Microsoft.AspNetCore.Mvc; - - ... - - ' + - pattern-inside: "using Microsoft.AspNetCore.Mvc;\n...\n" - pattern-not: "[AllowAnonymous]\npublic class $CLASS : Controller {\n ...\n}\n" - pattern-not: "[Authorize]\npublic class $CLASS : Controller {\n ...\n}\n" - pattern-not: "[Authorize(Roles = ...)]\npublic class $CLASS : Controller {\n ...\n}\n" - pattern-not: "[Authorize(Policy = ...)]\npublic class $CLASS : Controller {\n ...\n}\n" + severity: INFO - id: csharp.dotnet.security.audit.open-directory-listing.open-directory-listing + languages: + - csharp message: An open directory listing is potentially exposed, potentially revealing sensitive information to attackers. - severity: INFO metadata: - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM category: security + confidence: MEDIUM cwe: - 'CWE-548: Exposure of Information Through Directory Listing' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A06:2017 - Security Misconfiguration - A01:2021 - Broken Access Control @@ -397,72 +384,66 @@ rules: - https://cwe.mitre.org/data/definitions/548.html - https://owasp.org/Top10/A05_2021-Security_Misconfiguration/ - https://docs.microsoft.com/en-us/aspnet/core/fundamentals/static-files?view=aspnetcore-7.0#directory-browsing + semgrep.dev: + rule: + origin: community + r_id: 26336 + rule_id: v8U8Ab + rv_id: 1262616 + url: + https://semgrep.dev/playground/r/zyTb2Y2/csharp.dotnet.security.audit.open-directory-listing.open-directory-listing + version_id: zyTb2Y2 + shortlink: https://sg.run/n0y1 + source: https://semgrep.dev/r/csharp.dotnet.security.audit.open-directory-listing.open-directory-listing subcategory: - vuln technology: - .net - mvc - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information - source: https://semgrep.dev/r/csharp.dotnet.security.audit.open-directory-listing.open-directory-listing - shortlink: https://sg.run/n0y1 - semgrep.dev: - rule: - r_id: 26336 - rv_id: 1262616 - rule_id: v8U8Ab - version_id: zyTb2Y2 - url: https://semgrep.dev/playground/r/zyTb2Y2/csharp.dotnet.security.audit.open-directory-listing.open-directory-listing - origin: community - languages: - - csharp patterns: - pattern-either: - pattern: (IApplicationBuilder $APP).UseDirectoryBrowser(...); - pattern: $BUILDER.Services.AddDirectoryBrowser(...); - pattern-inside: "public void Configure(...) {\n ...\n}\n" + severity: INFO - id: csharp.dotnet.security.audit.xpath-injection.xpath-injection - message: XPath queries are constructed dynamically on user-controlled input. This vulnerability in code could lead to an - XPath Injection exploitation. - severity: ERROR + languages: + - csharp + message: XPath queries are constructed dynamically on user-controlled input. This vulnerability in code could lead to + an XPath Injection exploitation. metadata: - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM category: security + confidence: MEDIUM cwe: - - 'CWE-643: Improper Neutralization of Data within XPath Expressions (''XPath Injection'')' + - "CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection/ - https://cwe.mitre.org/data/definitions/643.html + semgrep.dev: + rule: + origin: community + r_id: 27400 + rule_id: x8Uj2k + rv_id: 1262618 + url: https://semgrep.dev/playground/r/2KTv2Pq/csharp.dotnet.security.audit.xpath-injection.xpath-injection + version_id: 2KTv2Pq + shortlink: https://sg.run/4KP7 + source: https://semgrep.dev/r/csharp.dotnet.security.audit.xpath-injection.xpath-injection subcategory: - vuln technology: - .net - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XPath Injection - source: https://semgrep.dev/r/csharp.dotnet.security.audit.xpath-injection.xpath-injection - shortlink: https://sg.run/4KP7 - semgrep.dev: - rule: - r_id: 27400 - rv_id: 1262618 - rule_id: x8Uj2k - version_id: 2KTv2Pq - url: https://semgrep.dev/playground/r/2KTv2Pq/csharp.dotnet.security.audit.xpath-injection.xpath-injection - origin: community - languages: - - csharp mode: taint - pattern-sources: - - pattern-either: - - pattern: $T $M($INPUT,...) {...} - - pattern: "$T $M(...) {\n ...\n string $INPUT;\n}\n" pattern-sinks: - pattern-either: - pattern: XPathExpression $EXPR = $NAV.Compile("..." + $INPUT + "..."); @@ -471,67 +452,72 @@ rules: - pattern: var $NODE = $NAV.Select("..." + $INPUT + "..."); - pattern: Object $OBJ = $NAV.Evaluate("..." + $INPUT + "..."); - pattern: var $OBJ = $NAV.Evaluate("..." + $INPUT + "..."); + pattern-sources: + - pattern-either: + - pattern: $T $M($INPUT,...) {...} + - pattern: "$T $M(...) {\n ...\n string $INPUT;\n}\n" + severity: ERROR - id: csharp.dotnet.security.razor-template-injection.razor-template-injection - message: User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process. - severity: WARNING + languages: + - csharp + message: User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the + process. metadata: - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM category: security + confidence: MEDIUM cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/ + semgrep.dev: + rule: + origin: community + r_id: 18216 + rule_id: EwUr68 + rv_id: 1262621 + url: + https://semgrep.dev/playground/r/1QTypdj/csharp.dotnet.security.razor-template-injection.razor-template-injection + version_id: 1QTypdj + shortlink: https://sg.run/oyj0 + source: https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection subcategory: - vuln technology: - .net - razor - asp - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection - source: https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection - shortlink: https://sg.run/oyj0 - semgrep.dev: - rule: - r_id: 18216 - rv_id: 1262621 - rule_id: EwUr68 - version_id: 1QTypdj - url: https://semgrep.dev/playground/r/1QTypdj/csharp.dotnet.security.razor-template-injection.razor-template-injection - origin: community - languages: - - csharp mode: taint - pattern-sources: - - patterns: - - focus-metavariable: $ARG - - pattern-inside: 'public ActionResult $METHOD(..., string $ARG,...){...} - - ' - pattern-sinks: - - pattern: 'Razor.Parse(...) - - ' pattern-sanitizers: - not_conflicting: true pattern: $F(...) + pattern-sinks: + - pattern: "Razor.Parse(...)\n" + pattern-sources: + - patterns: + - focus-metavariable: $ARG + - pattern-inside: "public ActionResult $METHOD(..., string $ARG,...){...}\n" + severity: WARNING - id: csharp.dotnet.security.use_deprecated_cipher_algorithm.use_deprecated_cipher_algorithm + languages: + - csharp message: Usage of deprecated cipher algorithm detected. Use Aes or ChaCha20Poly1305 instead. - severity: ERROR metadata: - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures @@ -540,25 +526,23 @@ rules: - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.rc2?view=net-6.0#remarks - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aes?view=net-6.0 - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0 + semgrep.dev: + rule: + origin: community + r_id: 36772 + rule_id: WAUJr0 + rv_id: 1262622 + url: + https://semgrep.dev/playground/r/9lT4bRK/csharp.dotnet.security.use_deprecated_cipher_algorithm.use_deprecated_cipher_algorithm + version_id: 9lT4bRK + shortlink: https://sg.run/k8Qo + source: https://semgrep.dev/r/csharp.dotnet.security.use_deprecated_cipher_algorithm.use_deprecated_cipher_algorithm subcategory: - vuln technology: - .net - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues - source: https://semgrep.dev/r/csharp.dotnet.security.use_deprecated_cipher_algorithm.use_deprecated_cipher_algorithm - shortlink: https://sg.run/k8Qo - semgrep.dev: - rule: - r_id: 36772 - rv_id: 1262622 - rule_id: WAUJr0 - version_id: 9lT4bRK - url: https://semgrep.dev/playground/r/9lT4bRK/csharp.dotnet.security.use_deprecated_cipher_algorithm.use_deprecated_cipher_algorithm - origin: community - languages: - - csharp patterns: - pattern: $KEYTYPE.Create(...); - metavariable-pattern: @@ -566,17 +550,20 @@ rules: pattern-either: - pattern: DES - pattern: RC2 + severity: ERROR - id: csharp.dotnet.security.use_ecb_mode.use_ecb_mode - message: Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented - by the classes AesGcm or ChaCha20Poly1305. - severity: WARNING + languages: + - csharp + message: Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is + implemented by the classes AesGcm or ChaCha20Poly1305. metadata: - likelihood: HIGH - impact: MEDIUM - confidence: HIGH category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures @@ -585,25 +572,22 @@ rules: - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0 - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0 - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes + semgrep.dev: + rule: + origin: community + r_id: 36773 + rule_id: 0oUqWP + rv_id: 1262623 + url: https://semgrep.dev/playground/r/yeTxpPw/csharp.dotnet.security.use_ecb_mode.use_ecb_mode + version_id: yeTxpPw + shortlink: https://sg.run/wj9n + source: https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode subcategory: - vuln technology: - .net - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues - source: https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode - shortlink: https://sg.run/wj9n - semgrep.dev: - rule: - r_id: 36773 - rv_id: 1262623 - rule_id: 0oUqWP - version_id: yeTxpPw - url: https://semgrep.dev/playground/r/yeTxpPw/csharp.dotnet.security.use_ecb_mode.use_ecb_mode - origin: community - languages: - - csharp patterns: - pattern-either: - pattern: ($KEYTYPE $KEY).EncryptEcb(...); @@ -618,17 +602,20 @@ rules: - pattern: DES - pattern: TripleDES - pattern: RC2 + severity: WARNING - id: csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration - message: You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never - be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead. - severity: ERROR + languages: + - csharp + message: You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must + never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead. metadata: - likelihood: HIGH - impact: MEDIUM - confidence: HIGH category: security + confidence: HIGH cwe: - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures @@ -637,30 +624,24 @@ rules: - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0 - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key + semgrep.dev: + rule: + origin: community + r_id: 36774 + rule_id: KxU3Nq + rv_id: 1262624 + url: + https://semgrep.dev/playground/r/rxTAK2O/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration + version_id: rxTAK2O + shortlink: https://sg.run/xjrA + source: https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration subcategory: - vuln technology: - .net - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues - source: https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration - shortlink: https://sg.run/xjrA - semgrep.dev: - rule: - r_id: 36774 - rv_id: 1262624 - rule_id: KxU3Nq - version_id: rxTAK2O - url: https://semgrep.dev/playground/r/rxTAK2O/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration - origin: community - languages: - - csharp mode: taint - pattern-sources: - - patterns: - - pattern-inside: (System.Random $RNG).NextBytes($KEY); ... - - pattern: $KEY pattern-sinks: - pattern-either: - patterns: @@ -678,16 +659,23 @@ rules: - pattern: new AesGcm(...) - pattern: new AesCcm(...) - pattern: new ChaCha20Poly1305(...) + pattern-sources: + - patterns: + - pattern-inside: (System.Random $RNG).NextBytes($KEY); ... + - pattern: $KEY + severity: ERROR - id: csharp.dotnet.security.use_weak_rsa_encryption_padding.use_weak_rsa_encryption_padding + languages: + - csharp message: You are using the outdated PKCS#1 v1.5 encryption padding for your RSA key. Use the OAEP padding instead. - severity: WARNING metadata: - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM category: security + confidence: MEDIUM cwe: - 'CWE-780: Use of RSA Algorithm without OAEP' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures @@ -696,176 +684,169 @@ rules: - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.rsaoaepkeyexchangeformatter - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.rsapkcs1keyexchangedeformatter - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.rsaoaepkeyexchangedeformatter + semgrep.dev: + rule: + origin: community + r_id: 35492 + rule_id: QrU2G5 + rv_id: 1262625 + url: + https://semgrep.dev/playground/r/bZT53zb/csharp.dotnet.security.use_weak_rsa_encryption_padding.use_weak_rsa_encryption_padding + version_id: bZT53zb + shortlink: https://sg.run/GoJ1 + source: https://semgrep.dev/r/csharp.dotnet.security.use_weak_rsa_encryption_padding.use_weak_rsa_encryption_padding subcategory: - vuln technology: - .net - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues - source: https://semgrep.dev/r/csharp.dotnet.security.use_weak_rsa_encryption_padding.use_weak_rsa_encryption_padding - shortlink: https://sg.run/GoJ1 - semgrep.dev: - rule: - r_id: 35492 - rv_id: 1262625 - rule_id: QrU2G5 - version_id: bZT53zb - url: https://semgrep.dev/playground/r/bZT53zb/csharp.dotnet.security.use_weak_rsa_encryption_padding.use_weak_rsa_encryption_padding - origin: community - languages: - - csharp pattern-either: - pattern: (RSAPKCS1KeyExchangeFormatter $FORMATER).CreateKeyExchange(...); - pattern: (RSAPKCS1KeyExchangeDeformatter $DEFORMATER).DecryptKeyExchange(...); -- id: csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation - patterns: - - pattern-either: - - patterns: - - pattern: $LIFETIME = $FALSE - - pattern-inside: new TokenValidationParameters {...} - - patterns: - - pattern: '(TokenValidationParameters $OPTS). ... .$LIFETIME = $FALSE - - ' - - metavariable-regex: - metavariable: $LIFETIME - regex: (RequireExpirationTime|ValidateLifetime) - - metavariable-regex: - metavariable: $FALSE - regex: (false) - - focus-metavariable: $FALSE - fix: 'true - - ' - message: The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. - This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate - the JWT lifetime to ensure only valid tokens are used. + severity: WARNING +- fix: "true\n" + id: + csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation + languages: + - csharp + message: The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not + validated. This can lead to an JWT token being used after it has expired, which has security implications. It is + recommended to validate the JWT lifetime to ensure only valid tokens are used. metadata: category: security - technology: - - csharp + confidence: HIGH + cwe: + - 'CWE-613: Insufficient Session Expiration' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - cwe: - - 'CWE-613: Insufficient Session Expiration' references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/ - https://cwe.mitre.org/data/definitions/613.html - https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet - subcategory: - - audit - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation - shortlink: https://sg.run/KA0d semgrep.dev: rule: + origin: community r_id: 28955 - rv_id: 1262628 rule_id: bwU5kK + rv_id: 1262628 + url: + https://semgrep.dev/playground/r/w8TRolJ/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation version_id: w8TRolJ - url: https://semgrep.dev/playground/r/w8TRolJ/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation - origin: community + shortlink: https://sg.run/KA0d + source: + https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation + subcategory: + - audit + technology: + - csharp + vulnerability_class: + - Improper Authorization + patterns: + - pattern-either: + - patterns: + - pattern: $LIFETIME = $FALSE + - pattern-inside: new TokenValidationParameters {...} + - patterns: + - pattern: "(TokenValidationParameters $OPTS). ... .$LIFETIME = $FALSE\n" + - metavariable-regex: + metavariable: $LIFETIME + regex: (RequireExpirationTime|ValidateLifetime) + - metavariable-regex: + metavariable: $FALSE + regex: (false) + - focus-metavariable: $FALSE + severity: WARNING +- fix: RequireSignedTokens = true + id: csharp.lang.security.cryptography.unsigned-security-token.unsigned-security-token languages: - csharp - severity: WARNING -- id: csharp.lang.security.cryptography.unsigned-security-token.unsigned-security-token - patterns: - - pattern: RequireSignedTokens = false - - pattern-inside: "new TokenValidationParameters {\n ...\n}\n" - fix: RequireSignedTokens = true - message: Accepting unsigned security tokens as valid security tokens allows an attacker to remove its signature and potentially - forge an identity. As a fix, set RequireSignedTokens to be true. + message: Accepting unsigned security tokens as valid security tokens allows an attacker to remove its signature and + potentially forge an identity. As a fix, set RequireSignedTokens to be true. metadata: category: security - technology: - - csharp + confidence: MEDIUM + cwe: + - 'CWE-347: Improper Verification of Cryptographic Signature' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-347: Improper Verification of Cryptographic Signature' references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control/ - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/ - https://cwe.mitre.org/data/definitions/347 - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/csharp.lang.security.cryptography.unsigned-security-token.unsigned-security-token - shortlink: https://sg.run/pqzN semgrep.dev: rule: + origin: community r_id: 26718 - rv_id: 1262631 rule_id: KxUGLw + rv_id: 1262631 + url: + https://semgrep.dev/playground/r/e1Tyjrz/csharp.lang.security.cryptography.unsigned-security-token.unsigned-security-token version_id: e1Tyjrz - url: https://semgrep.dev/playground/r/e1Tyjrz/csharp.lang.security.cryptography.unsigned-security-token.unsigned-security-token - origin: community - languages: - - csharp + shortlink: https://sg.run/pqzN + source: https://semgrep.dev/r/csharp.lang.security.cryptography.unsigned-security-token.unsigned-security-token + subcategory: + - vuln + technology: + - csharp + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: RequireSignedTokens = false + - pattern-inside: "new TokenValidationParameters {\n ...\n}\n" severity: ERROR - id: csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation - severity: WARNING languages: - csharp + message: Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method + instead. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-295: Improper Certificate Validation' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8 - category: security - technology: - - .net - confidence: MEDIUM - subcategory: - - vuln - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation - shortlink: https://sg.run/XZ6B semgrep.dev: rule: + origin: community r_id: 18220 - rv_id: 1262629 rule_id: gxUy01 + rv_id: 1262629 + url: + https://semgrep.dev/playground/r/xyTjzGW/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation version_id: xyTjzGW - url: https://semgrep.dev/playground/r/xyTjzGW/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation - origin: community - message: Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead. + shortlink: https://sg.run/XZ6B + source: + https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation + subcategory: + - vuln + technology: + - .net + vulnerability_class: + - Improper Authentication patterns: - - pattern-inside: 'using System.IdentityModel.Tokens; - - ... - - ' + - pattern-inside: "using System.IdentityModel.Tokens;\n...\n" - pattern-either: - patterns: - pattern-either: - - pattern-inside: 'X509SecurityToken $TOK = $RHS; - - ... - - ' + - pattern-inside: "X509SecurityToken $TOK = $RHS;\n...\n" - pattern-inside: "$T $M(..., X509SecurityToken $TOK, ...) {\n ...\n}\n" - metavariable-pattern: metavariable: $RHS @@ -874,11 +855,7 @@ rules: - pattern: new X509SecurityToken(...) - patterns: - pattern-either: - - pattern-inside: 'X509Certificate2 $CERT = new X509Certificate2(...); - - ... - - ' + - pattern-inside: "X509Certificate2 $CERT = new X509Certificate2(...);\n...\n" - pattern-inside: "$T $M(..., X509Certificate2 $CERT, ...) {\n ...\n}\n" - pattern-inside: "foreach (X509Certificate2 $CERT in $COLLECTION) {\n ...\n}\n" - patterns: @@ -888,1535 +865,1407 @@ rules: - pattern: $NAME.Equals("...") - pattern: $NAME == "..." - pattern: $NAME != "..." - - pattern: '"..." == $NAME - - ' - - pattern: '"..." != $NAME - - ' + - pattern: "\"...\" == $NAME\n" + - pattern: "\"...\" != $NAME\n" - metavariable-pattern: metavariable: $NAME pattern-either: - pattern: $TOK.Certificate.SubjectName.Name - pattern: $CERT.SubjectName.Name - pattern: $CERT.GetNameInfo(...) + severity: WARNING - id: csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine - mode: taint - pattern-sources: - - patterns: - - pattern: $A - - pattern-inside: 'Path.Combine(...,$A,...) - - ' - - pattern-inside: 'public $TYPE $M(...,$A,...){...} - - ' - - pattern-not-inside: '<... Path.GetFileName($A) != $A ...> - - ' - pattern-sinks: - - patterns: - - focus-metavariable: $X - - pattern: 'File.$METHOD($X,...) - - ' - - metavariable-regex: - metavariable: $METHOD - regex: (?i)^(read|write) - pattern-sanitizers: - - pattern: 'Path.GetFileName(...) - - ' - - patterns: - - pattern-inside: '$X = Path.GetFileName(...); - - ... - - ' - - pattern: $X - - patterns: - - pattern: $X - - pattern-inside: "if(<... Path.GetFileName($X) != $X ...>){\n ...\n throw new $EXCEPTION(...);\n}\n...\n" - message: String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. - If the path is user-supplied data this can lead to path traversal. languages: - csharp - severity: WARNING + message: String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via + Path.GetFileName. If the path is user-supplied data this can lead to path traversal. metadata: category: security confidence: MEDIUM - references: - - https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/ - - https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks - technology: - - .net cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine - shortlink: https://sg.run/1RvG + references: + - https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/ + - https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks semgrep.dev: rule: + origin: community r_id: 18222 - rv_id: 1262632 rule_id: 3qU3bE + rv_id: 1262632 + url: + https://semgrep.dev/playground/r/vdT0644/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine version_id: vdT0644 - url: https://semgrep.dev/playground/r/vdT0644/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine - origin: community -- id: csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings + shortlink: https://sg.run/1RvG + source: https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine + subcategory: + - vuln + technology: + - .net + vulnerability_class: + - Path Traversal + mode: taint + pattern-sanitizers: + - pattern: "Path.GetFileName(...)\n" + - patterns: + - pattern-inside: "$X = Path.GetFileName(...);\n...\n" + - pattern: $X + - patterns: + - pattern: $X + - pattern-inside: "if(<... Path.GetFileName($X) != $X ...>){\n ...\n throw new $EXCEPTION(...);\n}\n...\n" + pattern-sinks: + - patterns: + - focus-metavariable: $X + - pattern: "File.$METHOD($X,...)\n" + - metavariable-regex: + metavariable: $METHOD + regex: (?i)^(read|write) + pattern-sources: + - patterns: + - pattern: $A + - pattern-inside: "Path.Combine(...,$A,...)\n" + - pattern-inside: "public $TYPE $M(...,$A,...){...}\n" + - pattern-not-inside: "<... Path.GetFileName($A) != $A ...>\n" severity: WARNING +- id: csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings languages: - C# + message: The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give + attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard + binding. For example, you can use "*.asdf.gov" if you own all of "asdf.gov". metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0 - category: security - technology: - - .net - confidence: MEDIUM - subcategory: - - vuln - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings - shortlink: https://sg.run/9LJr semgrep.dev: rule: + origin: community r_id: 18223 - rv_id: 1262633 rule_id: 4bUQ81 + rv_id: 1262633 + url: + https://semgrep.dev/playground/r/d6Tyx4K/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings version_id: d6Tyx4K - url: https://semgrep.dev/playground/r/d6Tyx4K/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings - origin: community - message: The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers - more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, - you can use "*.asdf.gov" if you own all of "asdf.gov". + shortlink: https://sg.run/9LJr + source: + https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings + subcategory: + - vuln + technology: + - .net + vulnerability_class: + - Improper Authorization patterns: - - pattern-inside: 'using System.Net; - - ... - - ' + - pattern-inside: "using System.Net;\n...\n" - pattern: $LISTENER.Prefixes.Add("$PREFIX") - metavariable-regex: metavariable: $PREFIX regex: (http|https)://(\*|\+)(.[a-zA-Z]{2,})?:[0-9]+ -- id: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization severity: WARNING +- id: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization languages: - C# + message: The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop + using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. + BinaryFormatter is insecure and can't be made secure metadata: + category: security + confidence: HIGH cwe: - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide - category: security - technology: - - .net - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization - shortlink: https://sg.run/ZeXW semgrep.dev: rule: + origin: community r_id: 11135 - rv_id: 1262635 rule_id: bwUOjK + rv_id: 1262635 + url: + https://semgrep.dev/playground/r/nWT2LGp/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization version_id: nWT2LGp - url: https://semgrep.dev/playground/r/nWT2LGp/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization - origin: community - message: The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using - BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter - is insecure and can't be made secure + shortlink: https://sg.run/ZeXW + source: + https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization + subcategory: + - vuln + technology: + - .net + vulnerability_class: + - 'Insecure Deserialization ' patterns: - - pattern-inside: 'using System.Runtime.Serialization.Formatters.Binary; - - ... - - ' - - pattern: 'new BinaryFormatter(); - - ' -- id: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization + - pattern-inside: "using System.Runtime.Serialization.Formatters.Binary;\n...\n" + - pattern: "new BinaryFormatter();\n" severity: WARNING +- id: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization languages: - C# + message: The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure + deserialization vulnerability. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution - category: security - technology: - - .net - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization - shortlink: https://sg.run/E5e5 semgrep.dev: rule: + origin: community r_id: 11137 - rv_id: 1262638 rule_id: kxURnR + rv_id: 1262638 + url: + https://semgrep.dev/playground/r/LjTkgPk/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization version_id: LjTkgPk - url: https://semgrep.dev/playground/r/LjTkgPk/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization - origin: community - message: The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization - vulnerability. + shortlink: https://sg.run/E5e5 + source: + https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization + subcategory: + - vuln + technology: + - .net + vulnerability_class: + - 'Insecure Deserialization ' patterns: - - pattern-inside: 'using MBrace.FsPickler.Json; - - ... - - ' - - pattern: 'FsPickler.CreateJsonSerializer(); - - ' -- id: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization + - pattern-inside: "using MBrace.FsPickler.Json;\n...\n" + - pattern: "FsPickler.CreateJsonSerializer();\n" severity: WARNING +- id: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization languages: - C# + message: The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using + LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter + is insecure and can't be made secure metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8 - category: security - technology: - - .net - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization - shortlink: https://sg.run/70pG semgrep.dev: rule: + origin: community r_id: 11138 - rv_id: 1262641 rule_id: wdU87G + rv_id: 1262641 + url: + https://semgrep.dev/playground/r/QkTGqnA/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization version_id: QkTGqnA - url: https://semgrep.dev/playground/r/QkTGqnA/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization - origin: community - message: The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter - as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and - can't be made secure - patterns: - - pattern-inside: 'using System.Web.UI; - - ... - - ' - - pattern: 'new LosFormatter(); - - ' -- id: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization + shortlink: https://sg.run/70pG + source: + https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization + subcategory: + - vuln + technology: + - .net + vulnerability_class: + - 'Insecure Deserialization ' + patterns: + - pattern-inside: "using System.Web.UI;\n...\n" + - pattern: "new LosFormatter();\n" severity: WARNING +- id: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization languages: - C# + message: The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications + should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to + be trustworthy. NetDataContractSerializer is insecure and can't be made secure metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security - category: security - technology: - - .net - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization - shortlink: https://sg.run/L0AX semgrep.dev: rule: + origin: community r_id: 11139 - rv_id: 1262642 rule_id: x8UW7x + rv_id: 1262642 + url: + https://semgrep.dev/playground/r/3ZT4X6b/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization version_id: 3ZT4X6b - url: https://semgrep.dev/playground/r/3ZT4X6b/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization - origin: community - message: The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should - stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. - NetDataContractSerializer is insecure and can't be made secure - patterns: - - pattern-inside: 'using System.Runtime.Serialization; - - ... - - ' - - pattern: 'new NetDataContractSerializer(); - - ' -- id: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization + shortlink: https://sg.run/L0AX + source: + https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization + subcategory: + - vuln + technology: + - .net + vulnerability_class: + - 'Insecure Deserialization ' + patterns: + - pattern-inside: "using System.Runtime.Serialization;\n...\n" + - pattern: "new NetDataContractSerializer();\n" severity: WARNING +- id: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization languages: - C# + message: The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop + using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. + SoapFormatter is insecure and can't be made secure metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks - category: security - technology: - - .net - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization - shortlink: https://sg.run/gJnR semgrep.dev: rule: + origin: community r_id: 11141 - rv_id: 1262644 rule_id: eqUvND + rv_id: 1262644 + url: + https://semgrep.dev/playground/r/PkTR30n/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization version_id: PkTR30n - url: https://semgrep.dev/playground/r/PkTR30n/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization - origin: community - message: The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using - SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is - insecure and can't be made secure + shortlink: https://sg.run/gJnR + source: + https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization + subcategory: + - vuln + technology: + - .net + vulnerability_class: + - 'Insecure Deserialization ' patterns: - - pattern-inside: 'using System.Runtime.Serialization.Formatters.Soap; - - ... - - ' - - pattern: 'new SoapFormatter(); - - ' -- id: csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout + - pattern-inside: "using System.Runtime.Serialization.Formatters.Soap;\n...\n" + - pattern: "new SoapFormatter();\n" severity: WARNING +- id: + csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout languages: - C# + message: 'Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider + setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double + check that your context meets the conditions outlined in the "Notes to Callers" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-1333: Inefficient Regular Expression Complexity' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: A01:2017 - Injection references: - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS - https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout - https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0 - category: security - technology: - - .net - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Denial-of-Service (DoS) - source: https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout - shortlink: https://sg.run/NgRy semgrep.dev: rule: + origin: community r_id: 18227 - rv_id: 945224 rule_id: GdUDBP + rv_id: 945224 + url: + https://semgrep.dev/playground/r/yeT0nDq/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout version_id: yeT0nDq - url: https://semgrep.dev/playground/r/yeT0nDq/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout - origin: community - message: 'Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider - setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double - check that your context meets the conditions outlined in the "Notes to Callers" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0' + shortlink: https://sg.run/NgRy + source: + https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout + subcategory: + - audit + technology: + - .net + vulnerability_class: + - Denial-of-Service (DoS) patterns: - - pattern-inside: 'using System.Text.RegularExpressions; - - ... - - ' + - pattern-inside: "using System.Text.RegularExpressions;\n...\n" - pattern-either: - pattern: new Regex(..., TimeSpan.InfiniteMatchTimeout) - patterns: - pattern: new Regex(..., TimeSpan.FromSeconds($TIME)) - metavariable-comparison: - metavariable: $TIME comparison: $TIME > 5 + metavariable: $TIME - pattern: new Regex(..., TimeSpan.FromMinutes(...)) - pattern: new Regex(..., TimeSpan.FromHours(...)) -- id: csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos severity: WARNING +- id: csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos languages: - C# + message: When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout. A malicious user can + provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This + will lead to excessive CPU usage, causing a Denial-of-Service attack metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-1333: Inefficient Regular Expression Complexity' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: A01:2017 - Injection references: - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS - https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples - category: security - technology: - - .net - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Denial-of-Service (DoS) - source: https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos - shortlink: https://sg.run/RPyY semgrep.dev: rule: + origin: community r_id: 12005 - rv_id: 945225 rule_id: 4bU2gd + rv_id: 945225 + url: + https://semgrep.dev/playground/r/rxT6rjl/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos version_id: rxT6rjl - url: https://semgrep.dev/playground/r/rxT6rjl/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos - origin: community - message: When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout. A malicious user can provide - input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead - to excessive CPU usage, causing a Denial-of-Service attack + shortlink: https://sg.run/RPyY + source: + https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos + subcategory: + - audit + technology: + - .net + vulnerability_class: + - Denial-of-Service (DoS) patterns: - - pattern-inside: 'using System.Text.RegularExpressions; - - ... - - ' + - pattern-inside: "using System.Text.RegularExpressions;\n...\n" - pattern-either: - pattern: "public $T $F($X)\n{\n Regex $Y = new Regex($P);\n ...\n $Y.Match($X);\n}\n" - pattern: "public $T $F($X)\n{\n Regex $Y = new Regex($P, $O);\n ...\n $Y.Match($X);\n}\n" - pattern: "public $T $F($X)\n{\n ... Regex.Match($X, $P);\n}\n" - pattern: "public $T $F($X)\n{\n ... Regex.Match($X, $P, $O);\n}\n" + severity: WARNING - id: csharp.lang.security.sqli.csharp-sqli.csharp-sqli - mode: taint - pattern-sources: - - patterns: - - pattern: '(string $X) - - ' - - pattern-not: '"..." - - ' - pattern-propagators: - - pattern: (StringBuilder $B).$ANY(...,(string $X),...) - from: $X - to: $B - pattern-sinks: - - patterns: - - pattern-either: - - patterns: - - pattern: 'new $PATTERN($CMD,...) - - ' - - focus-metavariable: $CMD - - patterns: - - pattern: '$CMD.$PATTERN = $VALUE; - - ' - - focus-metavariable: $VALUE - - metavariable-regex: - metavariable: $PATTERN - regex: ^(SqlCommand|CommandText|OleDbCommand|OdbcCommand|OracleCommand)$ - pattern-sanitizers: - - pattern-either: - - pattern: '$CMD.Parameters.Add(...) - - ' - - pattern: '$CMD.Parameters.AddRange(...) - - ' - - pattern: '$CMD.Parameters.AddWithValue(...) - - ' - - pattern: '$CMD.Parameters[$IDX].Value = ... - - ' - by-side-effect: true - message: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement - are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and - 'SqlParameter'. + languages: + - csharp + message: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL + statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using + 'SqlCommand' and 'SqlParameter'. metadata: category: security - technology: - - csharp + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli - shortlink: https://sg.run/d2Xd semgrep.dev: rule: + origin: community r_id: 15078 - rv_id: 1262648 rule_id: x8UxeP - version_id: RGT0LqW + rv_id: 1262648 url: https://semgrep.dev/playground/r/RGT0LqW/csharp.lang.security.sqli.csharp-sqli.csharp-sqli - origin: community - languages: - - csharp + version_id: RGT0LqW + shortlink: https://sg.run/d2Xd + source: https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli + subcategory: + - audit + technology: + - csharp + vulnerability_class: + - SQL Injection + mode: taint + pattern-propagators: + - from: $X + pattern: (StringBuilder $B).$ANY(...,(string $X),...) + to: $B + pattern-sanitizers: + - by-side-effect: true + pattern-either: + - pattern: "$CMD.Parameters.Add(...)\n" + - pattern: "$CMD.Parameters.AddRange(...)\n" + - pattern: "$CMD.Parameters.AddWithValue(...)\n" + - pattern: "$CMD.Parameters[$IDX].Value = ...\n" + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: "new $PATTERN($CMD,...)\n" + - focus-metavariable: $CMD + - patterns: + - pattern: "$CMD.$PATTERN = $VALUE;\n" + - focus-metavariable: $VALUE + - metavariable-regex: + metavariable: $PATTERN + regex: ^(SqlCommand|CommandText|OleDbCommand|OdbcCommand|OracleCommand)$ + pattern-sources: + - patterns: + - pattern: "(string $X)\n" + - pattern-not: "\"...\"\n" severity: ERROR - id: csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure - patterns: - - pattern: $APP.UseDeveloperExceptionPage(...); - - pattern-not-inside: "if ($ENV.IsDevelopment(...)) {\n ...\n}\n" - - pattern-not-inside: "if ($ENV.EnvironmentName == \"Development\") {\n ...\n}\n" - message: Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace - information in a production environment aids an attacker in reconnaissance and information gathering. + languages: + - csharp + message: Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack + trace information in a production environment aids an attacker in reconnaissance and information gathering. metadata: category: security - technology: - - csharp + confidence: HIGH + cwe: + - 'CWE-209: Generation of Error Message Containing Sensitive Information' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A06:2017 - Security Misconfiguration - A04:2021 - Insecure Design - A06:2025 - Insecure Design - cwe: - - 'CWE-209: Generation of Error Message Containing Sensitive Information' references: - https://cwe.mitre.org/data/definitions/209.html - https://owasp.org/Top10/A04_2021-Insecure_Design/ - subcategory: - - audit - likelihood: LOW - impact: LOW - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure - shortlink: https://sg.run/XvkA semgrep.dev: rule: + origin: community r_id: 26720 - rv_id: 1262653 rule_id: lBU6Dv - version_id: 0bTKzrB + rv_id: 1262653 url: https://semgrep.dev/playground/r/0bTKzrB/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure - origin: community - languages: - - csharp + version_id: 0bTKzrB + shortlink: https://sg.run/XvkA + source: https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure + subcategory: + - audit + technology: + - csharp + vulnerability_class: + - Mishandled Sensitive Information + patterns: + - pattern: $APP.UseDeveloperExceptionPage(...); + - pattern-not-inside: "if ($ENV.IsDevelopment(...)) {\n ...\n}\n" + - pattern-not-inside: "if ($ENV.EnvironmentName == \"Development\") {\n ...\n}\n" severity: WARNING - id: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override - mode: taint - pattern-sources: - - patterns: - - focus-metavariable: $ARG - - pattern-inside: 'public $T $M(...,string $ARG,...){...} - - ' - pattern-sinks: - - patterns: - - pattern: '$XMLDOCUMENT.$METHOD(...) - - ' - - pattern-inside: "XmlDocument $XMLDOCUMENT = new XmlDocument(...);\n...\n$XMLDOCUMENT.XmlResolver = new XmlUrlResolver(...);\n\ - ... \n" - message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. - Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable - data. languages: - csharp - severity: WARNING + message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public + method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied + with user-controllable data. metadata: category: security - references: - - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ - - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks - technology: - - .net - - xml + confidence: MEDIUM cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - impact: MEDIUM - likelihood: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override - shortlink: https://sg.run/k98P + references: + - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ + - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks semgrep.dev: rule: + origin: community r_id: 18228 - rv_id: 1262654 rule_id: ReUK9k + rv_id: 1262654 + url: + https://semgrep.dev/playground/r/K3TKk5E/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override version_id: K3TKk5E - url: https://semgrep.dev/playground/r/K3TKk5E/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override - origin: community -- id: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override + shortlink: https://sg.run/k98P + source: + https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override + subcategory: + - vuln + technology: + - .net + - xml + vulnerability_class: + - XML Injection mode: taint + pattern-sinks: + - patterns: + - pattern: "$XMLDOCUMENT.$METHOD(...)\n" + - pattern-inside: "XmlDocument $XMLDOCUMENT = new XmlDocument(...);\n...\n$XMLDOCUMENT.XmlResolver = new XmlUrlResolver(...);\n\ + ... \n" pattern-sources: - patterns: - focus-metavariable: $ARG - - pattern-inside: 'public $T $M(...,string $ARG,...){...} - - ' - pattern-sinks: - - patterns: - - pattern: 'XmlReader $READER = XmlReader.Create(...,$RS,...); - - ' - - pattern-inside: "XmlReaderSettings $RS = new XmlReaderSettings();\n...\n$RS.DtdProcessing = DtdProcessing.Parse;\n...\ - \ \n" - message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. - Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable - data. + - pattern-inside: "public $T $M(...,string $ARG,...){...}\n" + severity: WARNING +- id: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override languages: - csharp - severity: WARNING + message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public + method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied + with user-controllable data. metadata: category: security - references: - - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ - - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks - technology: - - .net - - xml + confidence: MEDIUM cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - impact: MEDIUM - likelihood: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override - shortlink: https://sg.run/wXjA + references: + - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ + - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks semgrep.dev: rule: + origin: community r_id: 18229 - rv_id: 1262655 rule_id: AbU3pX + rv_id: 1262655 + url: + https://semgrep.dev/playground/r/qkTR7WD/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override version_id: qkTR7WD - url: https://semgrep.dev/playground/r/qkTR7WD/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override - origin: community -- id: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults + shortlink: https://sg.run/wXjA + source: + https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override + subcategory: + - vuln + technology: + - .net + - xml + vulnerability_class: + - XML Injection mode: taint + pattern-sinks: + - patterns: + - pattern: "XmlReader $READER = XmlReader.Create(...,$RS,...);\n" + - pattern-inside: "XmlReaderSettings $RS = new XmlReaderSettings();\n...\n$RS.DtdProcessing = DtdProcessing.Parse;\n...\ + \ \n" pattern-sources: - patterns: - focus-metavariable: $ARG - - pattern-inside: 'public $T $M(...,string $ARG,...){...} - - ' - pattern-sinks: - - patterns: - - pattern: '$READER.$METHOD(...) - - ' - - pattern-not-inside: '$READER.DtdProcessing = DtdProcessing.Prohibit; - - ... - - ' - - pattern-inside: 'XmlTextReader $READER = new XmlTextReader(...); - - ... - - ' - message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. - Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable - data. + - pattern-inside: "public $T $M(...,string $ARG,...){...}\n" + severity: WARNING +- id: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults languages: - csharp - severity: WARNING + message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public + method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied + with user-controllable data. metadata: category: security - references: - - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ - - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks - technology: - - .net - - xml + confidence: MEDIUM cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - impact: MEDIUM - likelihood: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults - shortlink: https://sg.run/xXjL + references: + - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ + - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks semgrep.dev: rule: + origin: community r_id: 18230 - rv_id: 1262656 rule_id: BYUevk + rv_id: 1262656 + url: + https://semgrep.dev/playground/r/l4TJRWG/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults version_id: l4TJRWG - url: https://semgrep.dev/playground/r/l4TJRWG/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults - origin: community -- id: dockerfile.security.last-user-is-root.last-user-is-root - patterns: - - pattern: USER root - - pattern-not-inside: - patterns: - - pattern: 'USER root - - ... - - USER $X - - ' - - metavariable-pattern: - metavariable: $X - patterns: - - pattern-not: root - message: The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the - container they will have root access. Switch back to another user after running commands as 'root'. - severity: ERROR + shortlink: https://sg.run/xXjL + source: https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults + subcategory: + - vuln + technology: + - .net + - xml + vulnerability_class: + - XML Injection + mode: taint + pattern-sinks: + - patterns: + - pattern: "$READER.$METHOD(...)\n" + - pattern-not-inside: "$READER.DtdProcessing = DtdProcessing.Prohibit;\n...\n" + - pattern-inside: "XmlTextReader $READER = new XmlTextReader(...);\n...\n" + pattern-sources: + - patterns: + - focus-metavariable: $ARG + - pattern-inside: "public $T $M(...,string $ARG,...){...}\n" + severity: WARNING +- id: dockerfile.security.last-user-is-root.last-user-is-root languages: - dockerfile + message: The last user in the container is 'root'. This is a security hazard because if an attacker gains control of + the container they will have root access. Switch back to another user after running commands as 'root'. metadata: - cwe: - - 'CWE-269: Improper Privilege Management' - source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3002 - references: - - https://github.com/hadolint/hadolint/wiki/DL3002 category: security - technology: - - dockerfile confidence: MEDIUM + cwe: + - 'CWE-269: Improper Privilege Management' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root - shortlink: https://sg.run/5Z43 + references: + - https://github.com/hadolint/hadolint/wiki/DL3002 semgrep.dev: rule: + origin: community r_id: 20147 - rv_id: 1262658 rule_id: ReU2n5 - version_id: 6xT29Eg + rv_id: 1262658 url: https://semgrep.dev/playground/r/6xT29Eg/dockerfile.security.last-user-is-root.last-user-is-root - origin: community -- id: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint - patterns: - - pattern: 'ENTRYPOINT $...VARS - - ' - - pattern-not-inside: 'USER $USER - - ... - - ' - fix: 'USER non-root - - ENTRYPOINT $...VARS - - ' - message: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker - can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile - is a USER other than 'root'. + version_id: 6xT29Eg + shortlink: https://sg.run/5Z43 + source: https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root + source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3002 + subcategory: + - audit + technology: + - dockerfile + vulnerability_class: + - Improper Authorization + patterns: + - pattern: USER root + - pattern-not-inside: + patterns: + - pattern: "USER root\n...\nUSER $X\n" + - metavariable-pattern: + metavariable: $X + patterns: + - pattern-not: root severity: ERROR +- fix: "USER non-root\nENTRYPOINT $...VARS\n" + id: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint languages: - dockerfile + message: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an + attacker can control a process running as root, they may have control over the container. Ensure that the last USER + in a Dockerfile is a USER other than 'root'. metadata: - cwe: - - 'CWE-269: Improper Privilege Management' category: security - technology: - - dockerfile confidence: MEDIUM + cwe: + - 'CWE-269: Improper Privilege Management' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design references: - https://owasp.org/Top10/A04_2021-Insecure_Design - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint - shortlink: https://sg.run/k281 semgrep.dev: rule: + origin: community r_id: 47272 - rv_id: 1262659 rule_id: ReUW9E + rv_id: 1262659 + url: + https://semgrep.dev/playground/r/o5TbD21/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint version_id: o5TbD21 - url: https://semgrep.dev/playground/r/o5TbD21/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint - origin: community -- id: dockerfile.security.missing-user.missing-user - patterns: - - pattern: 'CMD $...VARS - - ' - - pattern-not-inside: 'USER $USER - - ... - - ' - - pattern-not-inside: 'HEALTHCHECK ... CMD ... - - ' - fix: 'USER non-root - - CMD $...VARS - - ' - message: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker - can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile - is a USER other than 'root'. + shortlink: https://sg.run/k281 + source: https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint + subcategory: + - audit + technology: + - dockerfile + vulnerability_class: + - Improper Authorization + patterns: + - pattern: "ENTRYPOINT $...VARS\n" + - pattern-not-inside: "USER $USER\n...\n" severity: ERROR +- fix: "USER non-root\nCMD $...VARS\n" + id: dockerfile.security.missing-user.missing-user languages: - dockerfile + message: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an + attacker can control a process running as root, they may have control over the container. Ensure that the last USER + in a Dockerfile is a USER other than 'root'. metadata: - cwe: - - 'CWE-250: Execution with Unnecessary Privileges' category: security - technology: - - dockerfile confidence: MEDIUM + cwe: + - 'CWE-250: Execution with Unnecessary Privileges' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design references: - https://owasp.org/Top10/A04_2021-Insecure_Design - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/dockerfile.security.missing-user.missing-user - shortlink: https://sg.run/Gbvn semgrep.dev: rule: + origin: community r_id: 20148 - rv_id: 1262660 rule_id: AbUN06 - version_id: zyTb2n2 + rv_id: 1262660 url: https://semgrep.dev/playground/r/zyTb2n2/dockerfile.security.missing-user.missing-user - origin: community -- id: dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile + version_id: zyTb2n2 + shortlink: https://sg.run/Gbvn + source: https://semgrep.dev/r/dockerfile.security.missing-user.missing-user + subcategory: + - audit + technology: + - dockerfile + vulnerability_class: + - Improper Authorization patterns: - - pattern: 'RUN sudo ... - - ' - message: Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact of - configuration errors and security vulnerabilities. + - pattern: "CMD $...VARS\n" + - pattern-not-inside: "USER $USER\n...\n" + - pattern-not-inside: "HEALTHCHECK ... CMD ...\n" + severity: ERROR +- id: dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile + languages: + - dockerfile + message: Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact + of configuration errors and security vulnerabilities. metadata: category: security - technology: - - dockerfile + confidence: HIGH cwe: - 'CWE-250: Execution with Unnecessary Privileges' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://cwe.mitre.org/data/definitions/250.html - https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user - subcategory: - - audit - likelihood: LOW - impact: LOW - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile - shortlink: https://sg.run/80Q7 semgrep.dev: rule: + origin: community r_id: 66384 - rv_id: 1262661 rule_id: kxUlx1 - version_id: pZT03zY + rv_id: 1262661 url: https://semgrep.dev/playground/r/pZT03zY/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile - origin: community - languages: - - dockerfile + version_id: pZT03zY + shortlink: https://sg.run/80Q7 + source: https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile + subcategory: + - audit + technology: + - dockerfile + vulnerability_class: + - Improper Authorization + patterns: + - pattern: "RUN sudo ...\n" severity: WARNING - id: generic.ci.security.bash-reverse-shell.bash_reverse_shell + languages: + - generic + message: Semgrep found a bash reverse shell metadata: - cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' category: security - technology: - - ci confidence: HIGH + cwe: + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - subcategory: - - audit - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell - shortlink: https://sg.run/4l9l semgrep.dev: rule: + origin: community r_id: 16200 - rv_id: 1262664 rule_id: gxUJrJ - version_id: jQTn5QE + rv_id: 1262664 url: https://semgrep.dev/playground/r/jQTn5QE/generic.ci.security.bash-reverse-shell.bash_reverse_shell - origin: community - message: Semgrep found a bash reverse shell - severity: ERROR - languages: - - generic + version_id: jQTn5QE + shortlink: https://sg.run/4l9l + source: https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell + subcategory: + - audit + technology: + - ci + vulnerability_class: + - Code Injection pattern-either: - - pattern: 'sh -i >& /dev/udp/.../... 0>&1 - - ' - - pattern: '<...>/dev/tcp/.../...; sh <&... >&... 2>& - - ' - - pattern: '<...>/dev/tcp/.../...; cat <&... | while read line; do $line 2>&... >&...;done - - ' - - pattern: 'sh -i ...<...> /dev/tcp/.../... ...<&... 1>&... 2>& - - ' + - pattern: "sh -i >& /dev/udp/.../... 0>&1\n" + - pattern: "<...>/dev/tcp/.../...; sh <&... >&... 2>&\n" + - pattern: "<...>/dev/tcp/.../...; cat <&... | while read line; do $line 2>&... >&...;done\n" + - pattern: "sh -i ...<...> /dev/tcp/.../... ...<&... 1>&... 2>&\n" + severity: ERROR - id: generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host - paths: - include: - - '*.conf' - - '*.vhost' - - '**/sites-available/*' - - '**/sites-enabled/*' languages: - generic - severity: WARNING - message: The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an - attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving - them with 'map' or something similar. + message: The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by + an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and + retrieving them with 'map' or something similar. metadata: - source-rule-url: https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md - references: - - https://nginx.org/en/docs/http/ngx_http_map_module.html category: security - technology: - - nginx confidence: MEDIUM cwe: - - 'CWE-441: Unintended Proxy or Intermediary (''Confused Deputy'')' + - "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host - shortlink: https://sg.run/ndpb + references: + - https://nginx.org/en/docs/http/ngx_http_map_module.html semgrep.dev: rule: + origin: community r_id: 9036 - rv_id: 1262671 rule_id: GdU7yl - version_id: kbTzG2j + rv_id: 1262671 url: https://semgrep.dev/playground/r/kbTzG2j/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host - origin: community - pattern-either: - - pattern: proxy_pass $SCHEME://$$HOST ...; - - pattern: proxy_pass $$SCHEME://$$HOST ...; -- id: generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme + version_id: kbTzG2j + shortlink: https://sg.run/ndpb + source: https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host + source-rule-url: https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md + subcategory: + - audit + technology: + - nginx + vulnerability_class: + - Server-Side Request Forgery (SSRF) paths: include: - '*.conf' - '*.vhost' - '**/sites-available/*' - '**/sites-enabled/*' + pattern-either: + - pattern: proxy_pass $SCHEME://$$HOST ...; + - pattern: proxy_pass $$SCHEME://$$HOST ...; + severity: WARNING +- id: generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme languages: - generic - severity: WARNING - message: The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected - by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy. + message: The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be + injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this + proxy. metadata: - cwe: - - 'CWE-16: CWE CATEGORY: Configuration' - references: - - https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md category: security - technology: - - nginx confidence: MEDIUM + cwe: + - 'CWE-16: CWE CATEGORY: Configuration' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A06:2017 - Security Misconfiguration - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme - shortlink: https://sg.run/EkAo + references: + - https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md semgrep.dev: rule: + origin: community r_id: 9037 - rv_id: 1262672 rule_id: ReUg7n - version_id: w8TRoAJ + rv_id: 1262672 url: https://semgrep.dev/playground/r/w8TRoAJ/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme - origin: community - pattern: proxy_pass $$SCHEME:// ...; -- id: generic.nginx.security.header-injection.header-injection - pattern: "location ... <$VARIABLE> ... {\n ...\n add_header ... $$VARIABLE\n ...\n}\n" + version_id: w8TRoAJ + shortlink: https://sg.run/EkAo + source: https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme + subcategory: + - audit + technology: + - nginx + vulnerability_class: + - Other paths: include: - '*.conf' - '*.vhost' - '**/sites-available/*' - '**/sites-enabled/*' + pattern: proxy_pass $$SCHEME:// ...; + severity: WARNING +- id: generic.nginx.security.header-injection.header-injection languages: - generic - severity: ERROR - message: 'The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline + message: "The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the - path parameter: ''[^\s]+''.' + path parameter: '[^\\s]+'." metadata: - cwe: - - 'CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (''HTTP Request/Response Splitting'')' - references: - - https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md - - https://owasp.org/www-community/attacks/HTTP_Response_Splitting category: security - technology: - - nginx confidence: MEDIUM + cwe: + - "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2021 - Injection - A05:2025 - Injection - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection - shortlink: https://sg.run/7oj4 + references: + - https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md + - https://owasp.org/www-community/attacks/HTTP_Response_Splitting semgrep.dev: rule: + origin: community r_id: 9038 - rv_id: 1262673 rule_id: AbUz8p - version_id: xyTjzNW + rv_id: 1262673 url: https://semgrep.dev/playground/r/xyTjzNW/generic.nginx.security.header-injection.header-injection - origin: community -- id: generic.nginx.security.insecure-ssl-version.insecure-ssl-version - patterns: - - pattern-not: ssl_protocols TLSv1.2 TLSv1.3; - - pattern-not: ssl_protocols TLSv1.3 TLSv1.2; - - pattern-not: ssl_protocols TLSv1.2; - - pattern-not: ssl_protocols TLSv1.3; - - pattern: ssl_protocols ...; + version_id: xyTjzNW + shortlink: https://sg.run/7oj4 + source: https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection + subcategory: + - audit + technology: + - nginx + vulnerability_class: + - Improper Validation paths: include: - '*.conf' - '*.vhost' - '**/sites-available/*' - '**/sites-enabled/*' + pattern: "location ... <$VARIABLE> ... {\n ...\n add_header ... $$VARIABLE\n ...\n}\n" + severity: ERROR +- id: generic.nginx.security.insecure-ssl-version.insecure-ssl-version languages: - generic - severity: WARNING - message: Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to - be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later. + message: Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known + to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later. metadata: - cwe: - - 'CWE-326: Inadequate Encryption Strength' - references: - - https://www.acunetix.com/blog/web-security-zone/hardening-nginx/ - - https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/ category: security - technology: - - nginx confidence: HIGH + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version - shortlink: https://sg.run/gLKy + references: + - https://www.acunetix.com/blog/web-security-zone/hardening-nginx/ + - https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/ semgrep.dev: rule: + origin: community r_id: 9041 - rv_id: 1262676 rule_id: WAUo9k - version_id: vdT06O4 + rv_id: 1262676 url: https://semgrep.dev/playground/r/vdT06O4/generic.nginx.security.insecure-ssl-version.insecure-ssl-version - origin: community -- id: generic.nginx.security.missing-ssl-version.missing-ssl-version - patterns: - - pattern: server { ... listen $PORT ssl; ... } - - pattern-not-inside: server { ... ssl_protocols ... } + version_id: vdT06O4 + shortlink: https://sg.run/gLKy + source: https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version + subcategory: + - audit + technology: + - nginx + vulnerability_class: + - Cryptographic Issues paths: include: - '*.conf' - '*.vhost' - '**/sites-available/*' - '**/sites-enabled/*' + patterns: + - pattern-not: ssl_protocols TLSv1.2 TLSv1.3; + - pattern-not: ssl_protocols TLSv1.3 TLSv1.2; + - pattern-not: ssl_protocols TLSv1.2; + - pattern-not: ssl_protocols TLSv1.3; + - pattern: ssl_protocols ...; + severity: WARNING +- id: generic.nginx.security.missing-ssl-version.missing-ssl-version languages: - generic - severity: WARNING - message: This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols - TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 - TLSv1.3' to use secure TLS versions. + message: This server configuration is missing the 'ssl_protocols' directive. By default, this server will use + 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify + 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions. metadata: - cwe: - - 'CWE-326: Inadequate Encryption Strength' - references: - - https://www.acunetix.com/blog/web-security-zone/hardening-nginx/ - - https://nginx.org/en/docs/http/configuring_https_servers.html category: security - technology: - - nginx confidence: MEDIUM + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version - shortlink: https://sg.run/3xzl + references: + - https://www.acunetix.com/blog/web-security-zone/hardening-nginx/ + - https://nginx.org/en/docs/http/configuring_https_servers.html semgrep.dev: rule: + origin: community r_id: 9043 - rv_id: 1262678 rule_id: KxUbeA - version_id: ZRTKAle + rv_id: 1262678 url: https://semgrep.dev/playground/r/ZRTKAle/generic.nginx.security.missing-ssl-version.missing-ssl-version - origin: community -- id: generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling + version_id: ZRTKAle + shortlink: https://sg.run/3xzl + source: https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version + subcategory: + - audit + technology: + - nginx + vulnerability_class: + - Cryptographic Issues + paths: + include: + - '*.conf' + - '*.vhost' + - '**/sites-available/*' + - '**/sites-enabled/*' patterns: - - pattern-either: - - pattern: 'proxy_http_version 1.1 ...; - - ... - - proxy_set_header Upgrade ...; - - ... - - proxy_set_header Connection ...; - - ' - - pattern: 'proxy_set_header Upgrade ...; - - ... - - proxy_set_header Connection ...; - - ... - - proxy_http_version 1.1 ...; - - ' - - pattern: 'proxy_set_header Upgrade ...; - - ... - - proxy_http_version 1.1 ...; - - ... - - proxy_set_header Connection ...; - - ' - - pattern-inside: "location ... {\n ...\n}\n" + - pattern: server { ... listen $PORT ssl; ... } + - pattern-not-inside: server { ... ssl_protocols ... } + severity: WARNING +- id: generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling languages: - generic - severity: WARNING message: 'Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers.' - paths: - include: - - '*.conf' - - '*.vhost' - - '**/sites-available/*' - - '**/sites-enabled/*' metadata: - cwe: - - 'CWE-444: Inconsistent Interpretation of HTTP Requests (''HTTP Request/Response Smuggling'')' - references: - - https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c category: security - technology: - - nginx confidence: MEDIUM + cwe: + - "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling - shortlink: https://sg.run/ploZ + references: + - https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c semgrep.dev: rule: + origin: community r_id: 10562 - rv_id: 1262679 rule_id: 6JUq0Z + rv_id: 1262679 + url: + https://semgrep.dev/playground/r/nWT2Lyp/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling version_id: nWT2Lyp - url: https://semgrep.dev/playground/r/nWT2Lyp/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling - origin: community -- id: generic.nginx.security.request-host-used.request-host-used - pattern-either: - - pattern: $http_host - - pattern: $host + shortlink: https://sg.run/ploZ + source: https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling + subcategory: + - audit + technology: + - nginx + vulnerability_class: + - Improper Validation paths: include: - - '*conf*' - - '*nginx*' - - '*vhost*' + - '*.conf' + - '*.vhost' - '**/sites-available/*' - '**/sites-enabled/*' + patterns: + - pattern-either: + - pattern: "proxy_http_version 1.1 ...;\n...\nproxy_set_header Upgrade ...;\n...\nproxy_set_header Connection ...;\n" + - pattern: "proxy_set_header Upgrade ...;\n...\nproxy_set_header Connection ...;\n...\nproxy_http_version 1.1 ...;\n" + - pattern: "proxy_set_header Upgrade ...;\n...\nproxy_http_version 1.1 ...;\n...\nproxy_set_header Connection ...;\n" + - pattern-inside: "location ... {\n ...\n}\n" + severity: WARNING +- id: generic.nginx.security.request-host-used.request-host-used languages: - generic - severity: WARNING - message: '''$http_host'' and ''$host'' variables may contain a malicious value from attacker controlled ''Host'' request - header. Use an explicitly configured host value or a allow list for validation.' + message: "'$http_host' and '$host' variables may contain a malicious value from attacker controlled 'Host' request header. + Use an explicitly configured host value or a allow list for validation." metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-290: Authentication Bypass by Spoofing' - references: - - https://github.com/yandex/gixy/blob/master/docs/en/plugins/hostspoofing.md - - https://portswigger.net/web-security/host-header - category: security - technology: - - nginx - confidence: MEDIUM + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/generic.nginx.security.request-host-used.request-host-used - shortlink: https://sg.run/4x3Z + references: + - https://github.com/yandex/gixy/blob/master/docs/en/plugins/hostspoofing.md + - https://portswigger.net/web-security/host-header semgrep.dev: rule: + origin: community r_id: 9044 - rv_id: 1262680 rule_id: qNUjGg - version_id: ExTExrN + rv_id: 1262680 url: https://semgrep.dev/playground/r/ExTExrN/generic.nginx.security.request-host-used.request-host-used - origin: community + version_id: ExTExrN + shortlink: https://sg.run/4x3Z + source: https://semgrep.dev/r/generic.nginx.security.request-host-used.request-host-used + subcategory: + - audit + technology: + - nginx + vulnerability_class: + - Improper Authentication + paths: + include: + - '*conf*' + - '*nginx*' + - '*vhost*' + - '**/sites-available/*' + - '**/sites-enabled/*' + pattern-either: + - pattern: $http_host + - pattern: $host + severity: WARNING - id: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key - pattern-regex: rk_live_[0-9a-zA-Z]{24} languages: - regex message: Stripe Restricted API Key detected - severity: ERROR metadata: - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security - technology: - - secrets - - stripe confidence: MEDIUM + cwe: + - 'CWE-798: Use of Hard-coded Credentials' + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key - shortlink: https://sg.run/ZvdL semgrep.dev: rule: + origin: community r_id: 9079 - rv_id: 1262900 rule_id: 5rUOWq + rv_id: 1262900 + url: + https://semgrep.dev/playground/r/K3TKkKj/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key version_id: K3TKkKj - url: https://semgrep.dev/playground/r/K3TKkKj/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key - origin: community + shortlink: https://sg.run/ZvdL + source: + https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key + source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json + subcategory: + - audit + technology: + - secrets + - stripe + vulnerability_class: + - Hard-coded Secrets + pattern-regex: rk_live_[0-9a-zA-Z]{24} + severity: ERROR - id: generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri - patterns: - - pattern: $PROTOCOL://$...USERNAME:$...PASSWORD@$END - - metavariable-regex: - metavariable: $...USERNAME - regex: \A({?)([A-Za-z])([A-Za-z0-9_-]){5,31}(}?)\Z - - metavariable-regex: - metavariable: $...PASSWORD - regex: (?!.*[\s])(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~]){6,32} - - metavariable-regex: - metavariable: $PROTOCOL - regex: (.*http.*)|(.*sql.*)|(.*ftp.*)|(.*smtp.*) languages: - generic message: Username and password in URI detected - severity: ERROR metadata: - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security - technology: - - secrets confidence: MEDIUM - cwe2022-top25: true + cwe: + - 'CWE-798: Use of Hard-coded Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri - shortlink: https://sg.run/8yA4 + likelihood: MEDIUM + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go semgrep.dev: rule: + origin: community r_id: 9084 - rv_id: 1262903 rule_id: DbUple + rv_id: 1262903 + url: + https://semgrep.dev/playground/r/YDTZeZE/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri version_id: YDTZeZE - url: https://semgrep.dev/playground/r/YDTZeZE/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri - origin: community -- id: generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak + shortlink: https://sg.run/8yA4 + source: + https://semgrep.dev/r/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri + subcategory: + - vuln + technology: + - secrets + vulnerability_class: + - Hard-coded Secrets patterns: - - pattern-regex: ^(AIza[0-9A-Za-z_-]{35}(?!\S))$ - message: Detects potential Google Maps API keys in code + - pattern: $PROTOCOL://$...USERNAME:$...PASSWORD@$END + - metavariable-regex: + metavariable: $...USERNAME + regex: \A({?)([A-Za-z])([A-Za-z0-9_-]){5,31}(}?)\Z + - metavariable-regex: + metavariable: $...PASSWORD + regex: (?!.*[\s])(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~]){6,32} + - metavariable-regex: + metavariable: $PROTOCOL + regex: (.*http.*)|(.*sql.*)|(.*ftp.*)|(.*smtp.*) + severity: ERROR +- id: generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak languages: - generic - severity: WARNING + message: Detects potential Google Maps API keys in code metadata: - description: Detects potential Google Maps API keys in code - severity: MEDIUM category: security confidence: MEDIUM + cwe: + - 'CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory' + description: Detects potential Google Maps API keys in code impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license likelihood: MEDIUM - subcategory: - - audit owasp: - A3:2017 Sensitive Data Exposure references: - https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e - cwe: - - 'CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory' - technology: - - Google Maps - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak - shortlink: https://sg.run/DL5d semgrep.dev: rule: + origin: community r_id: 52196 - rv_id: 945530 rule_id: EwU3kN + rv_id: 945530 + url: + https://semgrep.dev/playground/r/NdTqkGz/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak version_id: NdTqkGz - url: https://semgrep.dev/playground/r/NdTqkGz/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak - origin: community + severity: MEDIUM + shortlink: https://sg.run/DL5d + source: https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak + subcategory: + - audit + technology: + - Google Maps + vulnerability_class: + - Mishandled Sensitive Information + patterns: + - pattern-regex: ^(AIza[0-9A-Za-z_-]{35}(?!\S))$ + severity: WARNING - id: generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs languages: - generic - severity: WARNING message: 'Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your - pattern-not: - paths: - include: - - '*.component' - - '*.page' + severity: ERROR - id: generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute languages: - generic - severity: INFO - message: Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 - or higher. + message: Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version + 55 or higher. metadata: + category: security + confidence: HIGH cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5 - category: security + semgrep.dev: + rule: + origin: community + r_id: 72424 + rule_id: DbUj7d + rv_id: 1262907 + url: + https://semgrep.dev/playground/r/RGT0L0r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute + version_id: RGT0L0r + shortlink: https://sg.run/yoj8 + source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute subcategory: - vuln technology: - salesforce - visualforce - cwe2022-top25: true - cwe2021-top25: true - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute - shortlink: https://sg.run/yoj8 - semgrep.dev: - rule: - r_id: 72424 - rv_id: 1262907 - rule_id: DbUj7d - version_id: RGT0L0r - url: https://semgrep.dev/playground/r/RGT0L0r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute - origin: community + paths: + include: + - '*.page' patterns: - pattern: ... - pattern-not: ... - pattern-not: ...... - pattern-not: ...... - paths: - include: - - '*.page' + severity: INFO - id: generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version languages: - generic - severity: WARNING message: Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true. metadata: + category: security + confidence: HIGH cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm - category: security + semgrep.dev: + rule: + origin: community + r_id: 72425 + rule_id: WAUwJW + rv_id: 1262908 + url: + https://semgrep.dev/playground/r/A8Tgdgn/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version + version_id: A8Tgdgn + shortlink: https://sg.run/rWr6 + source: + https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version subcategory: - vuln technology: - salesforce - visualforce - cwe2022-top25: true - cwe2021-top25: true - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version - shortlink: https://sg.run/rWr6 - semgrep.dev: - rule: - r_id: 72425 - rv_id: 1262908 - rule_id: WAUwJW - version_id: A8Tgdgn - url: https://semgrep.dev/playground/r/A8Tgdgn/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version - origin: community + paths: + include: + - '*.page-meta.xml' patterns: - pattern-inside: - pattern-either: - pattern-regex: '[>][0-9].[0-9][<]' - pattern-regex: '[>][1-4][0-9].[0-9][<]' - pattern-regex: '[>][5][0-4].[0-9][<]' - paths: - include: - - '*.page-meta.xml' + severity: WARNING - id: go.aws-lambda.security.database-sqli.database-sqli languages: - go - message: Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is - user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls. - mode: taint + message: Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable + is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or + prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls. metadata: - references: - - https://pkg.go.dev/database/sql#DB.Query category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://pkg.go.dev/database/sql#DB.Query + semgrep.dev: + rule: + origin: community + r_id: 18232 + rule_id: WAUdJ7 + rv_id: 1262909 + url: https://semgrep.dev/playground/r/BjTkZkQ/go.aws-lambda.security.database-sqli.database-sqli + version_id: BjTkZkQ + shortlink: https://sg.run/e5e8 + source: https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli + subcategory: + - vuln technology: - aws-lambda - database - sql - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection - source: https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli - shortlink: https://sg.run/e5e8 - semgrep.dev: - rule: - r_id: 18232 - rv_id: 1262909 - rule_id: WAUdJ7 - version_id: BjTkZkQ - url: https://semgrep.dev/playground/r/BjTkZkQ/go.aws-lambda.security.database-sqli.database-sqli - origin: community + mode: taint pattern-sinks: - patterns: - focus-metavariable: $QUERY @@ -2630,112 +2481,63 @@ rules: - pattern: $DB.QueryContext($QUERY,...) - pattern: $DB.QueryRow($QUERY,...) - pattern: $DB.QueryRowContext($QUERY,...) - - pattern-inside: 'import "database/sql" - - ... - - ' + - pattern-inside: "import \"database/sql\"\n...\n" pattern-sources: - patterns: - pattern-either: - - pattern-inside: 'func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...} - - ... - - lambda.Start($HANDLER, ...) - - ' + - pattern-inside: "func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...}\n...\nlambda.Start($HANDLER, ...)\n" - patterns: - - pattern-inside: 'func $HANDLER($EVENT $TYPE) {...} - - ... - - lambda.Start($HANDLER, ...) - - ' - - pattern-not-inside: 'func $HANDLER($EVENT context.Context) {...} - - ... - - lambda.Start($HANDLER, ...) - - ' + - pattern-inside: "func $HANDLER($EVENT $TYPE) {...}\n...\nlambda.Start($HANDLER, ...)\n" + - pattern-not-inside: "func $HANDLER($EVENT context.Context) {...}\n...\nlambda.Start($HANDLER, ...)\n" - focus-metavariable: $EVENT severity: WARNING - id: go.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - go - severity: ERROR - message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction - could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the - database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider - using an object-relational mapper (ORM) such as Sequelize which will protect your queries. + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual + construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify + contents of the database. Instead, use a parameterized query which is available by default in most database engines. + Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. metadata: - references: - - https://owasp.org/www-community/attacks/SQL_Injection category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/vX3Y + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/SQL_Injection semgrep.dev: rule: + origin: community r_id: 18233 - rv_id: 1262910 rule_id: 0oUwqg - version_id: DkTRbRL + rv_id: 1262910 url: https://semgrep.dev/playground/r/DkTRbRL/go.aws-lambda.security.tainted-sql-string.tainted-sql-string - origin: community + version_id: DkTRbRL + shortlink: https://sg.run/vX3Y + source: https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: 'func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...} - - ... - - lambda.Start($HANDLER, ...) - - ' - - patterns: - - pattern-inside: 'func $HANDLER($EVENT $TYPE) {...} - - ... - - lambda.Start($HANDLER, ...) - - ' - - pattern-not-inside: 'func $HANDLER($EVENT context.Context) {...} - - ... - - lambda.Start($HANDLER, ...) - - ' - - focus-metavariable: $EVENT + pattern-sanitizers: + - pattern: strconv.Atoi(...) pattern-sinks: - patterns: - pattern-either: - patterns: - - pattern: '"$SQLSTR" + ... - - ' + - pattern: "\"$SQLSTR\" + ...\n" - metavariable-regex: metavariable: $SQLSTR regex: (?i)(\s*select|\s*delete|\s*insert|\s*create|\s*update|\s*alter|\s*drop).* @@ -2747,252 +2549,208 @@ rules: - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* - - pattern-not-inside: 'log.$PRINT(...) - - ' - pattern-sanitizers: - - pattern: strconv.Atoi(...) -- id: go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly - patterns: - - pattern-not-inside: "&sessions.Options{\n ...,\n HttpOnly: true,\n ...,\n}\n" - - pattern: "&sessions.Options{\n ...,\n}\n" - message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the - browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by - setting 'HttpOnly' to 'true' in the Options struct. + - pattern-not-inside: "log.$PRINT(...)\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...}\n...\nlambda.Start($HANDLER, ...)\n" + - patterns: + - pattern-inside: "func $HANDLER($EVENT $TYPE) {...}\n...\nlambda.Start($HANDLER, ...)\n" + - pattern-not-inside: "func $HANDLER($EVENT context.Context) {...}\n...\nlambda.Start($HANDLER, ...)\n" + - focus-metavariable: $EVENT + severity: ERROR +- fix-regex: + regex: (HttpOnly\s*:\s+)false + replacement: \1true + id: go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly + languages: + - go + message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs + the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' + flag by setting 'HttpOnly' to 'true' in the Options struct. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69 - category: security - technology: - - gorilla - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly - shortlink: https://sg.run/4xJZ semgrep.dev: rule: + origin: community r_id: 9088 - rv_id: 1262911 rule_id: qNUj6g + rv_id: 1262911 + url: + https://semgrep.dev/playground/r/WrTqKqe/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly version_id: WrTqKqe - url: https://semgrep.dev/playground/r/WrTqKqe/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly - origin: community - fix-regex: - regex: (HttpOnly\s*:\s+)false - replacement: \1true + shortlink: https://sg.run/4xJZ + source: + https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly + subcategory: + - audit + technology: + - gorilla + vulnerability_class: + - Cookie Security + patterns: + - pattern-not-inside: "&sessions.Options{\n ...,\n HttpOnly: true,\n ...,\n}\n" + - pattern: "&sessions.Options{\n ...,\n}\n" severity: WARNING +- fix-regex: + regex: (Secure\s*:\s+)false + replacement: \1true + id: go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure languages: - go -- id: go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure - patterns: - - pattern-not-inside: "&sessions.Options{\n ...,\n Secure: true,\n ...,\n}\n" - - pattern: "&sessions.Options{\n ...,\n}\n" - message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client - from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' - in the Options struct. + message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the + client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' + to 'true' in the Options struct. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69 - category: security - technology: - - gorilla - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure - shortlink: https://sg.run/PJdE semgrep.dev: rule: + origin: community r_id: 9089 - rv_id: 1262912 rule_id: lBU9kw + rv_id: 1262912 + url: + https://semgrep.dev/playground/r/0bTKzKk/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure version_id: 0bTKzKk - url: https://semgrep.dev/playground/r/0bTKzKk/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure - origin: community - fix-regex: - regex: (Secure\s*:\s+)false - replacement: \1true + shortlink: https://sg.run/PJdE + source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure + subcategory: + - audit + technology: + - gorilla + vulnerability_class: + - Cookie Security + patterns: + - pattern-not-inside: "&sessions.Options{\n ...,\n Secure: true,\n ...,\n}\n" + - pattern: "&sessions.Options{\n ...,\n}\n" severity: WARNING +- fix-regex: + regex: (SameSite\s*:\s+)http.SameSiteNoneMode + replacement: \1http.SameSiteDefaultMode + id: go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone languages: - go -- id: go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone - patterns: - - pattern-inside: "&sessions.Options{\n ...,\n SameSite: http.SameSiteNoneMode,\n ...,\n}\n" - - pattern: "&sessions.Options{\n ...,\n}\n" - message: Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default - for enhanced security. + message: Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or + Default for enhanced security. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://pkg.go.dev/github.com/gorilla/sessions#Options - category: security - technology: - - gorilla - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone - shortlink: https://sg.run/x8Nwj semgrep.dev: rule: + origin: community r_id: 133074 - rv_id: 1262913 rule_id: YGUpGd4 + rv_id: 1262913 + url: + https://semgrep.dev/playground/r/K3TKkKB/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone version_id: K3TKkKB - url: https://semgrep.dev/playground/r/K3TKkKB/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone - origin: community - fix-regex: - regex: (SameSite\s*:\s+)http.SameSiteNoneMode - replacement: \1http.SameSiteDefaultMode + shortlink: https://sg.run/x8Nwj + source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone + subcategory: + - audit + technology: + - gorilla + vulnerability_class: + - Cookie Security + patterns: + - pattern-inside: "&sessions.Options{\n ...,\n SameSite: http.SameSiteNoneMode,\n ...,\n}\n" + - pattern: "&sessions.Options{\n ...,\n}\n" severity: WARNING +- id: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check languages: - go -- id: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check - patterns: - - pattern-inside: 'import ("github.com/gorilla/websocket") - - ... - - ' - - patterns: - - pattern-not-inside: '$UPGRADER = websocket.Upgrader{..., CheckOrigin: $FN ,...} - - ... - - ' - - pattern-not-inside: '$UPGRADER.CheckOrigin = $FN2 - - ... - - ' - - pattern: '$UPGRADER.Upgrade(...) - - ' message: 'The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per "gorilla/websocket" documentation: "A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery."' - languages: - - go - severity: WARNING metadata: category: security + confidence: MEDIUM cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://pkg.go.dev/github.com/gorilla/websocket#Upgrader - technology: - - gorilla - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site Request Forgery (CSRF) - source: https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check - shortlink: https://sg.run/xXpz semgrep.dev: rule: + origin: community r_id: 18430 - rv_id: 1262914 rule_id: ReUKdz + rv_id: 1262914 + url: + https://semgrep.dev/playground/r/qkTR7RP/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check version_id: qkTR7RP - url: https://semgrep.dev/playground/r/qkTR7RP/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check - origin: community -- id: go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage - message: Detected usage of dangerous method $METHOD which does not escape inputs (see link in references). If the argument - is user-controlled, this can lead to SQL injection. When using $METHOD function, do not trust user-submitted data and - only allow approved list of input (possibly, use an allowlist approach). + shortlink: https://sg.run/xXpz + source: + https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check + subcategory: + - audit + technology: + - gorilla + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + patterns: + - pattern-inside: "import (\"github.com/gorilla/websocket\")\n...\n" + - patterns: + - pattern-not-inside: "$UPGRADER = websocket.Upgrader{..., CheckOrigin: $FN ,...}\n...\n" + - pattern-not-inside: "$UPGRADER.CheckOrigin = $FN2\n...\n" + - pattern: "$UPGRADER.Upgrade(...)\n" severity: WARNING +- id: go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage languages: - go - mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - metavariable-regex: - metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ - pattern-sinks: - - patterns: - - pattern-inside: 'import ("gorm.io/gorm") - - ... - - ' - - patterns: - - pattern-inside: "func $VAL(..., $GORM *gorm.DB,... ) {\n ...\n}\n" - - pattern-either: - - pattern: '$GORM. ... .$METHOD($VALUE) - - ' - - pattern: '$DB := $GORM. ... .$ANYTHING(...) - - ... - - $DB. ... .$METHOD($VALUE) - - ' - - focus-metavariable: $VALUE - - metavariable-regex: - metavariable: $METHOD - regex: ^(Order|Exec|Raw|Group|Having|Distinct|Select|Pluck)$ - pattern-sanitizers: - - pattern-either: - - pattern: strconv.Atoi(...) - - pattern: '($X: bool) - - ' - options: - interfile: true + message: Detected usage of dangerous method $METHOD which does not escape inputs (see link in references). If the + argument is user-controlled, this can lead to SQL injection. When using $METHOD function, do not trust + user-submitted data and only allow approved list of input (possibly, use an allowlist approach). metadata: category: security - technology: - - gorm + confidence: HIGH cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -3000,112 +2758,137 @@ rules: references: - https://gorm.io/docs/security.html#SQL-injection-Methods - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage - shortlink: https://sg.run/R4qg semgrep.dev: rule: + origin: community r_id: 24693 - rv_id: 1262915 rule_id: AbU5o3 + rv_id: 1262915 + url: + https://semgrep.dev/playground/r/l4TJRJK/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage version_id: l4TJRJK - url: https://semgrep.dev/playground/r/l4TJRJK/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage - origin: community -- id: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection + shortlink: https://sg.run/R4qg + source: https://semgrep.dev/r/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage + subcategory: + - vuln + technology: + - gorm + vulnerability_class: + - SQL Injection + mode: taint + options: + interfile: true + pattern-sanitizers: + - pattern-either: + - pattern: strconv.Atoi(...) + - pattern: "($X: bool)\n" + pattern-sinks: + - patterns: + - pattern-inside: "import (\"gorm.io/gorm\")\n...\n" + - patterns: + - pattern-inside: "func $VAL(..., $GORM *gorm.DB,... ) {\n ...\n}\n" + - pattern-either: + - pattern: "$GORM. ... .$METHOD($VALUE)\n" + - pattern: "$DB := $GORM. ... .$ANYTHING(...)\n...\n$DB. ... .$METHOD($VALUE)\n" + - focus-metavariable: $VALUE + - metavariable-regex: + metavariable: $METHOD + regex: ^(Order|Exec|Raw|Group|Having|Distinct|Select|Pluck)$ + pattern-sources: + - patterns: + - pattern-either: + - pattern: "($REQUEST : http.Request).$ANYTHING\n" + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - metavariable-regex: + metavariable: $ANYTHING + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + severity: WARNING +- fix-regex: + regex: (.*)WithInsecure\(.*?\) + replacement: \1WithTransportCredentials(credentials.NewTLS()) + id: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection + languages: + - go + message: "Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to + a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish + a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create + credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS())'." metadata: - cwe: - - 'CWE-300: Channel Accessible by Non-Endpoint' - references: - - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption category: security - technology: - - grpc confidence: HIGH + cwe: + - 'CWE-300: Channel Accessible by Non-Endpoint' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection - shortlink: https://sg.run/J9yZ + references: + - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption semgrep.dev: rule: + origin: community r_id: 9090 - rv_id: 1262916 rule_id: PeUZ4X + rv_id: 1262916 + url: + https://semgrep.dev/playground/r/YDTZeZB/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection version_id: YDTZeZB - url: https://semgrep.dev/playground/r/YDTZeZB/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection - origin: community - message: 'Found an insecure gRPC connection using ''grpc.WithInsecure()''. This creates a connection without encryption - to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, - establish a secure connection with an SSL certificate using the ''grpc.WithTransportCredentials()'' function. You can - create a create credentials using a ''tls.Config{}'' struct with ''credentials.NewTLS()''. The final fix looks like this: - ''grpc.WithTransportCredentials(credentials.NewTLS())''.' - languages: - - go - severity: ERROR + shortlink: https://sg.run/J9yZ + source: https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection + subcategory: + - audit + technology: + - grpc + vulnerability_class: + - Other pattern: $GRPC.Dial($ADDR, ..., $GRPC.WithInsecure(...), ...) - fix-regex: - regex: (.*)WithInsecure\(.*?\) - replacement: \1WithTransportCredentials(credentials.NewTLS()) + severity: ERROR - id: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection + languages: + - go + message: Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a + connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could + compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC + connection. You can create credentials using 'credentials.NewServerTLSFromFile("cert.pem", "cert.key")'. metadata: - cwe: - - 'CWE-300: Channel Accessible by Non-Endpoint' - references: - - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption category: security - technology: - - grpc confidence: HIGH + cwe: + - 'CWE-300: Channel Accessible by Non-Endpoint' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection - shortlink: https://sg.run/5Q5l + references: + - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption semgrep.dev: rule: + origin: community r_id: 9091 - rv_id: 1262917 rule_id: JDUy0B + rv_id: 1262917 + url: + https://semgrep.dev/playground/r/6xT2923/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection version_id: 6xT2923 - url: https://semgrep.dev/playground/r/6xT2923/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection - origin: community - message: Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection - without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the - machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create - credentials using 'credentials.NewServerTLSFromFile("cert.pem", "cert.key")'. - languages: - - go - severity: ERROR + shortlink: https://sg.run/5Q5l + source: https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection + subcategory: + - audit + technology: + - grpc + vulnerability_class: + - Other mode: taint pattern-sinks: - - requires: OPTIONS and not CREDS - pattern: grpc.NewServer($OPT, ...) - - requires: EMPTY_CONSTRUCTOR - pattern: grpc.NewServer() + - pattern: grpc.NewServer($OPT, ...) + requires: OPTIONS and not CREDS + - pattern: grpc.NewServer() + requires: EMPTY_CONSTRUCTOR pattern-sources: - label: OPTIONS pattern: grpc.ServerOption{ ... } @@ -3113,1282 +2896,1034 @@ rules: pattern: grpc.Creds(...) - label: EMPTY_CONSTRUCTOR pattern: grpc.NewServer() + severity: ERROR - id: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified - message: Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're - doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the - signature is valid (because it has been checked previously in the stack) and you want to extract values from it. + languages: + - go + message: Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what + you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where + you know the signature is valid (because it has been checked previously in the stack) and you want to extract values + from it. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-345: Insufficient Verification of Data Authenticity' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - category: security - technology: - - jwt - confidence: MEDIUM references: - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified - shortlink: https://sg.run/Av66 semgrep.dev: rule: + origin: community r_id: 9094 - rv_id: 1262918 rule_id: ReUgJJ + rv_id: 1262918 + url: + https://semgrep.dev/playground/r/o5TbDbq/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified version_id: o5TbDbq - url: https://semgrep.dev/playground/r/o5TbDbq/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified - origin: community - languages: - - go - severity: WARNING + shortlink: https://sg.run/Av66 + source: https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - audit + technology: + - jwt + vulnerability_class: + - Improper Authentication patterns: - - pattern-inside: 'import "github.com/dgrijalva/jwt-go" - - ... - - ' - - pattern: '$JWT.ParseUnverified(...) - - ' + - pattern-inside: "import \"github.com/dgrijalva/jwt-go\"\n...\n" + - pattern: "$JWT.ParseUnverified(...)\n" + severity: WARNING - id: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm - message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has - already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do - not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + languages: + - go + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token + has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be + verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - category: security - technology: - - jwt - confidence: HIGH references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm - shortlink: https://sg.run/Gej1 semgrep.dev: rule: + origin: community r_id: 9092 - rv_id: 1262919 rule_id: 5rUOWQ - version_id: zyTb2bz + rv_id: 1262919 url: https://semgrep.dev/playground/r/zyTb2bz/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm - origin: community - languages: - - go - severity: ERROR + version_id: zyTb2bz + shortlink: https://sg.run/Gej1 + source: https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - audit + technology: + - jwt + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern-inside: 'import "github.com/golang-jwt/jwt" - - ... - - ' - - pattern-inside: 'import "github.com/dgrijalva/jwt-go" - - ... - - ' + - pattern-inside: "import \"github.com/golang-jwt/jwt\"\n...\n" + - pattern-inside: "import \"github.com/dgrijalva/jwt-go\"\n...\n" - pattern-either: - - pattern: 'jwt.SigningMethodNone - - ' + - pattern: "jwt.SigningMethodNone\n" - pattern: jwt.UnsafeAllowNoneSignatureType + severity: ERROR - id: go.jwt-go.security.jwt.hardcoded-jwt-key - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). - options: - interfile: true + languages: + - go + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures category: security - technology: - - jwt - - secrets confidence: MEDIUM - cwe2022-top25: true + cwe: + - 'CWE-798: Use of Hard-coded Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key - shortlink: https://sg.run/Rod2 + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9093 - rv_id: 1262920 rule_id: GdU7Ny - version_id: pZT0305 + rv_id: 1262920 url: https://semgrep.dev/playground/r/pZT0305/go.jwt-go.security.jwt.hardcoded-jwt-key - origin: community - severity: WARNING - languages: - - go + version_id: pZT0305 + shortlink: https://sg.run/Rod2 + source: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key + subcategory: + - vuln + technology: + - jwt + - secrets + vulnerability_class: + - Hard-coded Secrets mode: taint - pattern-sources: - - patterns: - - pattern-inside: '[]byte("$F") - - ' + options: + interfile: true pattern-sinks: - patterns: - pattern-either: - - pattern-inside: '$TOKEN.SignedString($F) - - ' + - pattern-inside: "$TOKEN.SignedString($F)\n" - focus-metavariable: $F + pattern-sources: + - patterns: + - pattern-inside: "[]byte(\"$F\")\n" + severity: WARNING - id: go.lang.security.audit.crypto.bad_imports.insecure-module-used - message: The package `net/http/cgi` is on the import blocklist. The package is vulnerable to httpoxy attacks (CVE-2015-5386). - It is recommended to use `net/http` or a web framework to build a web application instead. + languages: + - go + message: The package `net/http/cgi` is on the import blocklist. The package is vulnerable to httpoxy attacks + (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - source-rule-url: https://github.com/securego/gosec references: - https://godoc.org/golang.org/x/crypto/sha3 - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used - shortlink: https://sg.run/l2gj semgrep.dev: rule: + origin: community r_id: 9113 - rv_id: 1262921 rule_id: yyUnov - version_id: 2KTv2vJ + rv_id: 1262921 url: https://semgrep.dev/playground/r/2KTv2vJ/go.lang.security.audit.crypto.bad_imports.insecure-module-used - origin: community - languages: - - go - severity: WARNING + version_id: 2KTv2vJ + shortlink: https://sg.run/l2gj + source: https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used + source-rule-url: https://github.com/securego/gosec + subcategory: + - audit + technology: + - go + vulnerability_class: + - Cryptographic Issues pattern-either: - patterns: - - pattern-inside: 'import "net/http/cgi" - - ... - - ' - - pattern: 'cgi.$FUNC(...) - - ' + - pattern-inside: "import \"net/http/cgi\"\n...\n" + - pattern: "cgi.$FUNC(...)\n" + severity: WARNING - id: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key - message: Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' - package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn - more about the problem and how to fix it. + languages: + - go + message: Disabled host key verification detected. This allows man-in-the-middle attacks. Use the + 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See + https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to + fix it. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-322: Key Exchange without Entity Authentication' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/securego/gosec references: - https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ - https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key - shortlink: https://sg.run/Yv6X semgrep.dev: rule: + origin: community r_id: 9114 - rv_id: 1262922 rule_id: r6UrW9 + rv_id: 1262922 + url: + https://semgrep.dev/playground/r/X0TzyzN/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key version_id: X0TzyzN - url: https://semgrep.dev/playground/r/X0TzyzN/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key - origin: community + shortlink: https://sg.run/Yv6X + source: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key + source-rule-url: https://github.com/securego/gosec + subcategory: + - audit + technology: + - go + vulnerability_class: + - Improper Authentication + pattern: ssh.InsecureIgnoreHostKey() + severity: WARNING +- fix: "crypto/rand\n" + id: go.lang.security.audit.crypto.math_random.math-random-used languages: - go - severity: WARNING - pattern: ssh.InsecureIgnoreHostKey() -- id: go.lang.security.audit.crypto.math_random.math-random-used + message: Do not use `math/rand`. Use `crypto/rand` instead. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used - shortlink: https://sg.run/6nK6 semgrep.dev: rule: + origin: community r_id: 9115 - rv_id: 1262923 rule_id: bwUwy8 - version_id: jQTn5nj + rv_id: 1262923 url: https://semgrep.dev/playground/r/jQTn5nj/go.lang.security.audit.crypto.math_random.math-random-used - origin: community - message: Do not use `math/rand`. Use `crypto/rand` instead. - languages: - - go - severity: WARNING + version_id: jQTn5nj + shortlink: https://sg.run/6nK6 + source: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern: 'import $RAND "$MATH" - - ' - - pattern: 'import "$MATH" - - ' + - pattern: "import $RAND \"$MATH\"\n" + - pattern: "import \"$MATH\"\n" - metavariable-regex: metavariable: $MATH regex: ^(math/rand(\/v[0-9]+)*)$ - pattern-either: - - pattern-inside: '... - - rand.$FUNC(...) - - ' - - pattern-inside: '... - - $RAND.$FUNC(...) - - ' + - pattern-inside: "...\nrand.$FUNC(...)\n" + - pattern-inside: "...\n$RAND.$FUNC(...)\n" - focus-metavariable: - $MATH - fix: 'crypto/rand - - ' -- id: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion - message: '`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as + severity: WARNING +- fix: "tls.Config{ $...CONF, MinVersion: tls.VersionTLS13 }\n" + id: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + languages: + - go + message: "`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer - 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13'' to the TLS configuration - to bump the minimum version to TLS 1.3.' + 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration + to bump the minimum version to TLS 1.3." metadata: + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go references: - https://go.dev/doc/go1.22#minor_library_changes - https://pkg.go.dev/crypto/tls#:~:text=MinVersion - https://www.us-cert.gov/ncas/alerts/TA14-290A - category: security - technology: - - go - confidence: HIGH - subcategory: - - audit - likelihood: MEDIUM - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion - shortlink: https://sg.run/oxEN semgrep.dev: rule: + origin: community r_id: 9116 - rv_id: 1262924 rule_id: NbUk4X + rv_id: 1262924 + url: + https://semgrep.dev/playground/r/1QTypyp/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion version_id: 1QTypyp - url: https://semgrep.dev/playground/r/1QTypyp/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion - origin: community - languages: - - go - severity: WARNING + shortlink: https://sg.run/oxEN + source: https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go + subcategory: + - audit + technology: + - go + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: 'tls.Config{ $...CONF } - - ' - - pattern-not: 'tls.Config{..., MinVersion: ..., ...} - - ' - fix: 'tls.Config{ $...CONF, MinVersion: tls.VersionTLS13 } - - ' + - pattern: "tls.Config{ $...CONF }\n" + - pattern-not: "tls.Config{..., MinVersion: ..., ...}\n" + severity: WARNING - id: go.lang.security.audit.crypto.sha224-hash.sha224-hash - pattern-either: - - patterns: - - pattern-inside: 'import "crypto/sha256" - - ... - - ' - - pattern-either: - - pattern: 'sha256.New224() - - ' - - pattern: 'sha256.Sum224(...) - - ' - - patterns: - - pattern-inside: 'import "golang.org/x/crypto/sha3" - - ... - - ' - - pattern-either: - - pattern: 'sha3.New224() - - ' - - pattern: 'sha3.Sum224(...) - - ' - message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating - to a stronger hash function such as SHA-384 or higher to ensure compliance and security. languages: - go - severity: WARNING + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider + updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security. metadata: + category: security + confidence: HIGH + cwe: + - 'CWE-328: Use of Weak Hash' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-328: Use of Weak Hash' - category: security - technology: - - go references: - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/go.lang.security.audit.crypto.sha224-hash.sha224-hash - shortlink: https://sg.run/ReJwY semgrep.dev: rule: + origin: community r_id: 151749 - rv_id: 1262925 rule_id: GdUvElR - version_id: 9lT4b4w + rv_id: 1262925 url: https://semgrep.dev/playground/r/9lT4b4w/go.lang.security.audit.crypto.sha224-hash.sha224-hash - origin: community -- id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure - message: SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use - 'tls.VersionTLS13'. + version_id: 9lT4b4w + shortlink: https://sg.run/ReJwY + source: https://semgrep.dev/r/go.lang.security.audit.crypto.sha224-hash.sha224-hash + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Insecure Hashing Algorithm + pattern-either: + - patterns: + - pattern-inside: "import \"crypto/sha256\"\n...\n" + - pattern-either: + - pattern: "sha256.New224()\n" + - pattern: "sha256.Sum224(...)\n" + - patterns: + - pattern-inside: "import \"golang.org/x/crypto/sha3\"\n...\n" + - pattern-either: + - pattern: "sha3.New224()\n" + - pattern: "sha3.Sum224(...)\n" + severity: WARNING +- fix-regex: + regex: VersionSSL30 + replacement: VersionTLS13 + id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + languages: + - go + message: SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, + use 'tls.VersionTLS13'. metadata: + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go references: - https://golang.org/doc/go1.14#crypto/tls - https://www.us-cert.gov/ncas/alerts/TA14-290A - category: security - technology: - - go - confidence: HIGH - subcategory: - - vuln - likelihood: MEDIUM - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure - shortlink: https://sg.run/zvE1 semgrep.dev: rule: + origin: community r_id: 9117 - rv_id: 1262926 rule_id: kxUkJ2 - version_id: yeTxpxj + rv_id: 1262926 url: https://semgrep.dev/playground/r/yeTxpxj/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure - origin: community - languages: - - go - severity: WARNING - fix-regex: - regex: VersionSSL30 - replacement: VersionTLS13 + version_id: yeTxpxj + shortlink: https://sg.run/zvE1 + source: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cryptographic Issues pattern: 'tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}' + severity: WARNING - id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher - message: Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' - to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other - cipher suites to use. + languages: + - go + message: Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function + 'tls.CipherSuites()' to get a list of good cipher suites. See + https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use. metadata: + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go references: - https://golang.org/pkg/crypto/tls/#InsecureCipherSuites - category: security - technology: - - go - confidence: HIGH - subcategory: - - vuln - likelihood: HIGH - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher - shortlink: https://sg.run/px8N semgrep.dev: rule: + origin: community r_id: 9118 - rv_id: 1262927 rule_id: wdUJYk - version_id: rxTAKAZ + rv_id: 1262927 url: https://semgrep.dev/playground/r/rxTAKAZ/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher - origin: community - languages: - - go - severity: WARNING + version_id: rxTAKAZ + shortlink: https://sg.run/px8N + source: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher + source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cryptographic Issues pattern-either: - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}} - - ' - - pattern: 'tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}} - - ' - - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...} - - ' - - pattern: 'tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...} - - ' + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}}\n" + - pattern: "tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}}\n" + - pattern: "tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}\n" + - pattern: "tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}\n" + severity: WARNING - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES - message: Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use - AES instead. languages: - go - severity: WARNING + message: Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. + Use AES instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - source-rule-url: https://github.com/securego/gosec#available-rules - category: security - technology: - - go references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES - shortlink: https://sg.run/jREA semgrep.dev: rule: + origin: community r_id: 9121 - rv_id: 1262930 rule_id: eqU8B3 - version_id: kbTzGzA + rv_id: 1262930 url: https://semgrep.dev/playground/r/kbTzGzA/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES - origin: community + version_id: kbTzGzA + shortlink: https://sg.run/jREA + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES + source-rule-url: https://github.com/securego/gosec#available-rules + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: 'import "crypto/des" - - ... - - ' + - pattern-inside: "import \"crypto/des\"\n...\n" - pattern-either: - - pattern: 'des.NewTripleDESCipher(...) - - ' - - pattern: 'des.NewCipher(...) - - ' + - pattern: "des.NewTripleDESCipher(...)\n" + - pattern: "des.NewCipher(...)\n" + severity: WARNING - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 - message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use SHA256 or SHA3 instead. languages: - go - severity: WARNING + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-328: Use of Weak Hash' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-328: Use of Weak Hash' - source-rule-url: https://github.com/securego/gosec#available-rules - category: security - technology: - - go - confidence: MEDIUM references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 - shortlink: https://sg.run/2xB5 semgrep.dev: rule: + origin: community r_id: 9119 - rv_id: 1262928 rule_id: x8Un6q - version_id: bZT535Y + rv_id: 1262928 url: https://semgrep.dev/playground/r/bZT535Y/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 - origin: community + version_id: bZT535Y + shortlink: https://sg.run/2xB5 + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 + source-rule-url: https://github.com/securego/gosec#available-rules + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Insecure Hashing Algorithm patterns: - - pattern-inside: 'import "crypto/md5" - - ... - - ' + - pattern-inside: "import \"crypto/md5\"\n...\n" - pattern-either: - - pattern: 'md5.New() - - ' - - pattern: 'md5.Sum(...) - - ' + - pattern: "md5.New()\n" + - pattern: "md5.Sum(...)\n" + severity: WARNING - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 - message: Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead. languages: - go - severity: WARNING + message: Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES + instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - source-rule-url: https://github.com/securego/gosec#available-rules - category: security - technology: - - go references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 - shortlink: https://sg.run/1ZAD semgrep.dev: rule: + origin: community r_id: 9122 - rv_id: 1262931 rule_id: v8Unl0 - version_id: w8TRoRQ + rv_id: 1262931 url: https://semgrep.dev/playground/r/w8TRoRQ/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 - origin: community + version_id: w8TRoRQ + shortlink: https://sg.run/1ZAD + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 + source-rule-url: https://github.com/securego/gosec#available-rules + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: 'import "crypto/rc4" - - ... - - ' + - pattern-inside: "import \"crypto/rc4\"\n...\n" - pattern: rc4.NewCipher(...) + severity: WARNING - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 - message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not - suitable as a cryptographic signature. Use SHA256 or SHA3 instead. languages: - go - severity: WARNING + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore + not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-328: Use of Weak Hash' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-328: Use of Weak Hash' - source-rule-url: https://github.com/securego/gosec#available-rules - category: security - technology: - - go references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 - shortlink: https://sg.run/XBYA semgrep.dev: rule: + origin: community r_id: 9120 - rv_id: 1262929 rule_id: OrU31O - version_id: NdTzyz1 + rv_id: 1262929 url: https://semgrep.dev/playground/r/NdTzyz1/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 - origin: community + version_id: NdTzyz1 + shortlink: https://sg.run/XBYA + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 + source-rule-url: https://github.com/securego/gosec#available-rules + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Insecure Hashing Algorithm patterns: - - pattern-inside: 'import "crypto/sha1" - - ... - - ' + - pattern-inside: "import \"crypto/sha1\"\n...\n" - pattern-either: - - pattern: 'sha1.New() - - ' - - pattern: 'sha1.Sum(...) - - ' -- id: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key - message: RSA keys should be at least 2048 bits + - pattern: "sha1.New()\n" + - pattern: "sha1.Sum(...)\n" + severity: WARNING +- fix: "2048\n" + id: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key languages: - go - severity: WARNING + message: RSA keys should be at least 2048 bits metadata: + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/securego/gosec/blob/master/rules/rsa.go references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms - category: security - technology: - - go - confidence: HIGH - subcategory: - - audit - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key - shortlink: https://sg.run/9oY4 semgrep.dev: rule: + origin: community r_id: 9123 - rv_id: 1262932 rule_id: d8UjY3 + rv_id: 1262932 + url: + https://semgrep.dev/playground/r/xyTjz8L/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key version_id: xyTjz8L - url: https://semgrep.dev/playground/r/xyTjz8L/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key - origin: community + shortlink: https://sg.run/9oY4 + source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key + source-rule-url: https://github.com/securego/gosec/blob/master/rules/rsa.go + subcategory: + - audit + technology: + - go + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern: 'rsa.GenerateKey(..., $BITS) - - ' - - pattern: 'rsa.GenerateMultiPrimeKey(..., $BITS) - - ' + - pattern: "rsa.GenerateKey(..., $BITS)\n" + - pattern: "rsa.GenerateMultiPrimeKey(..., $BITS)\n" - metavariable-comparison: - metavariable: $BITS comparison: $BITS < 2048 + metavariable: $BITS - focus-metavariable: - $BITS - fix: '2048 - - ' + severity: WARNING - id: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd - patterns: - - pattern-either: - - patterns: - - pattern: 'exec.Cmd {...,Path: $CMD,...} - - ' - - pattern-not: 'exec.Cmd {...,Path: "...",...} - - ' - - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); - - ... - - ' - - pattern-not-inside: '$CMD = "..."; - - ... - - ' - - patterns: - - pattern: 'exec.Cmd {...,Args: $ARGS,...} - - ' - - pattern-not: 'exec.Cmd {...,Args: []string{...},...} - - ' - - pattern-not-inside: '$ARGS = []string{"...",...}; - - ... - - ' - - pattern-not-inside: '$CMD = "..."; - - ... - - $ARGS = []string{$CMD,...}; - - ... - - ' - - pattern-not-inside: '$CMD = exec.LookPath("..."); - - ... - - $ARGS = []string{$CMD,...}; - - ... - - ' - - patterns: - - pattern: 'exec.Cmd {...,Args: []string{$CMD,...},...} - - ' - - pattern-not: 'exec.Cmd {...,Args: []string{"...",...},...} - - ' - - pattern-not-inside: '$CMD,$ERR := exec.LookPath("..."); - - ... - - ' - - pattern-not-inside: '$CMD = "..."; - - ... - - ' - - patterns: - - pattern-either: - - pattern: 'exec.Cmd {...,Args: []string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...},...} - - ' - - patterns: - - pattern: 'exec.Cmd {...,Args: []string{$CMD,"-c",$EXE,...},...} - - ' - - pattern-inside: '$CMD,$ERR := exec.LookPath("=~/(sh|bash|ksh|csh|tcsh|zsh)/"); - - ... - - ' - - pattern-not: 'exec.Cmd {...,Args: []string{"...","...","...",...},...} - - ' - - pattern-not-inside: '$EXE = "..."; - - ... - - ' - - pattern-inside: 'import "os/exec" - - ... - - ' - message: Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this - call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary - code. - metadata: - cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' - owasp: - - A03:2021 - Injection - - A05:2025 - Injection + languages: + - go + message: Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach + this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute + arbitrary code. + metadata: category: security - technology: - - go confidence: MEDIUM - references: - - https://owasp.org/Top10/A03_2021-Injection + cwe: + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" cwe2022-top25: true - subcategory: - - audit - likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd - shortlink: https://sg.run/Dorj + likelihood: LOW + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection semgrep.dev: rule: + origin: community r_id: 9108 - rv_id: 1262934 rule_id: 2ZUb8l - version_id: e1Tyjeg + rv_id: 1262934 url: https://semgrep.dev/playground/r/e1Tyjeg/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd - origin: community + version_id: e1Tyjeg + shortlink: https://sg.run/Dorj + source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd + subcategory: + - audit + technology: + - go + vulnerability_class: + - Code Injection + patterns: + - pattern-either: + - patterns: + - pattern: "exec.Cmd {...,Path: $CMD,...}\n" + - pattern-not: "exec.Cmd {...,Path: \"...\",...}\n" + - pattern-not-inside: "$CMD,$ERR := exec.LookPath(\"...\");\n...\n" + - pattern-not-inside: "$CMD = \"...\";\n...\n" + - patterns: + - pattern: "exec.Cmd {...,Args: $ARGS,...}\n" + - pattern-not: "exec.Cmd {...,Args: []string{...},...}\n" + - pattern-not-inside: "$ARGS = []string{\"...\",...};\n...\n" + - pattern-not-inside: "$CMD = \"...\";\n...\n$ARGS = []string{$CMD,...};\n...\n" + - pattern-not-inside: "$CMD = exec.LookPath(\"...\");\n...\n$ARGS = []string{$CMD,...};\n...\n" + - patterns: + - pattern: "exec.Cmd {...,Args: []string{$CMD,...},...}\n" + - pattern-not: "exec.Cmd {...,Args: []string{\"...\",...},...}\n" + - pattern-not-inside: "$CMD,$ERR := exec.LookPath(\"...\");\n...\n" + - pattern-not-inside: "$CMD = \"...\";\n...\n" + - patterns: + - pattern-either: + - pattern: "exec.Cmd {...,Args: []string{\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\",$EXE,...},...}\n" + - patterns: + - pattern: "exec.Cmd {...,Args: []string{$CMD,\"-c\",$EXE,...},...}\n" + - pattern-inside: "$CMD,$ERR := exec.LookPath(\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\");\n...\n" + - pattern-not: "exec.Cmd {...,Args: []string{\"...\",\"...\",\"...\",...},...}\n" + - pattern-not-inside: "$EXE = \"...\";\n...\n" + - pattern-inside: "import \"os/exec\"\n...\n" severity: ERROR - languages: - - go - id: go.lang.security.audit.md5-used-as-password.md5-used-as-password languages: - go - severity: WARNING - message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked - by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` - package. - options: - interfile: true + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be + cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can + use the `golang.org/x/crypto/bcrypt` package. metadata: category: security - technology: - - md5 - references: - - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html - - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords - - https://github.com/returntocorp/semgrep-rules/issues/1609 - - https://pkg.go.dev/golang.org/x/crypto/bcrypt - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM impact: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password - shortlink: https://sg.run/4eOE + likelihood: MEDIUM + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html + - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords + - https://github.com/returntocorp/semgrep-rules/issues/1609 + - https://pkg.go.dev/golang.org/x/crypto/bcrypt semgrep.dev: rule: + origin: community r_id: 14688 - rv_id: 1262938 rule_id: 4bU1Wj - version_id: nWT2L9r + rv_id: 1262938 url: https://semgrep.dev/playground/r/nWT2L9r/go.lang.security.audit.md5-used-as-password.md5-used-as-password - origin: community + version_id: nWT2L9r + shortlink: https://sg.run/4eOE + source: https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password + subcategory: + - vuln + technology: + - md5 + vulnerability_class: + - Cryptographic Issues mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: md5.New - - pattern: md5.Sum + options: + interfile: true pattern-sinks: - patterns: - pattern: $FUNCTION(...) - metavariable-regex: metavariable: $FUNCTION regex: (?i)(.*password.*) + pattern-sources: + - patterns: + - pattern-either: + - pattern: md5.New + - pattern: md5.Sum + severity: WARNING - id: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces - message: Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server - publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty - string. languages: - go - severity: WARNING + message: Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the + server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor + the empty string. metadata: + category: security + confidence: HIGH cwe: - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - source-rule-url: https://github.com/securego/gosec - category: security - technology: - - go - confidence: HIGH references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces - shortlink: https://sg.run/rdE0 semgrep.dev: rule: + origin: community r_id: 9125 - rv_id: 1262939 rule_id: nJUz3J - version_id: ExTExoK + rv_id: 1262939 url: https://semgrep.dev/playground/r/ExTExoK/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces - origin: community - pattern-either: - - pattern: tls.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) - - pattern: net.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) - - pattern: tls.Listen($NETWORK, "=~/^:.*$/", ...) - - pattern: net.Listen($NETWORK, "=~/^:.*$/", ...) -- id: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly - patterns: - - pattern-not-inside: "http.Cookie{\n ...,\n HttpOnly: true,\n ...,\n}\n" - - pattern: "http.Cookie{\n ...,\n}\n" - message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the - browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by - setting 'HttpOnly' to 'true' in the Cookie. + version_id: ExTExoK + shortlink: https://sg.run/rdE0 + source: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces + source-rule-url: https://github.com/securego/gosec + subcategory: + - audit + technology: + - go + vulnerability_class: + - Mishandled Sensitive Information + pattern-either: + - pattern: tls.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) + - pattern: net.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) + - pattern: tls.Listen($NETWORK, "=~/^:.*$/", ...) + - pattern: net.Listen($NETWORK, "=~/^:.*$/", ...) + severity: WARNING +- fix-regex: + regex: (HttpOnly\s*:\s+)false + replacement: \1true + id: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + languages: + - go + message: A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs + the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' + flag by setting 'HttpOnly' to 'true' in the Cookie. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go - https://golang.org/src/net/http/cookie.go - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - vuln - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly - shortlink: https://sg.run/b73e semgrep.dev: rule: + origin: community r_id: 9126 - rv_id: 1262940 rule_id: EwU2Z6 + rv_id: 1262940 + url: + https://semgrep.dev/playground/r/7ZTE3BW/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly version_id: 7ZTE3BW - url: https://semgrep.dev/playground/r/7ZTE3BW/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly - origin: community - fix-regex: - regex: (HttpOnly\s*:\s+)false - replacement: \1true + shortlink: https://sg.run/b73e + source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cookie Security + patterns: + - pattern-not-inside: "http.Cookie{\n ...,\n HttpOnly: true,\n ...,\n}\n" + - pattern: "http.Cookie{\n ...,\n}\n" severity: WARNING +- fix-regex: + regex: (Secure\s*:\s+)false + replacement: \1true + id: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure languages: - go -- id: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure - patterns: - - pattern-not-inside: "http.Cookie{\n ...,\n Secure: true,\n ...,\n}\n" - - pattern: "http.Cookie{\n ...,\n}\n" - message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client - from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' - in the Options struct. + message: A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the + client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' + to 'true' in the Options struct. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go - https://golang.org/src/net/http/cookie.go - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - vuln - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure - shortlink: https://sg.run/N4G7 semgrep.dev: rule: + origin: community r_id: 9127 - rv_id: 1262941 rule_id: 7KUQ8X + rv_id: 1262941 + url: + https://semgrep.dev/playground/r/LjTkgGE/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure version_id: LjTkgGE - url: https://semgrep.dev/playground/r/LjTkgGE/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure - origin: community - fix-regex: - regex: (Secure\s*:\s+)false - replacement: \1true + shortlink: https://sg.run/N4G7 + source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cookie Security + patterns: + - pattern-not-inside: "http.Cookie{\n ...,\n Secure: true,\n ...,\n}\n" + - pattern: "http.Cookie{\n ...,\n}\n" severity: WARNING +- id: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace languages: - go -- id: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace - message: Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for - '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events - occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined. + message: Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition + for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request + events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically + defined. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-913: Improper Control of Dynamically-Managed Code Resources' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://github.com/returntocorp/semgrep-rules/issues/518 - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - vuln - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace - shortlink: https://sg.run/kXEK semgrep.dev: rule: + origin: community r_id: 9128 - rv_id: 1262942 rule_id: L1Uyjp + rv_id: 1262942 + url: + https://semgrep.dev/playground/r/8KT5rNv/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace version_id: 8KT5rNv - url: https://semgrep.dev/playground/r/8KT5rNv/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace - origin: community - patterns: - - pattern-not-inside: 'package $PACKAGE - - ... - - &httptrace.ClientTrace { ... } - - ... - - ' + shortlink: https://sg.run/kXEK + source: https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Code Injection + patterns: + - pattern-not-inside: "package $PACKAGE\n...\n&httptrace.ClientTrace { ... }\n...\n" - pattern: httptrace.WithClientTrace($ANY, $TRACE) severity: WARNING +- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string languages: - go -- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string - message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely - sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. + message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be + absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may + have a XSS vulnerability. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://golang.org/pkg/html/template/#HTML - category: security - technology: - - go - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string - shortlink: https://sg.run/weE0 semgrep.dev: rule: + origin: community r_id: 9129 - rv_id: 1262943 rule_id: 8GUjDW + rv_id: 1262943 + url: + https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string version_id: gETB7Pe - url: https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string - origin: community - languages: - - go - severity: WARNING + shortlink: https://sg.run/weE0 + source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string + subcategory: + - audit + technology: + - go + vulnerability_class: + - Cross-Site-Scripting (XSS) patterns: - pattern-not: template.HTML("..." + "...") - pattern-either: - pattern: template.HTML($T + $X, ...) - pattern: template.HTML(fmt.$P("...", ...), ...) - - pattern: '$T = "..." - - ... - - $T = $FXN(..., $T, ...) - - ... - - template.HTML($T, ...) - - ' - - pattern: '$T = fmt.$P("...", ...) - - ... - - template.HTML($T, ...) - - ' - - pattern: '$T, $ERR = fmt.$P("...", ...) - - ... - - template.HTML($T, ...) - - ' - - pattern: '$T = $X + $Y - - ... - - template.HTML($T, ...) - - ' - - pattern: '$T = "..." - - ... - - $OTHER, $ERR = fmt.$P(..., $T, ...) - - ... - - template.HTML($OTHER, ...)' -- id: go.lang.security.audit.net.fs-directory-listing.fs-directory-listing - message: 'Detected usage of ''http.FileServer'' as handler: this allows directory listing and an attacker could navigate - through directories looking for sensitive files. Be sure to disable directory listing or restrict access to specific directories/files.' + - pattern: "$T = \"...\"\n...\n$T = $FXN(..., $T, ...)\n...\ntemplate.HTML($T, ...)\n" + - pattern: "$T = fmt.$P(\"...\", ...)\n...\ntemplate.HTML($T, ...)\n" + - pattern: "$T, $ERR = fmt.$P(\"...\", ...)\n...\ntemplate.HTML($T, ...)\n" + - pattern: "$T = $X + $Y\n...\ntemplate.HTML($T, ...)\n" + - pattern: "$T = \"...\"\n...\n$OTHER, $ERR = fmt.$P(..., $T, ...)\n...\ntemplate.HTML($OTHER, ...)" severity: WARNING +- id: go.lang.security.audit.net.fs-directory-listing.fs-directory-listing languages: - go - patterns: - - pattern-either: - - patterns: - - pattern-inside: '$FS := http.FileServer(...) - - ... - - ' - - pattern-either: - - pattern: 'http.ListenAndServe(..., $FS) - - ' - - pattern: 'http.ListenAndServeTLS(..., $FS) - - ' - - pattern: 'http.Handle(..., $FS) - - ' - - pattern: 'http.HandleFunc(..., $FS) - - ' - - patterns: - - pattern: 'http.$FN(..., http.FileServer(...)) - - ' - - metavariable-regex: - metavariable: $FN - regex: (ListenAndServe|ListenAndServeTLS|Handle|HandleFunc) + message: "Detected usage of 'http.FileServer' as handler: this allows directory listing and an attacker could navigate through + directories looking for sensitive files. Be sure to disable directory listing or restrict access to specific directories/files." metadata: category: security + confidence: MEDIUM cwe: - 'CWE-548: Exposure of Information Through Directory Listing' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A06:2017 - Security Misconfiguration - A01:2021 - Broken Access Control @@ -4396,351 +3931,277 @@ rules: references: - https://github.com/OWASP/Go-SCP - https://cwe.mitre.org/data/definitions/548.html - confidence: MEDIUM - technology: - - go - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing - shortlink: https://sg.run/4R8x semgrep.dev: rule: + origin: community r_id: 21300 - rv_id: 1262944 rule_id: 5rU9JO + rv_id: 1262944 + url: + https://semgrep.dev/playground/r/QkTGqX0/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing version_id: QkTGqX0 - url: https://semgrep.dev/playground/r/QkTGqX0/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing - origin: community -- id: go.lang.security.audit.net.use-tls.use-tls - pattern: http.ListenAndServe($ADDR, $HANDLER) - fix: http.ListenAndServeTLS($ADDR, certFile, keyFile, $HANDLER) + shortlink: https://sg.run/4R8x + source: https://semgrep.dev/r/go.lang.security.audit.net.fs-directory-listing.fs-directory-listing + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Mishandled Sensitive Information + patterns: + - pattern-either: + - patterns: + - pattern-inside: "$FS := http.FileServer(...)\n...\n" + - pattern-either: + - pattern: "http.ListenAndServe(..., $FS)\n" + - pattern: "http.ListenAndServeTLS(..., $FS)\n" + - pattern: "http.Handle(..., $FS)\n" + - pattern: "http.HandleFunc(..., $FS)\n" + - patterns: + - pattern: "http.$FN(..., http.FileServer(...))\n" + - metavariable-regex: + metavariable: $FN + regex: (ListenAndServe|ListenAndServeTLS|Handle|HandleFunc) + severity: WARNING +- fix: http.ListenAndServeTLS($ADDR, certFile, keyFile, $HANDLER) + id: go.lang.security.audit.net.use-tls.use-tls + languages: + - go + message: Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See + https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://golang.org/pkg/net/http/#ListenAndServeTLS - category: security - technology: - - go - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls - shortlink: https://sg.run/dKbY semgrep.dev: rule: + origin: community r_id: 9134 - rv_id: 1262948 rule_id: PeUZ8X - version_id: JdTzxkn + rv_id: 1262948 url: https://semgrep.dev/playground/r/JdTzxkn/go.lang.security.audit.net.use-tls.use-tls - origin: community - message: Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS - for more information. - languages: - - go + version_id: JdTzxkn + shortlink: https://sg.run/dKbY + source: https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls + subcategory: + - audit + technology: + - go + vulnerability_class: + - Mishandled Sensitive Information + pattern: http.ListenAndServe($ADDR, $HANDLER) severity: WARNING - id: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf - patterns: - - pattern-inside: "func $FUNC(..., $W http.ResponseWriter, ...) {\n ...\n var $TEMPLATE = \"...\"\n ...\n $W.Write([]byte(fmt.$PRINTF($TEMPLATE,\ - \ ...)), ...)\n ...\n}\n" - - pattern-either: - - pattern: '$PARAMS = r.URL.Query() - - ... - - $DATA, $ERR := $PARAMS[...] - - ... - - $INTERM = $ANYTHING(..., $DATA, ...) - - ... - - $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - - ' - - pattern: '$PARAMS = r.URL.Query() - - ... - - $DATA, $ERR := $PARAMS[...] - - ... - - $INTERM = $DATA[...] - - ... - - $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - - ' - - pattern: '$DATA, $ERR := r.URL.Query()[...] - - ... - - $INTERM = $DATA[...] - - ... - - $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - - ' - - pattern: '$DATA, $ERR := r.URL.Query()[...] - - ... - - $INTERM = $ANYTHING(..., $DATA, ...) - - ... - - $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - - ' - - pattern: '$PARAMS = r.URL.Query() - - ... - - $DATA, $ERR := $PARAMS[...] - - ... - - $W.Write([]byte(fmt.$PRINTF(..., $DATA, ...))) - - ' - message: Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and - should not be done. If you must do this, ensure your data is sanitized or escaped. - metadata: - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + languages: + - go + message: Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS + and should not be done. If you must do this, ensure your data is sanitized or escaped. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - go - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf - shortlink: https://sg.run/Zvon semgrep.dev: rule: + origin: community r_id: 9135 - rv_id: 1262949 rule_id: JDUyXB + rv_id: 1262949 + url: + https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf version_id: 5PTo1qr - url: https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf - origin: community + shortlink: https://sg.run/Zvon + source: + https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cross-Site-Scripting (XSS) + patterns: + - pattern-inside: "func $FUNC(..., $W http.ResponseWriter, ...) {\n ...\n var $TEMPLATE = \"...\"\n ...\n $W.Write([]byte(fmt.$PRINTF($TEMPLATE, + ...)), ...)\n ...\n}\n" + - pattern-either: + - pattern: "$PARAMS = r.URL.Query()\n...\n$DATA, $ERR := $PARAMS[...]\n...\n$INTERM = $ANYTHING(..., $DATA, ...)\n...\n\ + $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))\n" + - pattern: "$PARAMS = r.URL.Query()\n...\n$DATA, $ERR := $PARAMS[...]\n...\n$INTERM = $DATA[...]\n...\n$W.Write([]byte(fmt.$PRINTF(..., + $INTERM, ...)))\n" + - pattern: "$DATA, $ERR := r.URL.Query()[...]\n...\n$INTERM = $DATA[...]\n...\n$W.Write([]byte(fmt.$PRINTF(..., $INTERM, + ...)))\n" + - pattern: "$DATA, $ERR := r.URL.Query()[...]\n...\n$INTERM = $ANYTHING(..., $DATA, ...)\n...\n$W.Write([]byte(fmt.$PRINTF(..., + $INTERM, ...)))\n" + - pattern: "$PARAMS = r.URL.Query()\n...\n$DATA, $ERR := $PARAMS[...]\n...\n$W.Write([]byte(fmt.$PRINTF(..., $DATA, ...)))\n" severity: WARNING - languages: - - go - id: go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface languages: - go - message: Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security vulnerabilities - (CWE-502). Use a concrete struct type instead. - severity: WARNING + message: Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security + vulnerabilities (CWE-502). Use a concrete struct type instead. metadata: + category: security + confidence: HIGH cwe: - 'CWE-502: Deserialization of Untrusted Data' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - category: security - technology: - - go - confidence: HIGH - likelihood: MEDIUM - impact: HIGH - subcategory: - - vuln references: - https://cwe.mitre.org/data/definitions/502.html - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface - shortlink: https://sg.run/6WbKL semgrep.dev: rule: + origin: community r_id: 274359 - rv_id: 1409387 rule_id: 4bUAQDG + rv_id: 1409387 + url: + https://semgrep.dev/playground/r/ZRTDkjk/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface version_id: ZRTDkjk - url: https://semgrep.dev/playground/r/ZRTDkjk/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface - origin: community + shortlink: https://sg.run/6WbKL + source: + https://semgrep.dev/r/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface + subcategory: + - vuln + technology: + - go + vulnerability_class: + - 'Insecure Deserialization ' patterns: - pattern-either: - - pattern: 'var $VAR interface{} - - ... - - json.Unmarshal($DATA, &$VAR) - - ' - - pattern: 'var $VAR interface{} - - ... - - yaml.Unmarshal($DATA, &$VAR) - - ' - - pattern: 'var $VAR interface{} - - ... - - xml.Unmarshal($DATA, &$VAR) - - ' -- id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse + - pattern: "var $VAR interface{}\n...\njson.Unmarshal($DATA, &$VAR)\n" + - pattern: "var $VAR interface{}\n...\nyaml.Unmarshal($DATA, &$VAR)\n" + - pattern: "var $VAR interface{}\n...\nxml.Unmarshal($DATA, &$VAR)\n" + severity: WARNING +- fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/"))) + id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse + languages: + - go message: '`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path, "/")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.' - severity: ERROR - languages: - - go - mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' - - metavariable-regex: - metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ - pattern-sinks: - - patterns: - - pattern-either: - - pattern: filepath.Clean($...INNER) - - pattern: path.Clean($...INNER) - pattern-sanitizers: - - pattern-either: - - pattern: '"/" + ... - - ' - fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/"))) - options: - interfile: true metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control references: - https://pkg.go.dev/path#Clean - http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html - https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/ - https://dzx.cz/2021/04/02/go_path_traversal/ - https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme - cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' - owasp: - - A05:2017 - Broken Access Control - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - category: security - technology: - - go - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse - shortlink: https://sg.run/ZKzw semgrep.dev: rule: + origin: community r_id: 18235 - rv_id: 1262967 rule_id: qNUQJe - version_id: jQTn5Bj + rv_id: 1262967 url: https://semgrep.dev/playground/r/jQTn5Bj/go.lang.security.filepath-clean-misuse.filepath-clean-misuse - origin: community + version_id: jQTn5Bj + shortlink: https://sg.run/ZKzw + source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Path Traversal + mode: taint + options: + interfile: true + pattern-sanitizers: + - pattern-either: + - pattern: "\"/\" + ...\n" + pattern-sinks: + - patterns: + - pattern-either: + - pattern: filepath.Clean($...INNER) + - pattern: path.Clean($...INNER) + pattern-sources: + - patterns: + - pattern-either: + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" + - metavariable-regex: + metavariable: $ANYTHING + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + severity: ERROR - id: go.lang.security.injection.raw-html-format.raw-html-format languages: - go - severity: WARNING - message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods - of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could - let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect - that the HTML is rendered safely. + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure + methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, + which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML + instead, or inspect that the HTML is rendered safely. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - go references: - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format - shortlink: https://sg.run/3r1G semgrep.dev: rule: + origin: community r_id: 14443 - rv_id: 1262968 rule_id: PeUonQ - version_id: 1QTyp2p + rv_id: 1262968 url: https://semgrep.dev/playground/r/1QTyp2p/go.lang.security.injection.raw-html-format.raw-html-format - origin: community + version_id: 1QTyp2p + shortlink: https://sg.run/3r1G + source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' - - metavariable-regex: - metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ pattern-sanitizers: - pattern: html.EscapeString(...) pattern-sinks: @@ -4751,21 +4212,37 @@ rules: - pattern: fmt.Fprintf($W, "$HTMLSTR", ...) - pattern: '"$HTMLSTR" + ...' - metavariable-pattern: - metavariable: $HTMLSTR language: generic + metavariable: $HTMLSTR pattern: <$TAG ... + pattern-sources: + - patterns: + - pattern-either: + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" + - metavariable-regex: + metavariable: $ANYTHING + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + severity: WARNING - id: go.lang.security.injection.tainted-sql-string.tainted-sql-string languages: - go - message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using - prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of - SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements - (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library. - options: - interfile: true + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings + using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible + indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use + prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library. metadata: + category: security + confidence: HIGH cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -4773,75 +4250,42 @@ rules: references: - https://golang.org/doc/database/sql-injection - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/ - category: security - technology: - - go - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/PbEq semgrep.dev: rule: + origin: community r_id: 14689 - rv_id: 1409388 rule_id: PeUoqy - version_id: nWTQ5qD + rv_id: 1409388 url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string - origin: community + version_id: nWTQ5qD + shortlink: https://sg.run/PbEq + source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - go + vulnerability_class: + - SQL Injection mode: taint - severity: ERROR - pattern-sources: - - patterns: - - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' - - metavariable-regex: - metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + options: + interfile: true + pattern-sanitizers: + - pattern-either: + - pattern: strconv.Atoi(...) + - pattern: "($X: bool)\n" pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - - pattern: '"$SQLSTR" + ... - - ' + - pattern: "\"$SQLSTR\" + ...\n" - patterns: - - pattern-inside: '$VAR = "$SQLSTR"; - - ... - - ' + - pattern-inside: "$VAR = \"$SQLSTR\";\n...\n" - pattern: $VAR += ... - patterns: - - pattern-inside: 'var $SB strings.Builder - - ... - - ' - - pattern-inside: '$SB.WriteString("$SQLSTR") - - ... - - $SB.String(...) - - ' - - pattern: '$SB.WriteString(...) - - ' + - pattern-inside: "var $SB strings.Builder\n...\n" + - pattern-inside: "$SB.WriteString(\"$SQLSTR\")\n...\n$SB.String(...)\n" + - pattern: "$SB.WriteString(...)\n" - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop).* @@ -4853,74 +4297,91 @@ rules: - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* - pattern-sanitizers: - - pattern-either: - - pattern: strconv.Atoi(...) - - pattern: '($X: bool) - - ' + pattern-sources: + - patterns: + - pattern-either: + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" + - metavariable-regex: + metavariable: $ANYTHING + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + severity: ERROR - id: go.lang.security.injection.tainted-url-host.tainted-url-host languages: - go - message: A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) - vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft - the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the - request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist. - options: - interfile: true + message: A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery + (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input + to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to + craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist. metadata: + category: security + confidence: HIGH cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://goteleport.com/blog/ssrf-attacks/ - category: security - technology: - - go - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host - shortlink: https://sg.run/5DjW semgrep.dev: rule: + origin: community r_id: 14391 - rv_id: 1262970 rule_id: AbUQLr - version_id: yeTxpOj + rv_id: 1262970 url: https://semgrep.dev/playground/r/yeTxpOj/go.lang.security.injection.tainted-url-host.tainted-url-host - origin: community + version_id: yeTxpOj + shortlink: https://sg.run/5DjW + source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host + subcategory: + - vuln + technology: + - go + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint + options: + interfile: true + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - patterns: + - pattern-inside: "$CLIENT := &http.Client{...}\n...\n" + - pattern: $CLIENT.$METHOD($URL, ...) + - pattern: http.$METHOD($URL, ...) + - metavariable-regex: + metavariable: $METHOD + regex: ^(Get|Head|Post|PostForm)$ + - patterns: + - pattern: "http.NewRequest(\"$METHOD\", $URL, ...)\n" + - metavariable-regex: + metavariable: $METHOD + regex: ^(GET|HEAD|POST|POSTFORM)$ + - focus-metavariable: $URL + requires: INPUT and not CLEAN pattern-sources: - label: INPUT patterns: - pattern-either: - - pattern: '($REQUEST : *http.Request).$ANYTHING - - ' - - pattern: '($REQUEST : http.Request).$ANYTHING - - ' + - pattern: "($REQUEST : *http.Request).$ANYTHING\n" + - pattern: "($REQUEST : http.Request).$ANYTHING\n" - metavariable-regex: metavariable: $ANYTHING - regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ + regex: + ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ - label: CLEAN - requires: INPUT patterns: - pattern-either: - - pattern: '"$URLSTR" + $INPUT - - ' + - pattern: "\"$URLSTR\" + $INPUT\n" - patterns: - pattern-either: - pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...) @@ -4929,668 +4390,585 @@ rules: - metavariable-regex: metavariable: $URLSTR regex: .*//[a-zA-Z0-10]+\..* - pattern-sinks: - - requires: INPUT and not CLEAN - patterns: - - pattern-either: - - patterns: - - pattern-either: - - patterns: - - pattern-inside: '$CLIENT := &http.Client{...} - - ... - - ' - - pattern: $CLIENT.$METHOD($URL, ...) - - pattern: http.$METHOD($URL, ...) - - metavariable-regex: - metavariable: $METHOD - regex: ^(Get|Head|Post|PostForm)$ - - patterns: - - pattern: 'http.NewRequest("$METHOD", $URL, ...) - - ' - - metavariable-regex: - metavariable: $METHOD - regex: ^(GET|HEAD|POST|POSTFORM)$ - - focus-metavariable: $URL + requires: INPUT severity: WARNING - id: html.security.plaintext-http-link.plaintext-http-link + languages: + - html + message: This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible. metadata: category: security - technology: - - html + confidence: HIGH cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - confidence: HIGH - subcategory: - - vuln references: - https://cwe.mitre.org/data/definitions/319.html - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link - shortlink: https://sg.run/RA5q semgrep.dev: rule: + origin: community r_id: 39193 - rv_id: 1262976 rule_id: AbUnNo - version_id: xyTjzRL + rv_id: 1262976 url: https://semgrep.dev/playground/r/xyTjzRL/html.security.plaintext-http-link.plaintext-http-link - origin: community + version_id: xyTjzRL + shortlink: https://sg.run/RA5q + source: https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link + subcategory: + - vuln + technology: + - html + vulnerability_class: + - Mishandled Sensitive Information patterns: - pattern: ... - metavariable-regex: metavariable: $URL regex: ^(?i)http:// - message: This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible. severity: WARNING - languages: - - html - id: java.android.security.exported_activity.exported_activity - patterns: - - pattern-not-inside: - - pattern-inside: " \n" - - pattern-either: - - pattern: ' - - ' - - pattern: ' ... /> - - ' - message: The application exports an activity. Any application on the device can launch the exported activity which may compromise - the integrity of your application or its data. Ensure that any exported activities do not have privileged access to your - application's control plane. languages: - generic - severity: WARNING - paths: - exclude: - - sources/ - - classes3.dex - - '*.so' - include: - - '*AndroidManifest.xml' + message: The application exports an activity. Any application on the device can launch the exported activity which may + compromise the integrity of your application or its data. Ensure that any exported activities do not have + privileged access to your application's control plane. metadata: category: security - subcategory: - - vuln + confidence: MEDIUM cwe: - 'CWE-926: Improper Export of Android Application Components' - confidence: MEDIUM - likelihood: MEDIUM impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A5:2021 Security Misconfiguration - technology: - - Android references: - https://cwe.mitre.org/data/definitions/926.html - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/java.android.security.exported_activity.exported_activity - shortlink: https://sg.run/eNGZ semgrep.dev: rule: + origin: community r_id: 60632 - rv_id: 945629 rule_id: v8Ul0r - version_id: rxT6rGR + rv_id: 945629 url: https://semgrep.dev/playground/r/rxT6rGR/java.android.security.exported_activity.exported_activity - origin: community + version_id: rxT6rGR + shortlink: https://sg.run/eNGZ + source: https://semgrep.dev/r/java.android.security.exported_activity.exported_activity + subcategory: + - vuln + technology: + - Android + vulnerability_class: + - Other + paths: + exclude: + - sources/ + - classes3.dex + - '*.so' + include: + - '*AndroidManifest.xml' + patterns: + - pattern-not-inside: + - pattern-inside: " \n" + - pattern-either: + - pattern: "\n" + - pattern: " ... />\n" + severity: WARNING - id: java.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - java - severity: ERROR - message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction - could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the - database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider - using an object-relational mapper (ORM) such as Sequelize which will protect your queries. - options: - interfile: true + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual + construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify + contents of the database. Instead, use a parameterized query which is available by default in most database engines. + Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. metadata: - references: - - https://owasp.org/www-community/attacks/SQL_Injection category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH - confidence: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/EBYN + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/SQL_Injection semgrep.dev: rule: + origin: community r_id: 18237 - rv_id: 1262977 rule_id: YGUl4z - version_id: O9TpxQN + rv_id: 1262977 url: https://semgrep.dev/playground/r/O9TpxQN/java.aws-lambda.security.tainted-sql-string.tainted-sql-string - origin: community + version_id: O9TpxQN + shortlink: https://sg.run/EBYN + source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - patterns: - - focus-metavariable: $EVENT - - pattern-either: - - pattern: "$HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {\n ...\n}\n" - - pattern: "$HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context\ - \ $CONTEXT) {\n ...\n}\n" + options: + interfile: true pattern-sinks: - patterns: - pattern-either: - - pattern: '"$SQLSTR" + ... - - ' - - pattern: '"$SQLSTR".concat(...) - - ' + - pattern: "\"$SQLSTR\" + ...\n" + - pattern: "\"$SQLSTR\".concat(...)\n" - patterns: - - pattern-inside: 'StringBuilder $SB = new StringBuilder("$SQLSTR"); - - ... - - ' + - pattern-inside: "StringBuilder $SB = new StringBuilder(\"$SQLSTR\");\n...\n" - pattern: $SB.append(...) - patterns: - - pattern-inside: '$VAR = "$SQLSTR"; - - ... - - ' + - pattern-inside: "$VAR = \"$SQLSTR\";\n...\n" - pattern: $VAR += ... - pattern: String.format("$SQLSTR", ...) - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop)\b - - pattern-not-inside: 'System.out.$PRINTLN(...) - - ' -- id: java.aws-lambda.security.tainted-sqli.tainted-sqli - message: Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the - SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead. - languages: - - java - severity: WARNING - mode: taint + - pattern-not-inside: "System.out.$PRINTLN(...)\n" pattern-sources: - patterns: - focus-metavariable: $EVENT - pattern-either: - pattern: "$HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {\n ...\n}\n" - - pattern: "$HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context\ - \ $CONTEXT) {\n ...\n}\n" - pattern-sinks: - - patterns: - - pattern-either: - - pattern: "(java.sql.CallableStatement $STMT) = ...; \n" - - pattern: '(java.sql.Statement $STMT) = ...; - - ' - - pattern: '(java.sql.PreparedStatement $STMT) = ...; - - ' - - pattern: '$VAR = $CONN.prepareStatement(...) - - ' - - pattern: '$PATH.queryForObject(...); - - ' - - pattern: '(java.util.Map $STMT) = $PATH.queryForMap(...); - - ' - - pattern: '(org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...; - - ' - - patterns: - - pattern-inside: '(String $SQL) = "$SQLSTR" + ...; - - ... - - ' - - pattern: $PATH.$SQLCMD(..., $SQL, ...); - - metavariable-regex: - metavariable: $SQLSTR - regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*) - - metavariable-regex: - metavariable: $SQLCMD - regex: (execute|query|executeUpdate|batchUpdate) - options: - interfile: true + - pattern: "$HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context + $CONTEXT) {\n ...\n}\n" + severity: ERROR +- id: java.aws-lambda.security.tainted-sqli.tainted-sqli + languages: + - java + message: Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in + the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead. metadata: category: security - technology: - - sql - - java - - aws-lambda + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli - shortlink: https://sg.run/7942 semgrep.dev: rule: + origin: community r_id: 18238 - rv_id: 1262978 rule_id: 6JUDWk - version_id: e1Tyj4g + rv_id: 1262978 url: https://semgrep.dev/playground/r/e1Tyj4g/java.aws-lambda.security.tainted-sqli.tainted-sqli - origin: community + version_id: e1Tyj4g + shortlink: https://sg.run/7942 + source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli + subcategory: + - vuln + technology: + - sql + - java + - aws-lambda + vulnerability_class: + - SQL Injection + mode: taint + options: + interfile: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "(java.sql.CallableStatement $STMT) = ...; \n" + - pattern: "(java.sql.Statement $STMT) = ...;\n" + - pattern: "(java.sql.PreparedStatement $STMT) = ...;\n" + - pattern: "$VAR = $CONN.prepareStatement(...)\n" + - pattern: "$PATH.queryForObject(...);\n" + - pattern: "(java.util.Map $STMT) = $PATH.queryForMap(...);\n" + - pattern: "(org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...;\n" + - patterns: + - pattern-inside: "(String $SQL) = \"$SQLSTR\" + ...;\n...\n" + - pattern: $PATH.$SQLCMD(..., $SQL, ...); + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*) + - metavariable-regex: + metavariable: $SQLCMD + regex: (execute|query|executeUpdate|batchUpdate) + pattern-sources: + - patterns: + - focus-metavariable: $EVENT + - pattern-either: + - pattern: "$HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {\n ...\n}\n" + - pattern: "$HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context + $CONTEXT) {\n ...\n}\n" + severity: WARNING - id: java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify - message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the - token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before - using the token. + languages: + - java + message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise + the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call + '.verify()' before using the token. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-345: Insufficient Verification of Data Authenticity' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - category: security - technology: - - jwt - confidence: MEDIUM references: - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures - subcategory: - - vuln - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify - shortlink: https://sg.run/Bk95 semgrep.dev: rule: + origin: community r_id: 9151 - rv_id: 1262979 rule_id: pKUOE9 + rv_id: 1262979 + url: + https://semgrep.dev/playground/r/vdT06Lp/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify version_id: vdT06Lp - url: https://semgrep.dev/playground/r/vdT06Lp/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify - origin: community - languages: - - java - severity: WARNING + shortlink: https://sg.run/Bk95 + source: https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - vuln + technology: + - jwt + vulnerability_class: + - Improper Authentication patterns: - - pattern: 'com.auth0.jwt.JWT.decode(...); - - ' + - pattern: "com.auth0.jwt.JWT.decode(...);\n" - pattern-not-inside: "class $CLASS {\n ...\n $RETURNTYPE $FUNC (...) {\n ...\n $VERIFIER.verify(...);\n ...\n\ \ }\n}" + severity: WARNING - id: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + languages: + - java + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: + category: security + confidence: HIGH cwe: - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + semgrep.dev: + rule: + origin: community + r_id: 9149 + rule_id: oqUeAn + rv_id: 1262980 + url: https://semgrep.dev/playground/r/d6Tyx8j/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret + version_id: d6Tyx8j + shortlink: https://sg.run/RoDK + source: https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret + subcategory: + - vuln technology: - java - secrets - jwt - category: security - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets - source: https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret - shortlink: https://sg.run/RoDK - semgrep.dev: - rule: - r_id: 9149 - rv_id: 1262980 - rule_id: oqUeAn - version_id: d6Tyx8j - url: https://semgrep.dev/playground/r/d6Tyx8j/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret - origin: community - languages: - - java - severity: WARNING patterns: - pattern-either: - - pattern: '(Algorithm $ALG) = $ALGO.$HMAC("$Y"); - - ' - - pattern: '$SECRET = "$Y"; - - ... - - (Algorithm $ALG) = $ALGO.$HMAC($SECRET); - - ' - - pattern: "class $CLASS {\n ...\n $TYPE $SECRET = \"$Y\";\n ...\n $RETURNTYPE $FUNC (...) {\n ...\n (Algorithm\ - \ $ALG) = $ALGO.$HMAC($SECRET);\n ...\n }\n ...\n}\n" + - pattern: "(Algorithm $ALG) = $ALGO.$HMAC(\"$Y\");\n" + - pattern: "$SECRET = \"$Y\";\n...\n(Algorithm $ALG) = $ALGO.$HMAC($SECRET);\n" + - pattern: "class $CLASS {\n ...\n $TYPE $SECRET = \"$Y\";\n ...\n $RETURNTYPE $FUNC (...) {\n ...\n (Algorithm + $ALG) = $ALGO.$HMAC($SECRET);\n ...\n }\n ...\n}\n" - focus-metavariable: $Y - metavariable-regex: metavariable: $HMAC regex: (HMAC384|HMAC256|HMAC512) + severity: WARNING - id: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg - message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has - already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do - not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + languages: + - java + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token + has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be + verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - category: security - technology: - - jwt - confidence: HIGH references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg - shortlink: https://sg.run/Av14 semgrep.dev: rule: + origin: community r_id: 9150 - rv_id: 1262981 rule_id: zdUkzR - version_id: ZRTKADq + rv_id: 1262981 url: https://semgrep.dev/playground/r/ZRTKADq/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg - origin: community - languages: - - java - severity: ERROR + version_id: ZRTKADq + shortlink: https://sg.run/Av14 + source: https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - vuln + technology: + - jwt + vulnerability_class: + - Cryptographic Issues pattern-either: - - pattern: '$JWT.sign(com.auth0.jwt.algorithms.Algorithm.none()); - - ' - - pattern: '$NONE = com.auth0.jwt.algorithms.Algorithm.none(); - - ... - - $JWT.sign($NONE); - - ' - - pattern: "class $CLASS {\n ...\n $TYPE $NONE = com.auth0.jwt.algorithms.Algorithm.none();\n ...\n $RETURNTYPE $FUNC\ - \ (...) {\n ...\n $JWT.sign($NONE);\n ...\n }\n ...\n}" + - pattern: "$JWT.sign(com.auth0.jwt.algorithms.Algorithm.none());\n" + - pattern: "$NONE = com.auth0.jwt.algorithms.Algorithm.none();\n...\n$JWT.sign($NONE);\n" + - pattern: "class $CLASS {\n ...\n $TYPE $NONE = com.auth0.jwt.algorithms.Algorithm.none();\n ...\n $RETURNTYPE $FUNC + (...) {\n ...\n $JWT.sign($NONE);\n ...\n }\n ...\n}" + severity: ERROR - id: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal + languages: + - java + message: Detected a potential path traversal. A malicious actor could control the location of this file, to include + going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths + are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) + to only retrieve the file name from the path. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN references: - https://www.owasp.org/index.php/Path_Traversal - category: security - technology: - - jax-rs - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal - shortlink: https://sg.run/DoWj semgrep.dev: rule: + origin: community r_id: 9152 - rv_id: 1262984 rule_id: 2ZUb9l - version_id: 7ZTE3KW + rv_id: 1262984 url: https://semgrep.dev/playground/r/7ZTE3KW/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal - origin: community - message: Detected a potential path traversal. A malicious actor could control the location of this file, to include going - backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. - You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve - the file name from the path. - severity: WARNING - languages: - - java + version_id: 7ZTE3KW + shortlink: https://sg.run/DoWj + source: https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN + subcategory: + - vuln + technology: + - jax-rs + vulnerability_class: + - Path Traversal pattern-either: - pattern: "$RETURNTYPE $FUNC (..., @PathParam(...) $TYPE $VAR, ...) {\n ...\n new File(..., $VAR, ...);\n ...\n}\n" - pattern: "$RETURNTYPE $FUNC (..., @javax.ws.rs.PathParam(...) $TYPE $VAR, ...) {\n ...\n new File(..., $VAR, ...);\n\ \ ...\n}" + severity: WARNING - id: java.jboss.security.session_sqli.find-sql-string-concatenation - message: In $METHOD, $X is used to construct a SQL query via string concatenation. languages: - java - severity: ERROR - pattern-either: - - pattern: "$RETURN $METHOD(...,String $X,...){\n ...\n Session $SESSION = ...;\n ...\n String $QUERY = ... + $X + ...;\n\ - \ ...\n PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY);\n ...\n ResultSet $RESULT = $PS.executeQuery();\n\ - \ ...\n}\n" - - pattern: "$RETURN $METHOD(...,String $X,...){\n ...\n String $QUERY = ... + $X + ...;\n ...\n Session $SESSION = ...;\n\ - \ ...\n PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY);\n ...\n ResultSet $RESULT = $PS.executeQuery();\n\ - \ ...\n}\n" + message: In $METHOD, $X is used to construct a SQL query via string concatenation. metadata: category: security - technology: - - jboss confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation - shortlink: https://sg.run/W8kA semgrep.dev: rule: + origin: community r_id: 9153 - rv_id: 1262986 rule_id: X5U8rQ - version_id: 8KT5r3v + rv_id: 1262986 url: https://semgrep.dev/playground/r/8KT5r3v/java.jboss.security.session_sqli.find-sql-string-concatenation - origin: community -- id: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size + version_id: 8KT5r3v + shortlink: https://sg.run/W8kA + source: https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation + subcategory: + - vuln + technology: + - jboss + vulnerability_class: + - SQL Injection + pattern-either: + - pattern: "$RETURN $METHOD(...,String $X,...){\n ...\n Session $SESSION = ...;\n ...\n String $QUERY = ... + $X + ...;\n\ + \ ...\n PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY);\n ...\n ResultSet $RESULT = $PS.executeQuery();\n\ + \ ...\n}\n" + - pattern: "$RETURN $METHOD(...,String $X,...){\n ...\n String $QUERY = ... + $X + ...;\n ...\n Session $SESSION = ...;\n\ + \ ...\n PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY);\n ...\n ResultSet $RESULT = $PS.executeQuery();\n\ + \ ...\n}\n" + severity: ERROR +- id: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size + languages: + - java + message: Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES + instead. metadata: + asvs: + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BLOWFISH_KEY_SIZE - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.5 Insecure Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' - category: security - technology: - - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - audit - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size - shortlink: https://sg.run/9o74 semgrep.dev: rule: + origin: community r_id: 9167 - rv_id: 1262989 rule_id: d8UjJ3 + rv_id: 1262989 + url: + https://semgrep.dev/playground/r/3ZT4X2r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size version_id: 3ZT4X2r - url: https://semgrep.dev/playground/r/3ZT4X2r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size - origin: community - message: Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead. - severity: WARNING - languages: - - java + shortlink: https://sg.run/9o74 + source: https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BLOWFISH_KEY_SIZE + subcategory: + - audit + technology: + - java + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: '$KEYGEN = KeyGenerator.getInstance("Blowfish"); - - ... - - $KEYGEN.init($SIZE); - - ' + - pattern: "$KEYGEN = KeyGenerator.getInstance(\"Blowfish\");\n...\n$KEYGEN.init($SIZE);\n" - metavariable-comparison: - metavariable: $SIZE comparison: $SIZE < 128 -- id: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle - message: Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference - between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' - instead. + metavariable: $SIZE + severity: WARNING +- fix: "\"AES/GCM/NoPadding\"\n" + id: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle + languages: + - java + message: Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the + difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. + Use 'AES/GCM/NoPadding' instead. metadata: + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PADDING_ORACLE references: - https://capec.mitre.org/data/definitions/463.html - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes - https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY - category: security - technology: - - java - subcategory: - - audit - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle - shortlink: https://sg.run/ydxr semgrep.dev: rule: + origin: community r_id: 9168 - rv_id: 1262990 rule_id: ZqU5oD - version_id: 44TEjbE + rv_id: 1262990 url: https://semgrep.dev/playground/r/44TEjbE/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle - origin: community - severity: WARNING - fix: '"AES/GCM/NoPadding" - - ' - languages: - - java + version_id: 44TEjbE + shortlink: https://sg.run/ydxr + source: https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PADDING_ORACLE + subcategory: + - audit + technology: + - java + vulnerability_class: + - Cryptographic Issues patterns: - pattern-inside: Cipher.getInstance("=~/.*\/CBC\/PKCS5Padding/") - - pattern: '"=~/.*\/CBC\/PKCS5Padding/" - - ' + - pattern: "\"=~/.*\\/CBC\\/PKCS5Padding/\"\n" + severity: WARNING - id: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs - message: When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge - log entries or include malicious content. + languages: + - java + message: When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could + forge log entries or include malicious content. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-93: Improper Neutralization of CRLF Sequences (''CRLF Injection'')' + - "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2021 - Injection - A05:2025 - Injection - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#CRLF_INJECTION_LOGS - category: security - technology: - - java references: - https://owasp.org/Top10/A03_2021-Injection - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs - shortlink: https://sg.run/wek0 semgrep.dev: rule: + origin: community r_id: 9173 - rv_id: 1262995 rule_id: 8GUjwW - version_id: RGT0LEr + rv_id: 1262995 url: https://semgrep.dev/playground/r/RGT0LEr/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs - origin: community - severity: WARNING - languages: - - java + version_id: RGT0LEr + shortlink: https://sg.run/wek0 + source: https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#CRLF_INJECTION_LOGS + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Improper Validation patterns: - pattern-either: - patterns: @@ -5603,611 +4981,572 @@ rules: - pattern-inside: "$X $METHOD(...) {\n ...\n Logger $LOG = ...;\n ...\n HttpServletRequest $REQ = ...;\n ...\n}\n" - pattern-inside: "$X $METHOD(...) {\n ...\n Logger $LOG = ...;\n ...\n ServletRequest $REQ = ...;\n ...\n}\n" - pattern-either: - - pattern: 'String $VAL = $REQ.getParameter(...); - - ... - - $LOG.$LEVEL(<... $VAL ...>); - - ' - - pattern: 'String $VAL = $REQ.getParameter(...); - - ... - - $LOG.log($LEVEL,<... $VAL ...>); - - ' - - pattern: '$LOG.$LEVEL(<... $REQ.getParameter(...) ...>); - - ' - - pattern: '$LOG.log($LEVEL,<... $REQ.getParameter(...) ...>); - - ' -- id: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated - message: DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard - for more information. + - pattern: "String $VAL = $REQ.getParameter(...);\n...\n$LOG.$LEVEL(<... $VAL ...>);\n" + - pattern: "String $VAL = $REQ.getParameter(...);\n...\n$LOG.log($LEVEL,<... $VAL ...>);\n" + - pattern: "$LOG.$LEVEL(<... $REQ.getParameter(...) ...>);\n" + - pattern: "$LOG.log($LEVEL,<... $REQ.getParameter(...) ...>);\n" + severity: WARNING +- fix: "\"AES/GCM/NoPadding\"\n" + id: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated + languages: + - java + - kt + message: DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See + https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information. metadata: - functional-categories: - - crypto::search::symmetric-algorithm::javax.crypto + asvs: + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::symmetric-algorithm::javax.crypto + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DES_USAGE - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.5 Insecure Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' references: - https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms - category: security - technology: - - java - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated - shortlink: https://sg.run/5Q73 semgrep.dev: rule: + origin: community r_id: 9191 - rv_id: 1262996 rule_id: PeUZNg + rv_id: 1262996 + url: + https://semgrep.dev/playground/r/A8TgdEn/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated version_id: A8TgdEn - url: https://semgrep.dev/playground/r/A8TgdEn/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated - origin: community - severity: WARNING + shortlink: https://sg.run/5Q73 + source: https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DES_USAGE + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - pattern-inside: $CIPHER.getInstance("=~/DES/.*/") - pattern-inside: $CIPHER.getInstance("DES") - pattern-either: - - pattern: '"=~/DES/.*/" - - ' - - pattern: '"DES" - - ' - fix: '"AES/GCM/NoPadding" - - ' + - pattern: "\"=~/DES/.*/\"\n" + - pattern: "\"DES\"\n" + severity: WARNING +- id: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated languages: - java - kt -- id: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated message: Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES. metadata: - functional-categories: - - crypto::search::symmetric-algorithm::javax.crypto + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::symmetric-algorithm::javax.crypto + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#TDES_USAGE references: - https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA - category: security - technology: - - java - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated - shortlink: https://sg.run/Geqn semgrep.dev: rule: + origin: community r_id: 9192 - rv_id: 1262997 rule_id: JDUy8J + rv_id: 1262997 + url: + https://semgrep.dev/playground/r/BjTkZyQ/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated version_id: BjTkZyQ - url: https://semgrep.dev/playground/r/BjTkZyQ/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated - origin: community - severity: WARNING + shortlink: https://sg.run/Geqn + source: https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#TDES_USAGE + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern: '$CIPHER.getInstance("=~/DESede.*/") - - ' - - pattern: '$CRYPTO.KeyGenerator.getInstance("DES") - - ' + - pattern: "$CIPHER.getInstance(\"=~/DESede.*/\")\n" + - pattern: "$CRYPTO.KeyGenerator.getInstance(\"DES\")\n" + severity: WARNING +- id: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher languages: - java - - kt -- id: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher + message: Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows + an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See + https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY. metadata: - functional-categories: - - crypto::search::mode::javax.crypto + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::mode::javax.crypto + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE - category: security - technology: - - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher - shortlink: https://sg.run/Ro9K semgrep.dev: rule: + origin: community r_id: 9193 - rv_id: 1262998 rule_id: 5rUOb6 - version_id: DkTRbwL + rv_id: 1262998 url: https://semgrep.dev/playground/r/DkTRbwL/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher - origin: community - message: Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an - attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY. - severity: WARNING - languages: - - java + version_id: DkTRbwL + shortlink: https://sg.run/Ro9K + source: https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: 'Cipher $VAR = $CIPHER.getInstance($MODE); - - ' + - pattern: "Cipher $VAR = $CIPHER.getInstance($MODE);\n" - metavariable-regex: metavariable: $MODE regex: .*ECB.* + severity: WARNING - id: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse + languages: + - java + message: 'GCM IV/nonce is reused: encryption can be totally useless' metadata: - functional-categories: - - crypto::search::randomness::javax.crypto + category: security + confidence: HIGH cwe: - 'CWE-323: Reusing a Nonce, Key Pair in Encryption' - category: security - source-rule-url: https://www.youtube.com/watch?v=r1awgAl90wM - technology: - - java + functional-categories: + - crypto::search::randomness::javax.crypto + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse - shortlink: https://sg.run/Dww2 semgrep.dev: rule: + origin: community r_id: 11908 - rv_id: 1263000 rule_id: GdUZZ3 - version_id: 0bTKzGk + rv_id: 1263000 url: https://semgrep.dev/playground/r/0bTKzGk/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse - origin: community - languages: - - java - message: 'GCM IV/nonce is reused: encryption can be totally useless' + version_id: 0bTKzGk + shortlink: https://sg.run/Dww2 + source: https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse + source-rule-url: https://www.youtube.com/watch?v=r1awgAl90wM + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - pattern: new GCMParameterSpec(..., "...".getBytes(...), ...); - pattern: byte[] $NONCE = "...".getBytes(...); ... new GCMParameterSpec(..., $NONCE, ...); severity: ERROR - id: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher - patterns: - - pattern-either: - - pattern: new NullCipher(...); - - pattern: new javax.crypto.NullCipher(...); + languages: + - java + message: 'NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use + a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions + for more information.' metadata: + asvs: + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.5 Insecure Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' - category: security - technology: - - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher - shortlink: https://sg.run/AvA4 semgrep.dev: rule: + origin: community r_id: 9194 - rv_id: 1263001 rule_id: GdU7pw - version_id: K3TKkgB + rv_id: 1263001 url: https://semgrep.dev/playground/r/K3TKkgB/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher - origin: community - message: 'NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use - a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions - for more information.' + version_id: K3TKkgB + shortlink: https://sg.run/AvA4 + source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern-either: + - pattern: new NullCipher(...); + - pattern: new javax.crypto.NullCipher(...); severity: WARNING +- id: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector languages: - java -- id: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector - message: Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static - IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption. + message: Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a + static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the + encryption. metadata: - cwe: - - 'CWE-329: Generation of Predictable IV with CBC Mode' - owasp: - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#STATIC_IV asvs: - section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements version: '4' - references: - - https://cwe.mitre.org/data/definitions/329.html category: security - technology: - - java - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM confidence: HIGH + cwe: + - 'CWE-329: Generation of Predictable IV with CBC Mode' + impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector - shortlink: https://sg.run/BkB5 + likelihood: MEDIUM + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://cwe.mitre.org/data/definitions/329.html semgrep.dev: rule: + origin: community r_id: 9195 - rv_id: 1263002 rule_id: ReUgj1 + rv_id: 1263002 + url: + https://semgrep.dev/playground/r/qkTR7vP/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector version_id: qkTR7vP - url: https://semgrep.dev/playground/r/qkTR7vP/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector - origin: community - severity: WARNING - languages: - - java + shortlink: https://sg.run/BkB5 + source: + https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#STATIC_IV + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: "byte[] $IV = {\n ...\n};\n...\nnew IvParameterSpec($IV, ...);\n" - - pattern: "class $CLASS {\n byte[] $IV = {\n ...\n };\n ...\n $METHOD(...) {\n ...\n new\ - \ IvParameterSpec($IV, ...);\n ...\n }\n}\n" + - pattern: "class $CLASS {\n byte[] $IV = {\n ...\n };\n ...\n $METHOD(...) {\n ...\n new + IvParameterSpec($IV, ...);\n ...\n }\n}\n" + severity: WARNING - id: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding + languages: + - java + - kt + message: Using RSA without OAEP mode weakens the encryption. metadata: - functional-categories: - - crypto::search::mode::javax.crypto + asvs: + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::mode::javax.crypto + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_NO_PADDING references: - https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/ - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.5 Insecure Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' - category: security - technology: - - java - - kotlin - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding - shortlink: https://sg.run/DoOj semgrep.dev: rule: + origin: community r_id: 9196 - rv_id: 1263003 rule_id: AbUzoj - version_id: l4TJRpK + rv_id: 1263003 url: https://semgrep.dev/playground/r/l4TJRpK/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding - origin: community - message: Using RSA without OAEP mode weakens the encryption. + version_id: l4TJRpK + shortlink: https://sg.run/DoOj + source: https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_NO_PADDING + subcategory: + - vuln + technology: + - java + - kotlin + vulnerability_class: + - Cryptographic Issues + pattern: $CIPHER.getInstance("=~/RSA/[Nn][Oo][Nn][Ee]/NoPadding/") severity: WARNING +- id: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket languages: - java - - kt - pattern: $CIPHER.getInstance("=~/RSA/[Nn][Oo][Nn][Ee]/NoPadding/") -- id: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket + message: Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker + intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' + instead. metadata: - functional-categories: - - net::search::crypto-config::java.net + asvs: + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' + functional-categories: + - net::search::crypto-config::java.net + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNENCRYPTED_SOCKET - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.5 Insecure Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' - category: security - technology: - - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket - shortlink: https://sg.run/W8zA semgrep.dev: rule: + origin: community r_id: 9197 - rv_id: 1263008 rule_id: BYUN3X + rv_id: 1263008 + url: + https://semgrep.dev/playground/r/RGT0LEj/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket version_id: RGT0LEj - url: https://semgrep.dev/playground/r/RGT0LEj/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket - origin: community - message: Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting - the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead. - severity: WARNING - languages: - - java + shortlink: https://sg.run/W8zA + source: https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNENCRYPTED_SOCKET + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Mishandled Sensitive Information pattern-either: - pattern: new ServerSocket(...) - pattern: new Socket(...) + severity: WARNING - id: java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb - pattern: $CIPHER.getInstance("=~/AES/ECB.*/") + languages: + - java + message: "Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and is not semantically secure + so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions + for more information." metadata: - functional-categories: - - crypto::search::mode::javax.crypto + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::mode::javax.crypto + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - category: security - technology: - - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb - shortlink: https://sg.run/dB2Y semgrep.dev: rule: + origin: community r_id: 48734 - rv_id: 1263009 rule_id: WAU2yA - version_id: A8TgdEo + rv_id: 1263009 url: https://semgrep.dev/playground/r/A8TgdEo/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb - origin: community - message: 'Use of AES with ECB mode detected. ECB doesn''t provide message confidentiality and is not semantically secure - so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions - for more information.' + version_id: A8TgdEo + shortlink: https://sg.run/dB2Y + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cryptographic Issues + pattern: $CIPHER.getInstance("=~/AES/ECB.*/") severity: WARNING +- id: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish languages: - java -- id: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish - pattern: $CIPHER.getInstance("Blowfish") + message: 'Use of Blowfish was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, + and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). + See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' metadata: - functional-categories: - - crypto::search::symmetric-algorithm::javax.crypto + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::javax.crypto + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - category: security - technology: - - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish - shortlink: https://sg.run/ZE4n semgrep.dev: rule: + origin: community r_id: 48735 - rv_id: 1263010 rule_id: 0oUR28 - version_id: BjTkZy0 + rv_id: 1263010 url: https://semgrep.dev/playground/r/BjTkZy0/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish - origin: community - message: 'Use of Blowfish was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, - and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). - See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' + version_id: BjTkZy0 + shortlink: https://sg.run/ZE4n + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cryptographic Issues + pattern: $CIPHER.getInstance("Blowfish") severity: WARNING +- id: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes languages: - java -- id: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes + message: "Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't provide message + confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"\ + AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information." + metadata: + category: security + confidence: HIGH + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::mode::javax.crypto + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html + semgrep.dev: + rule: + origin: community + r_id: 48736 + rule_id: KxUB7Z + rv_id: 1263011 + url: + https://semgrep.dev/playground/r/DkTRbwy/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes + version_id: DkTRbwy + shortlink: https://sg.run/nzKO + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cryptographic Issues pattern-either: - patterns: - pattern-either: - - pattern-inside: 'import javax; - - ... - - ' + - pattern-inside: "import javax;\n...\n" - pattern-either: - pattern: javax.crypto.Cipher.getInstance("AES") - pattern: (javax.crypto.Cipher $CIPHER).getInstance("AES") - patterns: - pattern-either: - - pattern-inside: 'import javax.*; - - ... - - ' - - pattern-inside: 'import javax.crypto; - - ... - - ' + - pattern-inside: "import javax.*;\n...\n" + - pattern-inside: "import javax.crypto;\n...\n" - pattern-either: - pattern: crypto.Cipher.getInstance("AES") - pattern: (crypto.Cipher $CIPHER).getInstance("AES") - patterns: - pattern-either: - - pattern-inside: 'import javax.crypto.*; - - ... - - ' - - pattern-inside: 'import javax.crypto.Cipher; - - ... - - ' + - pattern-inside: "import javax.crypto.*;\n...\n" + - pattern-inside: "import javax.crypto.Cipher;\n...\n" - pattern-either: - pattern: Cipher.getInstance("AES") - pattern: (Cipher $CIPHER).getInstance("AES") - metadata: - functional-categories: - - crypto::search::mode::javax.crypto - cwe: - - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures - category: security - technology: - - java - references: - - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes - shortlink: https://sg.run/nzKO - semgrep.dev: - rule: - r_id: 48736 - rv_id: 1263011 - rule_id: KxUB7Z - version_id: DkTRbwy - url: https://semgrep.dev/playground/r/DkTRbwy/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes - origin: community - message: 'Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn''t provide message - confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance("AES/CBC/PKCS7PADDING"). - See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' severity: WARNING +- fix: "getSha512Digest\n" + id: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils languages: - java -- id: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils - message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use HMAC instead. - languages: - - java - severity: WARNING + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use HMAC instead. metadata: + category: security + confidence: HIGH + cwe: + - 'CWE-328: Use of Weak Hash' functional-categories: - crypto::search::hash-algorithm::org.apache.commons + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-328: Use of Weak Hash' - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5 - category: security - technology: - - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils - shortlink: https://sg.run/AWL2 semgrep.dev: rule: + origin: community r_id: 39194 - rv_id: 1263012 rule_id: BYUGK0 + rv_id: 1263012 + url: + https://semgrep.dev/playground/r/WrTqK7K/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils version_id: WrTqK7K - url: https://semgrep.dev/playground/r/WrTqK7K/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils - origin: community + shortlink: https://sg.run/AWL2 + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5 + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Insecure Hashing Algorithm patterns: - - pattern: '$DU.$GET_ALGO().digest(...) - - ' + - pattern: "$DU.$GET_ALGO().digest(...)\n" - metavariable-pattern: metavariable: $GET_ALGO pattern: getMd5Digest @@ -6215,241 +5554,230 @@ rules: metavariable: $DU pattern: DigestUtils - focus-metavariable: $GET_ALGO - fix: 'getSha512Digest - - ' -- id: java.lang.security.audit.crypto.use-of-md5.use-of-md5 - message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use HMAC instead. + severity: WARNING +- fix: "\"SHA-512\"\n" + id: java.lang.security.audit.crypto.use-of-md5.use-of-md5 languages: - java - severity: WARNING + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use HMAC instead. metadata: + category: security + confidence: HIGH + cwe: + - 'CWE-328: Use of Weak Hash' functional-categories: - crypto::search::hash-algorithm::java.security + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-328: Use of Weak Hash' - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5 - category: security - technology: - - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5 - shortlink: https://sg.run/ryJn semgrep.dev: rule: + origin: community r_id: 17325 - rv_id: 1263013 rule_id: KxU5lW - version_id: 0bTKzGX + rv_id: 1263013 url: https://semgrep.dev/playground/r/0bTKzGX/java.lang.security.audit.crypto.use-of-md5.use-of-md5 - origin: community + version_id: 0bTKzGX + shortlink: https://sg.run/ryJn + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5 + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5 + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Insecure Hashing Algorithm patterns: - - pattern: 'java.security.MessageDigest.getInstance($ALGO, ...); - - ' + - pattern: "java.security.MessageDigest.getInstance($ALGO, ...);\n" - metavariable-regex: metavariable: $ALGO regex: (?i)(.MD5.) - focus-metavariable: $ALGO - fix: '"SHA-512" - - ' + severity: WARNING - id: java.lang.security.audit.crypto.use-of-rc2.use-of-rc2 - pattern: $CIPHER.getInstance("RC2") + languages: + - java + message: 'Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. + Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions + for more information.' metadata: - functional-categories: - - crypto::search::symmetric-algorithm::javax.crypto + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::javax.crypto + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - category: security - technology: - - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2 - shortlink: https://sg.run/EEvA semgrep.dev: rule: + origin: community r_id: 48737 - rv_id: 1263014 rule_id: qNUzXG - version_id: K3TKkg0 + rv_id: 1263014 url: https://semgrep.dev/playground/r/K3TKkg0/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2 - origin: community - message: 'Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. - Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions - for more information.' + version_id: K3TKkg0 + shortlink: https://sg.run/EEvA + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2 + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cryptographic Issues + pattern: $CIPHER.getInstance("RC2") severity: WARNING +- id: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4 languages: - java -- id: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4 - pattern: $CIPHER.getInstance("RC4") + message: 'Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping + attacks. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions + for more information.' metadata: - functional-categories: - - crypto::search::symmetric-algorithm::javax.crypto + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::javax.crypto + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - category: security - technology: - - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4 - shortlink: https://sg.run/7OYR semgrep.dev: rule: + origin: community r_id: 48738 - rv_id: 1263015 rule_id: lBUw8k - version_id: qkTR7vk + rv_id: 1263015 url: https://semgrep.dev/playground/r/qkTR7vk/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4 - origin: community - message: 'Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping - attacks. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions - for more information.' + version_id: qkTR7vk + shortlink: https://sg.run/7OYR + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4 + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cryptographic Issues + pattern: $CIPHER.getInstance("RC4") severity: WARNING - languages: - - java - id: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1 - message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not - suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function - applications. languages: - java - severity: WARNING + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore + not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other + hash function applications. metadata: + asvs: + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + category: security + confidence: HIGH + cwe: + - 'CWE-328: Use of Weak Hash' functional-categories: - crypto::search::hash-algorithm::javax.crypto + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-328: Use of Weak Hash' - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1 - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.5 Insecure Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' - category: security - technology: - - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1 - shortlink: https://sg.run/bXNp semgrep.dev: rule: + origin: community r_id: 17326 - rv_id: 1263016 rule_id: qNUWNn - version_id: l4TJRpL + rv_id: 1263016 url: https://semgrep.dev/playground/r/l4TJRpL/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1 - origin: community + version_id: l4TJRpL + shortlink: https://sg.run/bXNp + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1 + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1 + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Insecure Hashing Algorithm pattern-either: - patterns: - - pattern: 'java.security.MessageDigest.getInstance("$ALGO", ...); - - ' + - pattern: "java.security.MessageDigest.getInstance(\"$ALGO\", ...);\n" - metavariable-regex: metavariable: $ALGO regex: (SHA1|SHA-1) - - pattern: '$DU.getSha1Digest().digest(...) - - ' + - pattern: "$DU.getSha1Digest().digest(...)\n" + severity: WARNING - id: java.lang.security.audit.crypto.use-of-sha224.use-of-sha224 - message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating - to a stronger hash function such as SHA-384 or higher to ensure compliance and security. languages: - java - severity: WARNING + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider + updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security. metadata: + asvs: + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + category: security + confidence: HIGH + cwe: + - 'CWE-328: Use of Weak Hash' functional-categories: - crypto::search::hash-algorithm::javax.crypto + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-328: Use of Weak Hash' - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.5 Insecure Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' - category: security - technology: - - java references: - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha224.use-of-sha224 - shortlink: https://sg.run/Ab2KQ semgrep.dev: rule: + origin: community r_id: 151750 - rv_id: 1263017 rule_id: ReUDGEz - version_id: YDTZewo + rv_id: 1263017 url: https://semgrep.dev/playground/r/YDTZewo/java.lang.security.audit.crypto.use-of-sha224.use-of-sha224 - origin: community + version_id: YDTZewo + shortlink: https://sg.run/Ab2KQ + source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha224.use-of-sha224 + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Insecure Hashing Algorithm pattern-either: - pattern: org.apache.commons.codec.digest.DigestUtils.getSha3_224Digest() - pattern: org.apache.commons.codec.digest.DigestUtils.getSha512_224Digest() @@ -6457,128 +5785,152 @@ rules: - pattern: org.apache.commons.codec.digest.DigestUtils.sha3_224Hex(...) - pattern: org.apache.commons.codec.digest.DigestUtils.sha512_224(...) - pattern: org.apache.commons.codec.digest.DigestUtils.sha512_224Hex(...) - - pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_224) - - pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_512_224) - - pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA3_224) + - pattern: new + org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_224) + - pattern: new + org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_512_224) + - pattern: new + org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA3_224) - patterns: - pattern: java.security.MessageDigest.getInstance("$ALGO", ...); - metavariable-regex: metavariable: $ALGO regex: .*224 + severity: WARNING - id: java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key - message: RSA keys should be at least 2048 bits based on NIST recommendation. languages: - java - severity: WARNING + message: RSA keys should be at least 2048 bits based on NIST recommendation. metadata: - functional-categories: - - crypto::search::key-length::java.security + asvs: + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::key-length::java.security + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_KEY_SIZE - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.5 Insecure Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms - category: security - technology: - - java - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key - shortlink: https://sg.run/4x6x semgrep.dev: rule: + origin: community r_id: 9200 - rv_id: 1263019 rule_id: 0oU5P5 - version_id: o5TbDLY + rv_id: 1263019 url: https://semgrep.dev/playground/r/o5TbDLY/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key - origin: community + version_id: o5TbDLY + shortlink: https://sg.run/4x6x + source: https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_KEY_SIZE + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: 'KeyPairGenerator $KEY = $G.getInstance("RSA"); - - ... - - $KEY.initialize($BITS); - - ' + - pattern: "KeyPairGenerator $KEY = $G.getInstance(\"RSA\");\n...\n$KEY.initialize($BITS);\n" - metavariable-comparison: - metavariable: $BITS comparison: $BITS < 2048 + metavariable: $BITS + severity: WARNING - id: java.lang.security.audit.formatted-sql-string.formatted-sql-string + languages: + - java + message: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL + statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain + a PreparedStatement using 'connection.prepareStatement'. metadata: + asvs: + control_id: 5.3.5 Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.5 Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' references: - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html - https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps - https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement - category: security - technology: - - java - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string - shortlink: https://sg.run/OPXp semgrep.dev: rule: + origin: community r_id: 9175 - rv_id: 1409389 rule_id: QrUzxR - version_id: ExTeyBP + rv_id: 1409389 url: https://semgrep.dev/playground/r/ExTeyBP/java.lang.security.audit.formatted-sql-string.formatted-sql-string - origin: community + version_id: ExTeyBP + shortlink: https://sg.run/OPXp + source: https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION + subcategory: + - vuln + technology: + - java + vulnerability_class: + - SQL Injection + mode: taint options: - taint_assume_safe_numbers: true taint_assume_safe_booleans: true - message: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement - are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement - using 'connection.prepareStatement'. - mode: taint - pattern-sources: + taint_assume_safe_numbers: true + pattern-propagators: + - from: $X + pattern: (StringBuffer $S).append($X) + to: $S + - from: $X + pattern: (StringBuilder $S).append($X) + to: $S + pattern-sanitizers: - patterns: + - pattern: (CriteriaBuilder $CB).$ANY(...) + pattern-sinks: + - patterns: + - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE *$/" ...>) + - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE %s$/" ...>) + - pattern-either: + - pattern: (Statement $S).$SQLFUNC(...) + - pattern: (PreparedStatement $P).$SQLFUNC(...) + - pattern: (Connection $C).createStatement(...).$SQLFUNC(...) + - pattern: (Connection $C).prepareStatement(...).$SQLFUNC(...) + - pattern: (EntityManager $EM).$SQLFUNC(...) + - metavariable-regex: + metavariable: $SQLFUNC + regex: execute|executeQuery|createQuery|query|addBatch|nativeSQL|create|prepare + requires: CONCAT + pattern-sources: + - label: INPUT + patterns: - pattern-either: - - pattern: '(HttpServletRequest $REQ) - - ' + - pattern: "(HttpServletRequest $REQ)\n" - patterns: - pattern-inside: "$ANNOT $FUNC (..., $INPUT, ...) {\n ...\n}\n" - pattern: (String $INPUT) - focus-metavariable: $INPUT - label: INPUT - - patterns: + - label: CONCAT + patterns: - pattern-either: - pattern: $X + $INPUT - pattern: $X += $INPUT @@ -6593,211 +5945,161 @@ rules: - metavariable-type: metavariable: $STRB type: StringBuilder - label: CONCAT requires: INPUT - pattern-propagators: - - pattern: (StringBuffer $S).append($X) - from: $X - to: $S - - pattern: (StringBuilder $S).append($X) - from: $X - to: $S - pattern-sinks: - - patterns: - - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE *$/" ...>) - - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE %s$/" ...>) - - pattern-either: - - pattern: (Statement $S).$SQLFUNC(...) - - pattern: (PreparedStatement $P).$SQLFUNC(...) - - pattern: (Connection $C).createStatement(...).$SQLFUNC(...) - - pattern: (Connection $C).prepareStatement(...).$SQLFUNC(...) - - pattern: (EntityManager $EM).$SQLFUNC(...) - - metavariable-regex: - metavariable: $SQLFUNC - regex: execute|executeQuery|createQuery|query|addBatch|nativeSQL|create|prepare - requires: CONCAT - pattern-sanitizers: - - patterns: - - pattern: (CriteriaBuilder $CB).$ANY(...) severity: ERROR +- id: java.lang.security.audit.http-response-splitting.http-response-splitting languages: - java -- id: java.lang.security.audit.http-response-splitting.http-response-splitting + message: Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request + can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your + environment is not affected by testing this yourself. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (''HTTP Request/Response Splitting'')' + - "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTP_RESPONSE_SPLITTING references: - https://www.owasp.org/index.php/HTTP_Response_Splitting - category: security - technology: - - java - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting - shortlink: https://sg.run/eL0l semgrep.dev: rule: + origin: community r_id: 9176 - rv_id: 1263023 rule_id: 3qUPyK + rv_id: 1263023 + url: + https://semgrep.dev/playground/r/X0Tzykw/java.lang.security.audit.http-response-splitting.http-response-splitting version_id: X0Tzykw - url: https://semgrep.dev/playground/r/X0Tzykw/java.lang.security.audit.http-response-splitting.http-response-splitting - origin: community - message: Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can - be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment - is not affected by testing this yourself. - severity: INFO - languages: - - java + shortlink: https://sg.run/eL0l + source: https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTP_RESPONSE_SPLITTING + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Improper Validation pattern-either: - - pattern: '$VAR = $REQ.getParameter(...); - - ... - - $COOKIE = new Cookie(..., $VAR, ...); - - ... - - $RESP.addCookie($COOKIE, ...); - - ' + - pattern: "$VAR = $REQ.getParameter(...);\n...\n$COOKIE = new Cookie(..., $VAR, ...);\n...\n$RESP.addCookie($COOKIE, ...);\n" - patterns: - pattern-inside: "$RETTYPE $FUNC(...,@PathVariable $TYPE $VAR, ...) {\n ...\n}\n" - - pattern: '$COOKIE = new Cookie(..., $VAR, ...); - - ... - - $RESP.addCookie($COOKIE, ...); - - ' + - pattern: "$COOKIE = new Cookie(..., $VAR, ...);\n...\n$RESP.addCookie($COOKIE, ...);\n" + severity: INFO - id: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection + languages: + - java + message: Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate + verification by setting 'email.setSSLCheckServerIdentity(true)'. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-297: Improper Validation of Certificate with Host Mismatch' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_SMTP_SSL - category: security - technology: - - java references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection - shortlink: https://sg.run/vzN4 semgrep.dev: rule: + origin: community r_id: 9177 - rv_id: 1263024 rule_id: 4bUkrW + rv_id: 1263024 + url: + https://semgrep.dev/playground/r/jQTn5Dv/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection version_id: jQTn5Dv - url: https://semgrep.dev/playground/r/jQTn5Dv/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection - origin: community - message: Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification - by setting 'email.setSSLCheckServerIdentity(true)'. - severity: WARNING - patterns: - - pattern-not-inside: '$EMAIL.setSSLCheckServerIdentity(true); - - ... - - ' - - pattern-inside: '$EMAIL = new SimpleEmail(...); - - ... - - ' + shortlink: https://sg.run/vzN4 + source: https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_SMTP_SSL + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Improper Authentication + patterns: + - pattern-not-inside: "$EMAIL.setSSLCheckServerIdentity(true);\n...\n" + - pattern-inside: "$EMAIL = new SimpleEmail(...);\n...\n" - pattern: $EMAIL.send(...); - languages: - - java + severity: WARNING - id: java.lang.security.audit.md5-used-as-password.md5-used-as-password languages: - java - severity: WARNING - message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked - by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use - `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1")` or, if using Spring, `org.springframework.security.crypto.bcrypt`. + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be + cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. + You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1")` or, if using + Spring, `org.springframework.security.crypto.bcrypt`. metadata: category: security - technology: - - java - - md5 + confidence: MEDIUM + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures references: - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html - https://github.com/returntocorp/semgrep-rules/issues/1609 - https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory - https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password - shortlink: https://sg.run/JxEQ semgrep.dev: rule: + origin: community r_id: 14690 - rv_id: 1263029 rule_id: JDULAW - version_id: bZT53QB + rv_id: 1263029 url: https://semgrep.dev/playground/r/bZT53QB/java.lang.security.audit.md5-used-as-password.md5-used-as-password - origin: community + version_id: bZT53QB + shortlink: https://sg.run/JxEQ + source: https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password + subcategory: + - vuln + technology: + - java + - md5 + vulnerability_class: + - Cryptographic Issues mode: taint - pattern-sources: - - patterns: - - pattern-inside: '$TYPE $MD = MessageDigest.getInstance("MD5"); - - ... - - ' - - pattern: $MD.digest(...); pattern-sinks: - patterns: - pattern: $MODEL.$METHOD(...); - metavariable-regex: metavariable: $METHOD regex: (?i)(.*password.*) -- id: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request - message: Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if - variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input - instead. + pattern-sources: + - patterns: + - pattern-inside: "$TYPE $MD = MessageDigest.getInstance(\"MD5\");\n...\n" + - pattern: $MD.digest(...); severity: WARNING +- id: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request + languages: + - java + message: Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection + if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize + user input instead. metadata: - likelihood: HIGH - impact: MEDIUM - confidence: HIGH category: security + confidence: HIGH cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -6805,6 +6107,18 @@ rules: references: - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html - https://owasp.org/www-community/attacks/SQL_Injection + semgrep.dev: + rule: + origin: community + r_id: 18239 + rule_id: oqUBJG + rv_id: 1409390 + url: + https://semgrep.dev/playground/r/7ZTKJNj/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request + version_id: 7ZTKJNj + shortlink: https://sg.run/Lg56 + source: + https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request subcategory: - vuln technology: @@ -6812,70 +6126,25 @@ rules: - java - servlets - spring - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection - source: https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request - shortlink: https://sg.run/Lg56 - semgrep.dev: - rule: - r_id: 18239 - rv_id: 1409390 - rule_id: oqUBJG - version_id: 7ZTKJNj - url: https://semgrep.dev/playground/r/7ZTKJNj/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request - origin: community - languages: - - java mode: taint options: - taint_assume_safe_numbers: true taint_assume_safe_booleans: true - pattern-sources: - - patterns: - - pattern-either: - - pattern: '(HttpServletRequest $REQ).$REQFUNC(...) - - ' - - pattern: "(ServletRequest $REQ).$REQFUNC(...) \n" - - metavariable-regex: - metavariable: $REQFUNC - regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString) + taint_assume_safe_numbers: true pattern-sinks: - patterns: - pattern-either: - pattern: "(java.sql.CallableStatement $STMT) = ...; \n" - - pattern: '(java.sql.Statement $STMT) = ...; - - ... - - $OUTPUT = $STMT.$FUNC(...); - - ' - - pattern: '(java.sql.PreparedStatement $STMT) = ...; - - ' - - pattern: '$VAR = $CONN.prepareStatement(...) - - ' - - pattern: '$PATH.queryForObject(...); - - ' - - pattern: '(java.util.Map $STMT) = $PATH.queryForMap(...); - - ' - - pattern: '(org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...; - - ' - - pattern: '(org.springframework.jdbc.core.JdbcTemplate $TEMPL).batchUpdate(...) - - ' + - pattern: "(java.sql.Statement $STMT) = ...;\n...\n$OUTPUT = $STMT.$FUNC(...);\n" + - pattern: "(java.sql.PreparedStatement $STMT) = ...;\n" + - pattern: "$VAR = $CONN.prepareStatement(...)\n" + - pattern: "$PATH.queryForObject(...);\n" + - pattern: "(java.util.Map $STMT) = $PATH.queryForMap(...);\n" + - pattern: "(org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...;\n" + - pattern: "(org.springframework.jdbc.core.JdbcTemplate $TEMPL).batchUpdate(...)\n" - patterns: - - pattern-inside: '(String $SQL) = "$SQLSTR" + ...; - - ... - - ' + - pattern-inside: "(String $SQL) = \"$SQLSTR\" + ...;\n...\n" - pattern: $PATH.$SQLCMD(..., $SQL, ...); - metavariable-regex: metavariable: $SQLSTR @@ -6883,373 +6152,340 @@ rules: - metavariable-regex: metavariable: $SQLCMD regex: (execute|query|executeUpdate|batchUpdate) -- id: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request - message: Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command - injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands - with user-supplied input, or, if you must use these commands, use a whitelist of specific values. - languages: - - java - severity: ERROR - mode: taint pattern-sources: - patterns: - pattern-either: - - pattern: '(HttpServletRequest $REQ) - - ' - - patterns: - - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie\ - \ $COOKIE: $COOKIES) {\n ...\n}\n" - - pattern: '$COOKIE.getValue(...) - - ' - pattern-sinks: - - patterns: - - pattern-either: - - pattern: '(ProcessBuilder $PB) = ...; - - ' - - patterns: - - pattern: '(Process $P) = ...; - - ' - - pattern-not: '(Process $P) = (java.lang.Runtime $R).exec(...); - - ' - - patterns: - - pattern: (java.lang.Runtime $R).exec($CMD, ...); - - focus-metavariable: $CMD - - patterns: - - pattern-either: - - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(ProcessBuilder $PB) = ...;\n...\n$PB.command($ARGLIST);\n" - - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(ProcessBuilder $PB) = ...;\n" - - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(Process $P) = ...;\n" - - pattern: '$ARGLIST.add(...); - - ' + - pattern: "(HttpServletRequest $REQ).$REQFUNC(...)\n" + - pattern: "(ServletRequest $REQ).$REQFUNC(...) \n" + - metavariable-regex: + metavariable: $REQFUNC + regex: + (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString) + severity: WARNING +- id: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request + languages: + - java + message: Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to + command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these + OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values. metadata: category: security - technology: - - java + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request - shortlink: https://sg.run/8zPN semgrep.dev: rule: + origin: community r_id: 18240 - rv_id: 1263042 rule_id: zdUWrg + rv_id: 1263042 + url: + https://semgrep.dev/playground/r/LjTkg9J/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request version_id: LjTkg9J - url: https://semgrep.dev/playground/r/LjTkg9J/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request - origin: community -- id: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request - message: Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command. Instead, call - the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({"command", - "arg1", "arg2"})`. - languages: - - java - severity: ERROR + shortlink: https://sg.run/8zPN + source: https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Command Injection mode: taint - pattern-sources: + pattern-sinks: - patterns: - pattern-either: - - pattern: '(HttpServletRequest $REQ) - - ' + - pattern: "(ProcessBuilder $PB) = ...;\n" - patterns: - - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie\ - \ $COOKIE: $COOKIES) {\n ...\n}\n" - - pattern: '$COOKIE.getValue(...) - - ' - pattern-sinks: + - pattern: "(Process $P) = ...;\n" + - pattern-not: "(Process $P) = (java.lang.Runtime $R).exec(...);\n" + - patterns: + - pattern: (java.lang.Runtime $R).exec($CMD, ...); + - focus-metavariable: $CMD + - patterns: + - pattern-either: + - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(ProcessBuilder $PB) = ...;\n...\n$PB.command($ARGLIST);\n" + - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(ProcessBuilder $PB) = ...;\n" + - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(Process $P) = ...;\n" + - pattern: "$ARGLIST.add(...);\n" + pattern-sources: - patterns: - - pattern: (java.lang.Runtime $R).exec($CMD, $ENV_ARGS, ...); - - focus-metavariable: $ENV_ARGS + - pattern-either: + - pattern: "(HttpServletRequest $REQ)\n" + - patterns: + - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie + $COOKIE: $COOKIES) {\n ...\n}\n" + - pattern: "$COOKIE.getValue(...)\n" + severity: ERROR +- id: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request + languages: + - java + message: Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command. Instead, + call the command with user-supplied arguments by using the overloaded method with one String array as the argument. + `exec({"command", "arg1", "arg2"})`. metadata: category: security - technology: - - java + confidence: MEDIUM cwe: - 'CWE-454: External Initialization of Trusted Variables or Data Stores' + cwe2021-top25: false + cwe2022-top25: false + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: false - cwe2021-top25: false - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request - shortlink: https://sg.run/EJAB semgrep.dev: rule: + origin: community r_id: 70981 - rv_id: 1409391 rule_id: nJULjy + rv_id: 1409391 + url: + https://semgrep.dev/playground/r/LjTRL6W/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request version_id: LjTRL6W - url: https://semgrep.dev/playground/r/LjTRL6W/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request - origin: community + shortlink: https://sg.run/EJAB + source: https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Other + mode: taint + pattern-sinks: + - patterns: + - pattern: (java.lang.Runtime $R).exec($CMD, $ENV_ARGS, ...); + - focus-metavariable: $ENV_ARGS + pattern-sources: + - patterns: + - pattern-either: + - pattern: "(HttpServletRequest $REQ)\n" + - patterns: + - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie + $COOKIE: $COOKIES) {\n ...\n}\n" + - pattern: "$COOKIE.getValue(...)\n" + severity: ERROR - id: java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request - message: Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input - is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed - to an LDAP query is not controllable or properly sanitize the data. + languages: + - java + message: Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the + input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. + Ensure data passed to an LDAP query is not controllable or properly sanitize the data. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (''LDAP Injection'')' + - "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection - category: security - technology: - - java - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - LDAP Injection - source: https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request - shortlink: https://sg.run/gRg0 semgrep.dev: rule: + origin: community r_id: 18241 - rv_id: 1409392 rule_id: pKUXAv + rv_id: 1409392 + url: + https://semgrep.dev/playground/r/8KT3Pe6/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request version_id: 8KT3Pe6 - url: https://semgrep.dev/playground/r/8KT3Pe6/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request - origin: community - severity: WARNING - languages: - - java + shortlink: https://sg.run/gRg0 + source: + https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request + subcategory: + - vuln + technology: + - java + vulnerability_class: + - LDAP Injection mode: taint - pattern-sources: - - patterns: - - pattern: (HttpServletRequest $REQ) pattern-sinks: - patterns: - pattern-either: - - pattern: '(javax.naming.directory.InitialDirContext $IDC).search(...) - - ' - - pattern: '(javax.naming.directory.DirContext $CTX).search(...) - - ' - - pattern-not: '(javax.naming.directory.InitialDirContext $IDC).search($Y, "...", ...) - - ' - - pattern-not: '(javax.naming.directory.DirContext $CTX).search($Y, "...", ...) - - ' + - pattern: "(javax.naming.directory.InitialDirContext $IDC).search(...)\n" + - pattern: "(javax.naming.directory.DirContext $CTX).search(...)\n" + - pattern-not: "(javax.naming.directory.InitialDirContext $IDC).search($Y, \"...\", ...)\n" + - pattern-not: "(javax.naming.directory.DirContext $CTX).search($Y, \"...\", ...)\n" + pattern-sources: + - patterns: + - pattern: (HttpServletRequest $REQ) + severity: WARNING - id: java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request - message: Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such - a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's - trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated - data. Instead, thoroughly sanitize user input before passing it into such function calls. languages: - java - severity: WARNING - mode: taint - pattern-sources: - - patterns: - - pattern-either: - - patterns: - - pattern: '(HttpServletRequest $REQ).$FUNC(...) - - ' - - pattern-not: '(HttpServletRequest $REQ).getSession() - - ' - - patterns: - - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie\ - \ $COOKIE: $COOKIES) {\n ...\n}\n" - - pattern: '$COOKIE.getValue(...) - - ' - - patterns: - - pattern-inside: '$TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(... ); - - ... - - ' - - pattern: '$PARAM = $VALS[$INDEX]; - - ' - - patterns: - - pattern-inside: '$HEADERS = (HttpServletRequest $REQ).getHeaders(...); - - ... - - $PARAM = $HEADERS.$FUNC(...); - - ... - - ' - - pattern: 'java.net.URLDecoder.decode($PARAM, ...) - - ' - pattern-sinks: - - patterns: - - pattern: (HttpServletRequest $REQ).getSession().$FUNC($NAME, $VALUE); - - metavariable-regex: - metavariable: $FUNC - regex: ^(putValue|setAttribute)$ - - focus-metavariable: $VALUE - options: - interfile: true + message: Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into + such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line + between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to + programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function + calls. metadata: category: security - technology: - - java + confidence: MEDIUM cwe: - 'CWE-501: Trust Boundary Violation' + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design references: - https://owasp.org/Top10/A04_2021-Insecure_Design - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request - shortlink: https://sg.run/QbDZ semgrep.dev: rule: + origin: community r_id: 18242 - rv_id: 1409393 rule_id: 2ZU7Eo + rv_id: 1409393 + url: + https://semgrep.dev/playground/r/gETrv9j/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request version_id: gETrv9j - url: https://semgrep.dev/playground/r/gETrv9j/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request - origin: community -- id: java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request - message: Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath - injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could - lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use - parameterized xpath queries if you can. - languages: - - java - severity: WARNING + shortlink: https://sg.run/QbDZ + source: + https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Other mode: taint - pattern-sources: - - patterns: - - pattern: '(HttpServletRequest $REQ).$FUNC(...) - - ' + options: + interfile: true pattern-sinks: + - patterns: + - pattern: (HttpServletRequest $REQ).getSession().$FUNC($NAME, $VALUE); + - metavariable-regex: + metavariable: $FUNC + regex: ^(putValue|setAttribute)$ + - focus-metavariable: $VALUE + pattern-sources: - patterns: - pattern-either: - - pattern: '(javax.xml.xpath.XPath $XP).evaluate(...) - - ' - - pattern: '(javax.xml.xpath.XPath $XP).compile(...).evaluate(...) - - ' + - patterns: + - pattern: "(HttpServletRequest $REQ).$FUNC(...)\n" + - pattern-not: "(HttpServletRequest $REQ).getSession()\n" + - patterns: + - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie + $COOKIE: $COOKIES) {\n ...\n}\n" + - pattern: "$COOKIE.getValue(...)\n" + - patterns: + - pattern-inside: "$TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(... );\n...\n" + - pattern: "$PARAM = $VALS[$INDEX];\n" + - patterns: + - pattern-inside: "$HEADERS = (HttpServletRequest $REQ).getHeaders(...);\n...\n$PARAM = $HEADERS.$FUNC(...);\n...\n" + - pattern: "java.net.URLDecoder.decode($PARAM, ...)\n" + severity: WARNING +- id: java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request + languages: + - java + message: Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to + xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath + injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize + user input or use parameterized xpath queries if you can. metadata: category: security - technology: - - java + confidence: MEDIUM cwe: - - 'CWE-643: Improper Neutralization of Data within XPath Expressions (''XPath Injection'')' + - "CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XPath Injection - source: https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request - shortlink: https://sg.run/3BvK semgrep.dev: rule: + origin: community r_id: 18243 - rv_id: 1409394 rule_id: X5U5nj + rv_id: 1409394 + url: + https://semgrep.dev/playground/r/QkTERKP/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request version_id: QkTERKP - url: https://semgrep.dev/playground/r/QkTERKP/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request - origin: community + shortlink: https://sg.run/3BvK + source: + https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request + subcategory: + - vuln + technology: + - java + vulnerability_class: + - XPath Injection + mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "(javax.xml.xpath.XPath $XP).evaluate(...)\n" + - pattern: "(javax.xml.xpath.XPath $XP).compile(...).evaluate(...)\n" + pattern-sources: + - patterns: + - pattern: "(HttpServletRequest $REQ).$FUNC(...)\n" + severity: WARNING - id: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect - message: Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could - direct users to malicious locations. Consider using an allowlist to validate URLs. + languages: + - java + message: Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This + could direct users to malicious locations. Consider using an allowlist to validate URLs. metadata: - cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.1.5 Open Redirect - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' category: security - technology: - - java - references: - - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - impact: LOW - likelihood: MEDIUM confidence: MEDIUM + cwe: + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" + impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect - shortlink: https://sg.run/Q51P + likelihood: MEDIUM + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control semgrep.dev: rule: + origin: community r_id: 9186 - rv_id: 1263048 rule_id: WAUo0p - version_id: PkTR329 + rv_id: 1263048 url: https://semgrep.dev/playground/r/PkTR329/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect - origin: community - severity: WARNING - languages: - - java + version_id: PkTR329 + shortlink: https://sg.run/Q51P + source: https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Open Redirect pattern-either: - pattern: "$X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {\n ...\n $RES.sendRedirect($URL);\n ...\n}\n" - pattern: "$X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {\n ...\n $RES.sendRedirect($URL);\n ...\n}\n" @@ -7277,132 +6513,97 @@ rules: ,$REQ.getParameter(...));\n ...\n}\n" - pattern: "$X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {\n ...\n $RES.addHeader(\"Location\"\ ,$REQ.getParameter(...));\n ...\n}" -- id: java.lang.security.audit.weak-ssl-context.weak-ssl-context + severity: WARNING +- fix-regex: + regex: (.*?)\.getInstance\(.*?\) + replacement: \1.getInstance("TLSv1.2") + id: java.lang.security.audit.weak-ssl-context.weak-ssl-context + languages: + - java + message: An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak + encryption and are deprecated. Use SSLContext.getInstance("TLSv1.2") for the best security. metadata: + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source_rule_url: https://find-sec-bugs.github.io/bugs.htm#SSL_CONTEXT references: - https://tools.ietf.org/html/rfc7568 - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html - category: security - technology: - - java - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context - shortlink: https://sg.run/4x7E semgrep.dev: rule: + origin: community r_id: 9188 - rv_id: 1263050 rule_id: KxUb1k - version_id: 5PTo1rW + rv_id: 1263050 url: https://semgrep.dev/playground/r/5PTo1rW/java.lang.security.audit.weak-ssl-context.weak-ssl-context - origin: community - message: An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption - and are deprecated. Use SSLContext.getInstance("TLSv1.2") for the best security. - severity: WARNING - languages: - - java + version_id: 5PTo1rW + shortlink: https://sg.run/4x7E + source: https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context + source_rule_url: https://find-sec-bugs.github.io/bugs.htm#SSL_CONTEXT + subcategory: + - audit + technology: + - java + vulnerability_class: + - Cryptographic Issues patterns: - pattern-not: SSLContext.getInstance("TLSv1.3") - pattern-not: SSLContext.getInstance("TLSv1.2") - pattern: SSLContext.getInstance("...") - fix-regex: - regex: (.*?)\.getInstance\(.*?\) - replacement: \1.getInstance("TLSv1.2") -- id: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer - message: Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view - or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. - Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views. severity: WARNING - options: - interfile: true +- id: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer + languages: + - java + message: Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any + view or template environments, including HTML escaping, which may expose this application to cross-site scripting + (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes + HTML views. metadata: - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" cwe2021-top25: true cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html + semgrep.dev: + rule: + origin: community + r_id: 9211 + rule_id: j2Uv7B + rv_id: 1263055 + url: + https://semgrep.dev/playground/r/DkTRbXy/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer + version_id: DkTRbXy + shortlink: https://sg.run/KlRL + source: https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer subcategory: - vuln technology: - java - servlets - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer - shortlink: https://sg.run/KlRL - semgrep.dev: - rule: - r_id: 9211 - rv_id: 1263055 - rule_id: j2Uv7B - version_id: DkTRbXy - url: https://semgrep.dev/playground/r/DkTRbXy/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer - origin: community - languages: - - java mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: '(HttpServletRequest $REQ).$REQFUNC(...) - - ' - - pattern: "(ServletRequest $REQ).$REQFUNC(...) \n" - - metavariable-regex: - metavariable: $REQFUNC - regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString) - pattern-sinks: - - patterns: - - pattern-either: - - pattern: '(HttpServletResponse $RESPONSE).getWriter(...).$WRITE(...) - - ' - - pattern: '(HttpServletResponse $RESPONSE).getOutputStream(...).$WRITE(...) - - ' - - pattern: '(java.io.PrintWriter $WRITER).$WRITE(...) - - ' - - pattern: '(PrintWriter $WRITER).$WRITE(...) - - ' - - pattern: '(javax.servlet.ServletOutputStream $WRITER).$WRITE(...) - - ' - - pattern: '(ServletOutputStream $WRITER).$WRITE(...) - - ' - - pattern: '(java.io.OutputStream $WRITER).$WRITE(...) - - ' - - pattern: '(OutputStream $WRITER).$WRITE(...) - - ' + options: + interfile: true pattern-sanitizers: - pattern-either: - pattern: Encode.forHtml(...) @@ -7412,54 +6613,81 @@ rules: - pattern: org.apache.commons.lang.StringEscapeUtils.escapeHtml(...) - pattern: org.springframework.web.util.HtmlUtils.htmlEscape(...) - pattern: org.owasp.esapi.ESAPI.encoder().encodeForHTML(...) -- id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false - severity: ERROR + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "(HttpServletResponse $RESPONSE).getWriter(...).$WRITE(...)\n" + - pattern: "(HttpServletResponse $RESPONSE).getOutputStream(...).$WRITE(...)\n" + - pattern: "(java.io.PrintWriter $WRITER).$WRITE(...)\n" + - pattern: "(PrintWriter $WRITER).$WRITE(...)\n" + - pattern: "(javax.servlet.ServletOutputStream $WRITER).$WRITE(...)\n" + - pattern: "(ServletOutputStream $WRITER).$WRITE(...)\n" + - pattern: "(java.io.OutputStream $WRITER).$WRITE(...)\n" + - pattern: "(OutputStream $WRITER).$WRITE(...)\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern: "(HttpServletRequest $REQ).$REQFUNC(...)\n" + - pattern: "(ServletRequest $REQ).$REQFUNC(...) \n" + - metavariable-regex: + metavariable: $REQFUNC + regex: + (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString) + severity: WARNING +- id: + java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false + languages: + - java + message: DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is + vulnerable to XML external entity attacks. Disable this by setting the feature + "http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively, allow DOCTYPE declarations and only + prohibit external entities declarations. This can be done by setting the features + "http://xml.org/sax/features/external-general-entities" and + "http://xml.org/sax/features/external-parameter-entities" to false. metadata: + asvs: + control_id: 5.5.2 Insecue XML Deserialization + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - asvs: - section: V5 Validation, Sanitization and Encoding - control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention - version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - https://xerces.apache.org/xerces2-j/features.html - category: security - technology: - - java - - xml - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false - shortlink: https://sg.run/4Dv5 semgrep.dev: rule: + origin: community r_id: 18244 - rv_id: 1263057 rule_id: j2UrJ8 + rv_id: 1263057 + url: + https://semgrep.dev/playground/r/0bTKzgX/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false version_id: 0bTKzgX - url: https://semgrep.dev/playground/r/0bTKzgX/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false - origin: community - message: DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable - to XML external entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" - to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done - by setting the features "http://xml.org/sax/features/external-general-entities" and "http://xml.org/sax/features/external-parameter-entities" - to false. + shortlink: https://sg.run/4Dv5 + source: + https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false + subcategory: + - vuln + technology: + - java + - xml + vulnerability_class: + - XML Injection patterns: - pattern: $DBFACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false); - pattern-not-inside: "$RETURNTYPE $METHOD(...){\n ...\n $DBF.setFeature(\"http://xml.org/sax/features/external-general-entities\"\ @@ -7470,100 +6698,72 @@ rules: \ ...\n $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\");\n ...\n}\n" - pattern-not-inside: "$RETURNTYPE $METHOD(...){\n ...\n $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\");\n\ \ ...\n $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n ...\n}\n" + severity: ERROR +- fix: "$FACTORY.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n$FACTORY.newDocumentBuilder();\n" + id: + java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing languages: - java -- id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing - severity: ERROR + message: DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity + attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" to true. + Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by + setting the features "http://xml.org/sax/features/external-general-entities" and + "http://xml.org/sax/features/external-parameter-entities" to false. metadata: + asvs: + control_id: 5.5.2 Insecue XML Deserialization + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - asvs: - section: V5 Validation, Sanitization and Encoding - control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention - version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - https://xerces.apache.org/xerces2-j/features.html - category: security - technology: - - java - - xml - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing - shortlink: https://sg.run/PYBz semgrep.dev: rule: + origin: community r_id: 18245 - rv_id: 1263058 rule_id: 10UPQB + rv_id: 1263058 + url: + https://semgrep.dev/playground/r/K3TKk80/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing version_id: K3TKk80 - url: https://semgrep.dev/playground/r/K3TKk80/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing - origin: community - message: DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. - Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively, allow - DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities" - and "http://xml.org/sax/features/external-parameter-entities" to false. - mode: taint - pattern-sources: - - by-side-effect: true - patterns: - - pattern-either: - - pattern: '$FACTORY = DocumentBuilderFactory.newInstance(); - - ' - - patterns: - - pattern: $FACTORY - - pattern-inside: "class $C {\n ...\n $V $FACTORY = DocumentBuilderFactory.newInstance();\n ...\n}\n" - - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = DocumentBuilderFactory.newInstance();\n static {\n ...\n\ - \ $FACTORY.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n ...\n }\n ...\n\ - }\n" - - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = DocumentBuilderFactory.newInstance();\n static {\n ...\n\ - \ $FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n $FACTORY.setFeature(\"\ - http://xml.org/sax/features/external-general-entities\", false);\n ...\n }\n ...\n}\n" - - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = DocumentBuilderFactory.newInstance();\n static {\n ...\n\ - \ $FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n ...\n $FACTORY.setFeature(\"\ - http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n }\n ...\n}\n" - pattern-sinks: - - patterns: - - pattern: $FACTORY.newDocumentBuilder(); + shortlink: https://sg.run/PYBz + source: + https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing + subcategory: + - vuln + technology: + - java + - xml + vulnerability_class: + - XML Injection + mode: taint pattern-sanitizers: - by-side-effect: true pattern-either: - patterns: - pattern-either: - - pattern: '$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - - ' - - pattern: '$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); - - ... - - $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); - - ' - - pattern: '$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); - - ... - - $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); - - ' + - pattern: "$FACTORY.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n" + - pattern: "$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n...\n$FACTORY.setFeature(\"\ + http://xml.org/sax/features/external-parameter-entities\", false);\n" + - pattern: "$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n...\n$FACTORY.setFeature(\"\ + http://xml.org/sax/features/external-general-entities\", false);\n" - focus-metavariable: $FACTORY - patterns: - pattern-either: @@ -7577,203 +6777,198 @@ rules: \ ...\n }\n ...\n}\n" - pattern: $M($X) - focus-metavariable: $X - fix: '$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - - $FACTORY.newDocumentBuilder(); - - ' + pattern-sinks: + - patterns: + - pattern: $FACTORY.newDocumentBuilder(); + pattern-sources: + - by-side-effect: true + patterns: + - pattern-either: + - pattern: "$FACTORY = DocumentBuilderFactory.newInstance();\n" + - patterns: + - pattern: $FACTORY + - pattern-inside: "class $C {\n ...\n $V $FACTORY = DocumentBuilderFactory.newInstance();\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = DocumentBuilderFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n ...\n }\n ...\n\ + }\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = DocumentBuilderFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n $FACTORY.setFeature(\"\ + http://xml.org/sax/features/external-general-entities\", false);\n ...\n }\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = DocumentBuilderFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n ...\n $FACTORY.setFeature(\"\ + http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n }\n ...\n}\n" + severity: ERROR +- fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); + id: + java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true languages: - java -- id: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true - severity: ERROR + message: External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this + by setting the feature "http://xml.org/sax/features/external-general-entities" to false. metadata: + asvs: + control_id: 5.5.2 Insecue XML Deserialization + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - asvs: - section: V5 Validation, Sanitization and Encoding - control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention - version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - category: security - technology: - - java - - xml - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true - shortlink: https://sg.run/JgPy semgrep.dev: rule: + origin: community r_id: 18246 - rv_id: 1263059 rule_id: 9AUJ6r + rv_id: 1263059 + url: + https://semgrep.dev/playground/r/qkTR7Lk/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true version_id: qkTR7Lk - url: https://semgrep.dev/playground/r/qkTR7Lk/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true - origin: community - message: External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by - setting the feature "http://xml.org/sax/features/external-general-entities" to false. + shortlink: https://sg.run/JgPy + source: + https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true + subcategory: + - vuln + technology: + - java + - xml + vulnerability_class: + - XML Injection pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities", true); - fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); + severity: ERROR +- fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + id: + java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true languages: - java -- id: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true - severity: ERROR + message: External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this + by setting the feature "http://xml.org/sax/features/external-parameter-entities" to false. metadata: + asvs: + control_id: 5.5.2 Insecue XML Deserialization + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - asvs: - section: V5 Validation, Sanitization and Encoding - control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention - version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - category: security - technology: - - java - - xml - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true - shortlink: https://sg.run/5Lv0 semgrep.dev: rule: + origin: community r_id: 18247 - rv_id: 1263060 rule_id: yyUNeo + rv_id: 1263060 + url: + https://semgrep.dev/playground/r/l4TJRoL/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true version_id: l4TJRoL - url: https://semgrep.dev/playground/r/l4TJRoL/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true - origin: community - message: External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by - setting the feature "http://xml.org/sax/features/external-parameter-entities" to false. + shortlink: https://sg.run/5Lv0 + source: + https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true + subcategory: + - vuln + technology: + - java + - xml + vulnerability_class: + - XML Injection pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", true); - fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + severity: ERROR +- fix: "$FACTORY.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n$FACTORY.newSAXParser();\n" + id: + java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing languages: - java -- id: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing - severity: ERROR + message: DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity + attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. + Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by + setting the features `http://xml.org/sax/features/external-general-entities` and + `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be + clicked. They are the literal config key values that are supposed to be used to disable these features. For more + information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory. metadata: + asvs: + control_id: 5.5.2 Insecue XML Deserialization + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - asvs: - section: V5 Validation, Sanitization and Encoding - control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention - version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - https://xerces.apache.org/xerces2-j/features.html - category: security - technology: - - java - - xml - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing - shortlink: https://sg.run/Gj32 semgrep.dev: rule: + origin: community r_id: 59048 - rv_id: 1263061 rule_id: j2Udpk + rv_id: 1263061 + url: + https://semgrep.dev/playground/r/YDTZeko/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing version_id: YDTZeko - url: https://semgrep.dev/playground/r/YDTZeko/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing - origin: community - message: DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. - Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow - DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` - and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be - clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, - see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory. + shortlink: https://sg.run/Gj32 + source: + https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing + subcategory: + - vuln + technology: + - java + - xml + vulnerability_class: + - XML Injection mode: taint - pattern-sources: - - by-side-effect: true - patterns: - - pattern-either: - - pattern: '$FACTORY = SAXParserFactory.newInstance(); - - ' - - patterns: - - pattern: $FACTORY - - pattern-inside: "class $C {\n ...\n $V $FACTORY = SAXParserFactory.newInstance();\n ...\n}\n" - - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = SAXParserFactory.newInstance();\n static {\n ...\n \ - \ $FACTORY.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n ...\n }\n ...\n\ - }\n" - - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = SAXParserFactory.newInstance();\n static {\n ...\n \ - \ $FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n $FACTORY.setFeature(\"\ - http://xml.org/sax/features/external-general-entities\", false);\n ...\n }\n ...\n}\n" - - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = SAXParserFactory.newInstance();\n static {\n ...\n \ - \ $FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n ...\n $FACTORY.setFeature(\"\ - http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n }\n ...\n}\n" - pattern-sinks: - - patterns: - - pattern: $FACTORY.newSAXParser(); pattern-sanitizers: - by-side-effect: true pattern-either: - patterns: - pattern-either: - - pattern: '$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - - ' - - pattern: '$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); - - ... - - $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); - - ' - - pattern: '$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); - - ... - - $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); - - ' + - pattern: "$FACTORY.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n" + - pattern: "$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n...\n$FACTORY.setFeature(\"\ + http://xml.org/sax/features/external-parameter-entities\", false);\n" + - pattern: "$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n...\n$FACTORY.setFeature(\"\ + http://xml.org/sax/features/external-general-entities\", false);\n" - focus-metavariable: $FACTORY - patterns: - pattern-either: @@ -7787,121 +6982,100 @@ rules: \ ...\n }\n ...\n}\n" - pattern: $M($X) - focus-metavariable: $X - fix: '$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - - $FACTORY.newSAXParser(); - - ' + pattern-sinks: + - patterns: + - pattern: $FACTORY.newSAXParser(); + pattern-sources: + - by-side-effect: true + patterns: + - pattern-either: + - pattern: "$FACTORY = SAXParserFactory.newInstance();\n" + - patterns: + - pattern: $FACTORY + - pattern-inside: "class $C {\n ...\n $V $FACTORY = SAXParserFactory.newInstance();\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = SAXParserFactory.newInstance();\n static {\n ...\n \ + \ $FACTORY.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n ...\n }\n ...\n\ + }\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = SAXParserFactory.newInstance();\n static {\n ...\n \ + \ $FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n $FACTORY.setFeature(\"\ + http://xml.org/sax/features/external-general-entities\", false);\n ...\n }\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = SAXParserFactory.newInstance();\n static {\n ...\n \ + \ $FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n ...\n $FACTORY.setFeature(\"\ + http://xml.org/sax/features/external-parameter-entities\", false);\n ...\n }\n ...\n}\n" + severity: ERROR +- fix: "$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"); $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, + \"\");\n$FACTORY.newTransformer(...);\n" + id: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled languages: - java -- id: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled - severity: ERROR + message: DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity + attacks. Disable this by setting the attributes "accessExternalDTD" and "accessExternalStylesheet" to "". metadata: + asvs: + control_id: 5.5.2 Insecue XML Deserialization + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - asvs: - section: V5 Validation, Sanitization and Encoding - control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention - version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - https://xerces.apache.org/xerces2-j/features.html - category: security - technology: - - java - - xml - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled - shortlink: https://sg.run/1wyQ semgrep.dev: rule: + origin: community r_id: 59622 - rv_id: 1263062 rule_id: v8UeQ1 + rv_id: 1263062 + url: + https://semgrep.dev/playground/r/6xT29GK/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled version_id: 6xT29GK - url: https://semgrep.dev/playground/r/6xT29GK/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled - origin: community - message: DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. - Disable this by setting the attributes "accessExternalDTD" and "accessExternalStylesheet" to "". + shortlink: https://sg.run/1wyQ + source: + https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled + subcategory: + - vuln + technology: + - java + - xml + vulnerability_class: + - XML Injection mode: taint - pattern-sources: - - by-side-effect: true - patterns: - - pattern-either: - - pattern: '$FACTORY = TransformerFactory.newInstance(); - - ' - - patterns: - - pattern: $FACTORY - - pattern-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n ...\n}\n" - - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n static {\n ...\n\ - \ $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET,\ - \ \"\");\n ...\n }\n ...\n}\n" - - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n static {\n ...\n\ - \ $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, \"\");\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD,\ - \ \"\");\n ...\n }\n ...\n}\n" - - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n static {\n ...\n\ - \ $FACTORY.setAttribute(\"=~/.*accessExternalDTD.*/\", \"\");\n ...\n $FACTORY.setAttribute(\"=~/.*accessExternalStylesheet.*/\"\ - , \"\");\n ...\n }\n ...\n}\n" - - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n static {\n ...\n\ - \ $FACTORY.setAttribute(\"=~/.*accessExternalStylesheet.*/\", \"\");\n ...\n $FACTORY.setAttribute(\"\ - =~/.*accessExternalDTD.*/\", \"\");\n ...\n }\n ...\n}\n" - pattern-sinks: - - patterns: - - pattern: $FACTORY.newTransformer(...); - pattern-sanitizers: + pattern-sanitizers: - by-side-effect: true pattern-either: - patterns: - pattern-either: - - pattern: '$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ... - - $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); - - ' - - pattern: '$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); - - ... - - $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); - - ' - - pattern: '$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ... - - $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); - - ' - - pattern: '$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); - - ... - - $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); - - ' + - pattern: "$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, \"\"); ...\n$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, + \"\");\n" + - pattern: "$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n...\n$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, + \"\");\n" + - pattern: "$FACTORY.setAttribute(\"=~/.*accessExternalStylesheet.*/\", \"\"); ...\n$FACTORY.setAttribute(\"=~/.*accessExternalDTD.*/\"\ + , \"\");\n" + - pattern: "$FACTORY.setAttribute(\"=~/.*accessExternalDTD.*/\", \"\");\n...\n$FACTORY.setAttribute(\"=~/.*accessExternalStylesheet.*/\"\ + , \"\");\n" - focus-metavariable: $FACTORY - patterns: - pattern-either: - - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET,\ - \ \"\");\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n ...\n }\n ...\n}\n" - - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD,\ - \ \"\");\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, \"\");\n ...\n }\n \ - \ ...\n}\n" + - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, + \"\");\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n ...\n }\n ...\n}\n" + - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, + \"\");\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, \"\");\n ...\n }\n ...\n\ + }\n" - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setAttribute(\"=~/.*accessExternalStylesheet.*/\"\ , \"\");\n ...\n $FACTORY.setAttribute(\"=~/.*accessExternalDTD.*/\", \"\");\n ...\n }\n ...\n}\n" - pattern-inside: "class $C {\n ...\n $T $M(...) {\n ...\n $FACTORY.setAttribute(\"=~/.*accessExternalDTD.*/\"\ @@ -7909,186 +7083,162 @@ rules: }\n" - pattern: $M($X) - focus-metavariable: $X - fix: '$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, - ""); - - $FACTORY.newTransformer(...); - - ' + pattern-sinks: + - patterns: + - pattern: $FACTORY.newTransformer(...); + pattern-sources: + - by-side-effect: true + patterns: + - pattern-either: + - pattern: "$FACTORY = TransformerFactory.newInstance();\n" + - patterns: + - pattern: $FACTORY + - pattern-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, + \"\");\n ...\n }\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, \"\");\n ...\n $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, + \"\");\n ...\n }\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setAttribute(\"=~/.*accessExternalDTD.*/\", \"\");\n ...\n $FACTORY.setAttribute(\"=~/.*accessExternalStylesheet.*/\"\ + , \"\");\n ...\n }\n ...\n}\n" + - pattern-not-inside: "class $C {\n ...\n $V $FACTORY = TransformerFactory.newInstance();\n static {\n ...\n\ + \ $FACTORY.setAttribute(\"=~/.*accessExternalStylesheet.*/\", \"\");\n ...\n $FACTORY.setAttribute(\"\ + =~/.*accessExternalDTD.*/\", \"\");\n ...\n }\n ...\n}\n" + severity: ERROR +- id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal languages: - java -- id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal + message: Detected a potential path traversal. A malicious actor could control the location of this file, to include + going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths + are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) + to only retrieve the file name from the path. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN references: - https://www.owasp.org/index.php/Path_Traversal - category: security - technology: - - java - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal - shortlink: https://sg.run/oxXN semgrep.dev: rule: + origin: community r_id: 9160 - rv_id: 1263064 rule_id: NbUk7X + rv_id: 1263064 + url: + https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal version_id: zyTb2rq - url: https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal - origin: community - message: Detected a potential path traversal. A malicious actor could control the location of this file, to include going - backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. - You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve - the file name from the path. + shortlink: https://sg.run/oxXN + source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Path Traversal mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: '(HttpServletRequest $REQ) - - ' - - patterns: - - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie\ - \ $COOKIE: $COOKIES) {\n ...\n}\n" - - pattern: '$COOKIE.getValue(...) - - ' - - patterns: - - pattern-inside: '$TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...); - - ... - - ' - - pattern: '$PARAM = $VALS[$INDEX]; - - ' pattern-sanitizers: - pattern: org.apache.commons.io.FilenameUtils.getName(...) pattern-sinks: - patterns: - pattern-either: - - pattern: '(java.io.File $FILE) = ... - - ' - - pattern: '(java.io.FileOutputStream $FOS) = ... - - ' - - pattern: 'new java.io.FileInputStream(...) - - ' + - pattern: "(java.io.File $FILE) = ...\n" + - pattern: "(java.io.FileOutputStream $FOS) = ...\n" + - pattern: "new java.io.FileInputStream(...)\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern: "(HttpServletRequest $REQ)\n" + - patterns: + - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie + $COOKIE: $COOKIES) {\n ...\n}\n" + - pattern: "$COOKIE.getValue(...)\n" + - patterns: + - pattern-inside: "$TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...);\n...\n" + - pattern: "$PARAM = $VALS[$INDEX];\n" severity: ERROR - languages: - - java - id: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization - severity: WARNING languages: - java + message: JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when + ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker + could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application + listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received + inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method. metadata: + asvs: + control_id: 5.5.3 Insecue Deserialization + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding + version: '4' + category: security + confidence: MEDIUM cwe: - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - asvs: - section: V5 Validation, Sanitization and Encoding - control_id: 5.5.3 Insecue Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention - version: '4' references: - https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf - category: security - technology: - - java - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization - shortlink: https://sg.run/zvO1 semgrep.dev: rule: + origin: community r_id: 9161 - rv_id: 1263065 rule_id: kxUk12 + rv_id: 1263065 + url: + https://semgrep.dev/playground/r/pZT03A1/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization version_id: pZT03A1 - url: https://semgrep.dev/playground/r/pZT03A1/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization - origin: community - message: JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() - is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage - to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the - JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code - execution when calling the $Y.getObject method. + shortlink: https://sg.run/zvO1 + source: https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization + subcategory: + - vuln + technology: + - java + vulnerability_class: + - 'Insecure Deserialization ' patterns: - - pattern-inside: "public class $JMS_LISTENER implements MessageListener {\n ...\n public void onMessage(Message $JMS_MSG)\ - \ {\n ...\n }\n}\n" + - pattern-inside: "public class $JMS_LISTENER implements MessageListener {\n ...\n public void onMessage(Message $JMS_MSG) + {\n ...\n }\n}\n" - pattern-either: - pattern-inside: $X = $Y.getObject(...); - pattern-inside: $X = ($Z) $Y.getObject(...); + severity: WARNING - id: java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization - patterns: - - pattern-either: - - patterns: - - pattern-inside: 'ObjectMapper $OM = new ObjectMapper(...); - - ... - - ' - - pattern-inside: '$OM.enableDefaultTyping(); - - ... - - ' - - pattern: $OM.readValue($JSON, ...); - - patterns: - - pattern-inside: "class $CLASS {\n ...\n @JsonTypeInfo(use = Id.CLASS,...)\n $TYPE $VAR;\n ...\n}\n" - - metavariable-regex: - metavariable: $TYPE - regex: (Object|Serializable|Comparable) - - pattern: $OM.readValue($JSON, $CLASS.class); - - patterns: - - pattern-inside: "class $CLASS {\n ...\n ObjectMapper $OM;\n ...\n $INITMETHODTYPE $INITMETHOD(...) {\n ...\n\ - \ $OM = new ObjectMapper();\n ...\n $OM.enableDefaultTyping();\n ...\n }\n ...\n}\n" - - pattern-inside: "$METHODTYPE $METHOD(...) {\n ... \n}\n" - - pattern: $OM.readValue($JSON, ...); - message: When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead - to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit - unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using "Per-class" - annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes - for Jackson based deserialization. languages: - java - severity: WARNING + message: When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can + lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used + to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by + using "Per-class" annotations) and avoid using `Object` and other dangerous types for member variable declaration + which creating classes for Jackson based deserialization. metadata: category: security - subcategory: - - audit + confidence: MEDIUM cwe: - 'CWE-502: Deserialization of Untrusted Data' - confidence: MEDIUM - likelihood: LOW impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A8:2017 Insecure Deserialization - A8:2021 Software and Data Integrity Failures @@ -8096,147 +7246,164 @@ rules: - https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038 - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/ - technology: - - jackson - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization - shortlink: https://sg.run/GDop semgrep.dev: rule: + origin: community r_id: 56948 - rv_id: 945724 rule_id: QrUD20 + rv_id: 945724 + url: + https://semgrep.dev/playground/r/2KTYbA9/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization version_id: 2KTYbA9 - url: https://semgrep.dev/playground/r/2KTYbA9/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization - origin: community + shortlink: https://sg.run/GDop + source: https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization + subcategory: + - audit + technology: + - jackson + vulnerability_class: + - 'Insecure Deserialization ' + patterns: + - pattern-either: + - patterns: + - pattern-inside: "ObjectMapper $OM = new ObjectMapper(...);\n...\n" + - pattern-inside: "$OM.enableDefaultTyping();\n...\n" + - pattern: $OM.readValue($JSON, ...); + - patterns: + - pattern-inside: "class $CLASS {\n ...\n @JsonTypeInfo(use = Id.CLASS,...)\n $TYPE $VAR;\n ...\n}\n" + - metavariable-regex: + metavariable: $TYPE + regex: (Object|Serializable|Comparable) + - pattern: $OM.readValue($JSON, $CLASS.class); + - patterns: + - pattern-inside: "class $CLASS {\n ...\n ObjectMapper $OM;\n ...\n $INITMETHODTYPE $INITMETHOD(...) {\n ...\n\ + \ $OM = new ObjectMapper();\n ...\n $OM.enableDefaultTyping();\n ...\n }\n ...\n}\n" + - pattern-inside: "$METHODTYPE $METHOD(...) {\n ... \n}\n" + - pattern: $OM.readValue($JSON, ...); + severity: WARNING - id: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss - message: 'Cross-site scripting detected in HttpServletResponse writer with variable ''$VAR''. User input was detected going + languages: + - java + message: "Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: - ''Encode.forHtml($VAR)''.' + 'Encode.forHtml($VAR)'." metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET - category: security - technology: - - java references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss - shortlink: https://sg.run/pxjN semgrep.dev: rule: + origin: community r_id: 9162 - rv_id: 1263066 rule_id: wdUJOk + rv_id: 1263066 + url: + https://semgrep.dev/playground/r/2KTv2EG/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss version_id: 2KTv2EG - url: https://semgrep.dev/playground/r/2KTv2EG/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss - origin: community - severity: ERROR + shortlink: https://sg.run/pxjN + source: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cross-Site-Scripting (XSS) patterns: - pattern-inside: $TYPE $FUNC(..., HttpServletResponse $RESP, ...) { ... } - pattern-inside: $VAR = $REQ.getParameter(...); ... - pattern-either: - pattern: $RESP.getWriter(...).write(..., $VAR, ...); - - pattern: '$WRITER = $RESP.getWriter(...); - - ... - - $WRITER.write(..., $VAR, ...); - - ' + - pattern: "$WRITER = $RESP.getWriter(...);\n...\n$WRITER.write(..., $VAR, ...);\n" + severity: ERROR +- id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe languages: - java -- id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe - severity: WARNING + message: XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML + external entity vulnerabilities. Explicitly disable external entities by setting + "javax.xml.stream.isSupportingExternalEntities" to false. metadata: + asvs: + control_id: 5.5.2 Insecue XML Deserialization + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding + version: '4' + category: security + confidence: MEDIUM cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - asvs: - section: V5 Validation, Sanitization and Encoding - control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention - version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser - category: security - technology: - - java - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe - shortlink: https://sg.run/XBwA semgrep.dev: rule: + origin: community r_id: 9164 - rv_id: 1263069 rule_id: OrU35O + rv_id: 1263069 + url: + https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe version_id: 1QTypQZ - url: https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe - origin: community - message: XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external - entity vulnerabilities. Explicitly disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" - to false. + shortlink: https://sg.run/XBwA + source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe + subcategory: + - vuln + technology: + - java + vulnerability_class: + - XML Injection patterns: - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(\"javax.xml.stream.isSupportingExternalEntities\"\ , false);\n ...\n}\n" - - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES,\ - \ false);\n ...\n}\n" + - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, + false);\n ...\n}\n" - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(\"javax.xml.stream.isSupportingExternalEntities\"\ , Boolean.FALSE);\n ...\n}\n" - - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES,\ - \ Boolean.FALSE);\n ...\n}\n" + - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, + Boolean.FALSE);\n ...\n}\n" - pattern-either: - pattern: javax.xml.stream.XMLInputFactory.newFactory(...) - pattern: new XMLInputFactory(...) - languages: - - java -- id: java.spring.security.audit.spring-actuator-fully-enabled-yaml.spring-actuator-fully-enabled-yaml - patterns: - - pattern-inside: "management:\n ...\n endpoints:\n ...\n web:\n ...\n exposure:\n ...\n" - - pattern: 'include: "*" - - ' - message: Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, - /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this - functionality is available without authentication, causing a severe security risk. severity: WARNING +- id: java.spring.security.audit.spring-actuator-fully-enabled-yaml.spring-actuator-fully-enabled-yaml languages: - yaml + message: Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, + /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to + protect these endpoints, this functionality is available without authentication, causing a severe security risk. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + cwe2021-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control @@ -8244,42 +7411,44 @@ rules: - https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints - https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785 - https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators - category: security - technology: - - spring - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled-yaml.spring-actuator-fully-enabled-yaml - shortlink: https://sg.run/1Bzw semgrep.dev: rule: + origin: community r_id: 29422 - rv_id: 1263076 rule_id: eqUerQ + rv_id: 1263076 + url: + https://semgrep.dev/playground/r/w8TRo5n/java.spring.security.audit.spring-actuator-fully-enabled-yaml.spring-actuator-fully-enabled-yaml version_id: w8TRo5n - url: https://semgrep.dev/playground/r/w8TRo5n/java.spring.security.audit.spring-actuator-fully-enabled-yaml.spring-actuator-fully-enabled-yaml - origin: community + shortlink: https://sg.run/1Bzw + source: + https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled-yaml.spring-actuator-fully-enabled-yaml + subcategory: + - vuln + technology: + - spring + vulnerability_class: + - Mishandled Sensitive Information + patterns: + - pattern-inside: "management:\n ...\n endpoints:\n ...\n web:\n ...\n exposure:\n ...\n" + - pattern: "include: \"*\"\n" + severity: WARNING - id: java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled - pattern: management.endpoints.web.exposure.include=* - message: Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, - /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this - functionality is available without authentication, causing a significant security risk. - severity: ERROR languages: - generic - paths: - include: - - '*properties' + message: Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, + /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to + protect these endpoints, this functionality is available without authentication, causing a significant security + risk. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + cwe2021-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control @@ -8287,46 +7456,43 @@ rules: - https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints - https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785 - https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators - category: security - technology: - - spring - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled - shortlink: https://sg.run/L0vY semgrep.dev: rule: + origin: community r_id: 10439 - rv_id: 1263077 rule_id: EwU4vg + rv_id: 1263077 + url: + https://semgrep.dev/playground/r/xyTjzwp/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled version_id: xyTjzwp - url: https://semgrep.dev/playground/r/xyTjzwp/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled - origin: community -- id: java.spring.security.audit.spring-actuator-non-health-enabled-yaml.spring-actuator-dangerous-endpoints-enabled-yaml - patterns: - - pattern-inside: "management:\n ...\n endpoints:\n ...\n web:\n ...\n exposure:\n ...\n \ - \ include:\n ...\n" - - pattern: 'include: [..., $ACTUATOR, ...] - - ' - - metavariable-comparison: - metavariable: $ACTUATOR - comparison: not str($ACTUATOR) in ["health","*"] - message: Spring Boot Actuator "$ACTUATOR" is enabled. Depending on the actuator, this can pose a significant security risk. - Please double-check if the actuator is needed and properly secured. - severity: WARNING + shortlink: https://sg.run/L0vY + source: https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled + subcategory: + - vuln + technology: + - spring + vulnerability_class: + - Mishandled Sensitive Information + paths: + include: + - '*properties' + pattern: management.endpoints.web.exposure.include=* + severity: ERROR +- id: + java.spring.security.audit.spring-actuator-non-health-enabled-yaml.spring-actuator-dangerous-endpoints-enabled-yaml languages: - yaml + message: Spring Boot Actuator "$ACTUATOR" is enabled. Depending on the actuator, this can pose a significant security + risk. Please double-check if the actuator is needed and properly secured. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + cwe2021-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control @@ -8334,44 +7500,46 @@ rules: - https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints - https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785 - https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators - category: security - technology: - - spring - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/java.spring.security.audit.spring-actuator-non-health-enabled-yaml.spring-actuator-dangerous-endpoints-enabled-yaml - shortlink: https://sg.run/JzKQ semgrep.dev: rule: + origin: community r_id: 32290 - rv_id: 1263078 rule_id: kxUWpX + rv_id: 1263078 + url: + https://semgrep.dev/playground/r/O9TpxBp/java.spring.security.audit.spring-actuator-non-health-enabled-yaml.spring-actuator-dangerous-endpoints-enabled-yaml version_id: O9TpxBp - url: https://semgrep.dev/playground/r/O9TpxBp/java.spring.security.audit.spring-actuator-non-health-enabled-yaml.spring-actuator-dangerous-endpoints-enabled-yaml - origin: community -- id: java.spring.security.audit.spring-actuator-non-health-enabled.spring-actuator-dangerous-endpoints-enabled + shortlink: https://sg.run/JzKQ + source: + https://semgrep.dev/r/java.spring.security.audit.spring-actuator-non-health-enabled-yaml.spring-actuator-dangerous-endpoints-enabled-yaml + subcategory: + - vuln + technology: + - spring + vulnerability_class: + - Mishandled Sensitive Information patterns: - - pattern: management.endpoints.web.exposure.include=$...ACTUATORS + - pattern-inside: "management:\n ...\n endpoints:\n ...\n web:\n ...\n exposure:\n ...\n \ + \ include:\n ...\n" + - pattern: "include: [..., $ACTUATOR, ...]\n" - metavariable-comparison: - metavariable: $...ACTUATORS - comparison: not str($...ACTUATORS) in ["health","*"] - message: Spring Boot Actuators "$...ACTUATORS" are enabled. Depending on the actuators, this can pose a significant security - risk. Please double-check if the actuators are needed and properly secured. + comparison: not str($ACTUATOR) in ["health","*"] + metavariable: $ACTUATOR severity: WARNING +- id: java.spring.security.audit.spring-actuator-non-health-enabled.spring-actuator-dangerous-endpoints-enabled languages: - generic - options: - generic_ellipsis_max_span: 0 + message: Spring Boot Actuators "$...ACTUATORS" are enabled. Depending on the actuators, this can pose a significant + security risk. Please double-check if the actuators are needed and properly secured. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + cwe2021-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control @@ -8379,148 +7547,139 @@ rules: - https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints - https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785 - https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators - category: security - technology: - - spring - cwe2021-top25: true + semgrep.dev: + rule: + origin: community + r_id: 32291 + rule_id: wdUWrZ + rv_id: 1263079 + url: + https://semgrep.dev/playground/r/e1Tyjqe/java.spring.security.audit.spring-actuator-non-health-enabled.spring-actuator-dangerous-endpoints-enabled + version_id: e1Tyjqe + shortlink: https://sg.run/5g23 + source: + https://semgrep.dev/r/java.spring.security.audit.spring-actuator-non-health-enabled.spring-actuator-dangerous-endpoints-enabled subcategory: - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - spring vulnerability_class: - Mishandled Sensitive Information - source: https://semgrep.dev/r/java.spring.security.audit.spring-actuator-non-health-enabled.spring-actuator-dangerous-endpoints-enabled - shortlink: https://sg.run/5g23 + options: + generic_ellipsis_max_span: 0 + patterns: + - pattern: management.endpoints.web.exposure.include=$...ACTUATORS + - metavariable-comparison: + comparison: not str($...ACTUATORS) in ["health","*"] + metavariable: $...ACTUATORS + severity: WARNING +- id: java.spring.security.audit.spring-sqli.spring-sqli + languages: + - java + message: Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL + injection if variables in the SQL statement are not properly sanitized. Use a prepared statements + (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection semgrep.dev: rule: - r_id: 32291 - rv_id: 1263079 - rule_id: wdUWrZ - version_id: e1Tyjqe - url: https://semgrep.dev/playground/r/e1Tyjqe/java.spring.security.audit.spring-actuator-non-health-enabled.spring-actuator-dangerous-endpoints-enabled origin: community -- id: java.spring.security.audit.spring-sqli.spring-sqli + r_id: 9222 + rule_id: eqU8N2 + rv_id: 1263082 + url: https://semgrep.dev/playground/r/ZRTKAWW/java.spring.security.audit.spring-sqli.spring-sqli + version_id: ZRTKAWW + shortlink: https://sg.run/1Z3x + source: https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli + subcategory: + - vuln + technology: + - spring + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - patterns: - - pattern: $ARG - - pattern-inside: 'public $T $M (..., String $ARG,...){...} - - ' + options: + taint_assume_safe_booleans: true + taint_assume_safe_numbers: true pattern-sanitizers: - not_conflicting: true pattern-either: - patterns: - focus-metavariable: $A - - pattern-inside: 'new $TYPE(...,$A,...); - - ' + - pattern-inside: "new $TYPE(...,$A,...);\n" pattern-sinks: - patterns: - pattern-either: - patterns: - focus-metavariable: $A - - pattern: 'new PreparedStatementCreatorFactory($A,...); - - ' + - pattern: "new PreparedStatementCreatorFactory($A,...);\n" - patterns: - focus-metavariable: $A - - pattern: '(JdbcTemplate $T).$M($A,...) - - ' + - pattern: "(JdbcTemplate $T).$M($A,...)\n" - patterns: - pattern: (String $A) - - pattern-inside: '(JdbcTemplate $T).batchUpdate(...) - - ' + - pattern-inside: "(JdbcTemplate $T).batchUpdate(...)\n" - patterns: - focus-metavariable: $A - - pattern: 'NamedParameterBatchUpdateUtils.$M($A,...) - - ' + - pattern: "NamedParameterBatchUpdateUtils.$M($A,...)\n" - patterns: - focus-metavariable: $A - - pattern: 'BatchUpdateUtils.$M($A,...) - - ' - message: Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection - if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. - You can obtain a PreparedStatement using 'connection.prepareStatement'. + - pattern: "BatchUpdateUtils.$M($A,...)\n" + pattern-sources: + - patterns: + - pattern: $ARG + - pattern-inside: "public $T $M (..., String $ARG,...){...}\n" + severity: WARNING +- id: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect languages: - java - severity: WARNING - options: - taint_assume_safe_numbers: true - taint_assume_safe_booleans: true + message: Application redirects a user to a destination URL specified by a user supplied parameter that is not + validated. metadata: - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' category: security - technology: - - spring - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM confidence: MEDIUM + cwe: + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" + impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli - shortlink: https://sg.run/1Z3x - semgrep.dev: - rule: - r_id: 9222 - rv_id: 1263082 - rule_id: eqU8N2 - version_id: ZRTKAWW - url: https://semgrep.dev/playground/r/ZRTKAWW/java.spring.security.audit.spring-sqli.spring-sqli - origin: community -- id: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect - message: Application redirects a user to a destination URL specified by a user supplied parameter that is not validated. - metadata: - cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT - category: security - technology: - - spring references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect - shortlink: https://sg.run/9oXz semgrep.dev: rule: + origin: community r_id: 9223 - rv_id: 1263083 rule_id: v8Un7w + rv_id: 1263083 + url: + https://semgrep.dev/playground/r/nWT2Lk0/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect version_id: nWT2Lk0 - url: https://semgrep.dev/playground/r/nWT2Lk0/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect - origin: community - severity: WARNING - languages: - - java + shortlink: https://sg.run/9oXz + source: https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT + subcategory: + - vuln + technology: + - spring + vulnerability_class: + - Open Redirect pattern-either: - pattern: "$X $METHOD(...,String $URL,...) {\n return \"redirect:\" + $URL;\n}\n" - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n String $REDIR = \"redirect:\" + $URL;\n ...\n return $REDIR;\n\ @@ -8528,60 +7687,50 @@ rules: - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n new ModelAndView(\"redirect:\" + $URL);\n ...\n}\n" - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n String $REDIR = \"redirect:\" + $URL;\n ...\n new ModelAndView($REDIR);\n\ \ ...\n}" + severity: WARNING - id: java.spring.security.injection.tainted-file-path.tainted-file-path languages: - java - severity: ERROR - message: Detected user input controlling a file path. An attacker could control the location of this file, to include going - backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. - You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve - the file name from the path. - options: - interfile: true + message: Detected user input controlling a file path. An attacker could control the location of this file, to include + going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths + are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) + to only retrieve the file name from the path. metadata: + category: security + confidence: HIGH cwe: - 'CWE-23: Relative Path Traversal' + impact: HIGH + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Path_Traversal - category: security - technology: - - java - - spring - subcategory: - - vuln - impact: HIGH - likelihood: MEDIUM - confidence: HIGH - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path - shortlink: https://sg.run/x9o0 semgrep.dev: rule: + origin: community r_id: 22074 - rv_id: 1263084 rule_id: lBUxok - version_id: ExTEx6Y + rv_id: 1263084 url: https://semgrep.dev/playground/r/ExTEx6Y/java.spring.security.injection.tainted-file-path.tainted-file-path - origin: community + version_id: ExTEx6Y + shortlink: https://sg.run/x9o0 + source: https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path + subcategory: + - vuln + technology: + - java + - spring + vulnerability_class: + - Path Traversal mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {\n ...\n}\n" - - pattern-inside: "$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {\n ...\n}\n" - - metavariable-regex: - metavariable: $TYPE - regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) - - metavariable-regex: - metavariable: $REQ - regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) - - focus-metavariable: $SOURCE + options: + interfile: true + pattern-sanitizers: + - pattern: org.apache.commons.io.FilenameUtils.getName(...) pattern-sinks: - patterns: - pattern-either: @@ -8593,9 +7742,7 @@ rules: - pattern: new java.io.FileInputStream(...) - pattern: (Paths $PATHS).get(...) - patterns: - - pattern: '$CLASS.$FUNC(...) - - ' + - pattern: "$CLASS.$FUNC(...)\n" - metavariable-regex: metavariable: $FUNC regex: ^(getResourceAsStream|getResource)$ @@ -8609,50 +7756,87 @@ rules: - pattern: new javax.xml.transform.StreamSource($FILE, ...) - pattern: FileUtils.openOutputStream($FILE, ...) - focus-metavariable: $FILE - pattern-sanitizers: - - pattern: org.apache.commons.io.FilenameUtils.getName(...) + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {\n ...\n}\n" + - pattern-inside: "$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {\n ...\n}\n" + - metavariable-regex: + metavariable: $TYPE + regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) + - metavariable-regex: + metavariable: $REQ + regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) + - focus-metavariable: $SOURCE + severity: ERROR - id: java.spring.security.injection.tainted-html-string.tainted-html-string languages: - java - severity: ERROR - message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods - of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could - let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use - the OWASP ESAPI encoder if you must render user data. + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure + methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, + which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered + safely. You can use the OWASP ESAPI encoder if you must render user data. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html - category: security - technology: - - java - - spring - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string - shortlink: https://sg.run/ObdR semgrep.dev: rule: + origin: community r_id: 22075 - rv_id: 1409395 rule_id: YGUvkL + rv_id: 1409395 + url: + https://semgrep.dev/playground/r/3ZT2598/java.spring.security.injection.tainted-html-string.tainted-html-string version_id: 3ZT2598 - url: https://semgrep.dev/playground/r/3ZT2598/java.spring.security.injection.tainted-html-string.tainted-html-string - origin: community + shortlink: https://sg.run/ObdR + source: https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string + subcategory: + - vuln + technology: + - java + - spring + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint + pattern-propagators: + - from: $...TAINTED + pattern: (StringBuilder $SB).append($...TAINTED) + to: $SB + - from: $...TAINTED + pattern: $VAR += $...TAINTED + to: $VAR + pattern-sanitizers: + - pattern-either: + - pattern: Encode.forHtml(...) + - pattern: (PolicyFactory $POLICY).sanitize(...) + - pattern: (AntiSamy $AS).scan(...) + - pattern: JSoup.clean(...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: new ResponseEntity<>($PAYLOAD, ...) + - pattern: new ResponseEntity<$ERROR>($PAYLOAD, ...) + - pattern: ResponseEntity. ... .body($PAYLOAD) + - patterns: + - pattern: "ResponseEntity.$RESPFUNC($PAYLOAD). ...\n" + - metavariable-regex: + metavariable: $RESPFUNC + regex: ^(ok|of)$ + - focus-metavariable: $PAYLOAD + requires: CONCAT pattern-sources: - label: INPUT patterns: @@ -8666,158 +7850,87 @@ rules: metavariable: $REQ regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) - focus-metavariable: $SOURCE - - label: CONCAT - by-side-effect: true - requires: INPUT + - by-side-effect: true + label: CONCAT patterns: - pattern-either: - - pattern: '"$HTMLSTR" + ... - - ' - - pattern: '"$HTMLSTR".concat(...) - - ' + - pattern: "\"$HTMLSTR\" + ...\n" + - pattern: "\"$HTMLSTR\".concat(...)\n" - patterns: - - pattern-inside: 'StringBuilder $SB = new StringBuilder("$HTMLSTR"); - - ... - - ' + - pattern-inside: "StringBuilder $SB = new StringBuilder(\"$HTMLSTR\");\n...\n" - pattern: $SB.append(...) - patterns: - - pattern-inside: '$VAR = "$HTMLSTR"; - - ... - - ' + - pattern-inside: "$VAR = \"$HTMLSTR\";\n...\n" - pattern: $VAR += ... - pattern: String.format("$HTMLSTR", ...) - patterns: - - pattern-inside: 'String $VAR = "$HTMLSTR"; - - ... - - ' + - pattern-inside: "String $VAR = \"$HTMLSTR\";\n...\n" - pattern: String.format($VAR, ...) - metavariable-regex: metavariable: $HTMLSTR regex: ^<\w+ - pattern-propagators: - - pattern: (StringBuilder $SB).append($...TAINTED) - from: $...TAINTED - to: $SB - - pattern: $VAR += $...TAINTED - from: $...TAINTED - to: $VAR - pattern-sinks: - - requires: CONCAT - patterns: - - pattern-either: - - pattern: new ResponseEntity<>($PAYLOAD, ...) - - pattern: new ResponseEntity<$ERROR>($PAYLOAD, ...) - - pattern: ResponseEntity. ... .body($PAYLOAD) - - patterns: - - pattern: 'ResponseEntity.$RESPFUNC($PAYLOAD). ... - - ' - - metavariable-regex: - metavariable: $RESPFUNC - regex: ^(ok|of)$ - - focus-metavariable: $PAYLOAD - pattern-sanitizers: - - pattern-either: - - pattern: Encode.forHtml(...) - - pattern: (PolicyFactory $POLICY).sanitize(...) - - pattern: (AntiSamy $AS).scan(...) - - pattern: JSoup.clean(...) + requires: INPUT + severity: ERROR - id: java.spring.security.injection.tainted-sql-string.tainted-sql-string languages: - java - severity: ERROR - message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using - prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of - SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements - (`connection.PreparedStatement`) or a safe library. + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings + using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible + indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use + prepared statements (`connection.PreparedStatement`) or a safe library. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html - category: security - technology: - - spring - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/9rzz semgrep.dev: rule: + origin: community r_id: 14767 - rv_id: 1409396 rule_id: 10UdRR + rv_id: 1409396 + url: + https://semgrep.dev/playground/r/44TbKvr/java.spring.security.injection.tainted-sql-string.tainted-sql-string version_id: 44TbKvr - url: https://semgrep.dev/playground/r/44TbKvr/java.spring.security.injection.tainted-sql-string.tainted-sql-string - origin: community + shortlink: https://sg.run/9rzz + source: https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - spring + vulnerability_class: + - SQL Injection + mode: taint options: - taint_assume_safe_numbers: true - taint_assume_safe_booleans: true interfile: true - mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {\n ...\n}\n" - - pattern-inside: "$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {\n ...\n}\n" - - metavariable-regex: - metavariable: $REQ - regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue) - - metavariable-regex: - metavariable: $TYPE - regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) - - focus-metavariable: $SOURCE + taint_assume_safe_booleans: true + taint_assume_safe_numbers: true pattern-sinks: - patterns: - pattern-either: - - pattern: '"$SQLSTR" + ... - - ' - - pattern: '"$SQLSTR".concat(...) - - ' + - pattern: "\"$SQLSTR\" + ...\n" + - pattern: "\"$SQLSTR\".concat(...)\n" - patterns: - - pattern-inside: 'StringBuilder $SB = new StringBuilder("$SQLSTR"); - - ... - - ' + - pattern-inside: "StringBuilder $SB = new StringBuilder(\"$SQLSTR\");\n...\n" - pattern: $SB.append(...) - patterns: - - pattern-inside: '$VAR = "$SQLSTR"; - - ... - - ' + - pattern-inside: "$VAR = \"$SQLSTR\";\n...\n" - pattern: $VAR += ... - pattern: String.format("$SQLSTR", ...) - patterns: - - pattern-inside: 'String $VAR = "$SQLSTR"; - - ... - - ' + - pattern-inside: "String $VAR = \"$SQLSTR\";\n...\n" - pattern: String.format($VAR, ...) - pattern-not-inside: System.out.println(...) - pattern-not-inside: $LOG.info(...) @@ -8831,259 +7944,257 @@ rules: - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop)\b -- id: java.spring.security.injection.tainted-system-command.tainted-system-command - languages: - - java - severity: ERROR - mode: taint - pattern-propagators: - - pattern: (StringBuilder $STRB).append($INPUT) - from: $INPUT - to: $STRB - label: CONCAT - requires: INPUT pattern-sources: - patterns: - pattern-either: - pattern-inside: "$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {\n ...\n}\n" - pattern-inside: "$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {\n ...\n}\n" + - metavariable-regex: + metavariable: $REQ + regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue) - metavariable-regex: metavariable: $TYPE regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) - - metavariable-regex: - metavariable: $REQ - regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) - focus-metavariable: $SOURCE - label: INPUT - - patterns: - - pattern-either: - - pattern: $X + $SOURCE - - pattern: $SOURCE + $Y - - pattern: String.format("...", ..., $SOURCE, ...) - - pattern: String.join("...", ..., $SOURCE, ...) - - pattern: (String $STR).concat($SOURCE) - - pattern: $SOURCE.concat(...) - - pattern: $X += $SOURCE - - pattern: $SOURCE += $X + severity: ERROR +- id: java.spring.security.injection.tainted-system-command.tainted-system-command + languages: + - java + message: "Detected user input entering a method which executes a system command. This could result in a command injection + vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download + malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, + like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual + command so that attackers can't run arbitrary commands." + metadata: + category: security + confidence: HIGH + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://www.stackhawk.com/blog/command-injection-java/ + - https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html + - https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java + semgrep.dev: + rule: + origin: community + r_id: 22076 + rule_id: 6JUxGN + rv_id: 1263087 + url: + https://semgrep.dev/playground/r/8KT5rnP/java.spring.security.injection.tainted-system-command.tainted-system-command + version_id: 8KT5rnP + shortlink: https://sg.run/epY0 + source: https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command + subcategory: + - vuln + technology: + - java + - spring + vulnerability_class: + - Command Injection + mode: taint + pattern-propagators: + - from: $INPUT label: CONCAT + pattern: (StringBuilder $STRB).append($INPUT) requires: INPUT + to: $STRB pattern-sinks: - patterns: - pattern-either: - - pattern: '(Process $P) = new Process(...); - - ' - - pattern: '(ProcessBuilder $PB).command(...); - - ' + - pattern: "(Process $P) = new Process(...);\n" + - pattern: "(ProcessBuilder $PB).command(...);\n" - patterns: - pattern-either: - - pattern: '(Runtime $R).$EXEC(...); - - ' - - pattern: 'Runtime.getRuntime(...).$EXEC(...); - - ' + - pattern: "(Runtime $R).$EXEC(...);\n" + - pattern: "Runtime.getRuntime(...).$EXEC(...);\n" - metavariable-regex: metavariable: $EXEC regex: (exec|loadLibrary|load) - patterns: - - pattern: '(ProcessBuilder $PB).command(...).$ADD(...); - - ' + - pattern: "(ProcessBuilder $PB).command(...).$ADD(...);\n" - metavariable-regex: metavariable: $ADD regex: (add|addAll) - patterns: - pattern-either: - patterns: - - pattern-inside: '$BUILDER = new ProcessBuilder(...); - - ... - - ' + - pattern-inside: "$BUILDER = new ProcessBuilder(...);\n...\n" - pattern: $BUILDER.start(...) - - pattern: 'new ProcessBuilder(...). ... .start(...); - - ' + - pattern: "new ProcessBuilder(...). ... .start(...);\n" requires: CONCAT - message: 'Detected user input entering a method which executes a system command. This could result in a command injection - vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download - malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, - like this: `new ProcessBuilder("ls", "-al", targetDirectory)`. Further, make sure you hardcode or allowlist the actual - command so that attackers can''t run arbitrary commands.' - metadata: - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - category: security - technology: - - java - - spring - confidence: HIGH - references: - - https://www.stackhawk.com/blog/command-injection-java/ - - https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html - - https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command - shortlink: https://sg.run/epY0 - semgrep.dev: - rule: - r_id: 22076 - rv_id: 1263087 - rule_id: 6JUxGN - version_id: 8KT5rnP - url: https://semgrep.dev/playground/r/8KT5rnP/java.spring.security.injection.tainted-system-command.tainted-system-command - origin: community + pattern-sources: + - label: INPUT + patterns: + - pattern-either: + - pattern-inside: "$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {\n ...\n}\n" + - pattern-inside: "$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {\n ...\n}\n" + - metavariable-regex: + metavariable: $TYPE + regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) + - metavariable-regex: + metavariable: $REQ + regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) + - focus-metavariable: $SOURCE + - label: CONCAT + patterns: + - pattern-either: + - pattern: $X + $SOURCE + - pattern: $SOURCE + $Y + - pattern: String.format("...", ..., $SOURCE, ...) + - pattern: String.join("...", ..., $SOURCE, ...) + - pattern: (String $STR).concat($SOURCE) + - pattern: $SOURCE.concat(...) + - pattern: $X += $SOURCE + - pattern: $SOURCE += $X + requires: INPUT + severity: ERROR - id: java.spring.security.injection.tainted-url-host.tainted-url-host languages: - java - severity: ERROR - message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data - to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. - They could also probe internal servers or other resources that the server running this code can access. (This is called - server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, - hardcode the correct host, or ensure that the user data can only affect the path or parameters. - options: - interfile: true + message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send + data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with + this request. They could also probe internal servers or other resources that the server running this code can + access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an + allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or + parameters. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html - category: security - technology: - - java - - spring - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - interfile: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host - shortlink: https://sg.run/vkYn semgrep.dev: rule: + origin: community r_id: 22077 - rv_id: 1263088 rule_id: oqUZo8 - version_id: gETB708 + rv_id: 1263088 url: https://semgrep.dev/playground/r/gETB708/java.spring.security.injection.tainted-url-host.tainted-url-host - origin: community + version_id: gETB708 + shortlink: https://sg.run/vkYn + source: https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host + subcategory: + - vuln + technology: + - java + - spring + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {\n ...\n}\n" - - pattern-inside: "$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {\n ...\n}\n" - - metavariable-regex: - metavariable: $TYPE - regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) - - metavariable-regex: - metavariable: $REQ - regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) - - focus-metavariable: $SOURCE + options: + interfile: true pattern-sinks: - pattern-either: - pattern: new URL($ONEARG) - patterns: - pattern-either: - - pattern: '"$URLSTR" + ... - - ' - - pattern: '"$URLSTR".concat(...) - - ' + - pattern: "\"$URLSTR\" + ...\n" + - pattern: "\"$URLSTR\".concat(...)\n" - patterns: - - pattern-inside: 'StringBuilder $SB = new StringBuilder("$URLSTR"); - - ... - - ' + - pattern-inside: "StringBuilder $SB = new StringBuilder(\"$URLSTR\");\n...\n" - pattern: $SB.append(...) - patterns: - - pattern-inside: '$VAR = "$URLSTR"; - - ... - - ' + - pattern-inside: "$VAR = \"$URLSTR\";\n...\n" - pattern: $VAR += ... - patterns: - pattern: String.format("$URLSTR", ...) - pattern-not: String.format("$URLSTR", "...", ...) - patterns: - - pattern-inside: 'String $VAR = "$URLSTR"; - - ... - - ' + - pattern-inside: "String $VAR = \"$URLSTR\";\n...\n" - pattern: String.format($VAR, ...) - metavariable-regex: metavariable: $URLSTR regex: http(s?)://%(v|s|q).* + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {\n ...\n}\n" + - pattern-inside: "$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {\n ...\n}\n" + - metavariable-regex: + metavariable: $TYPE + regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) + - metavariable-regex: + metavariable: $REQ + regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) + - focus-metavariable: $SOURCE + severity: ERROR - id: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint - message: Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It - is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved - it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize. + languages: + - javascript + - typescript + message: Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. + It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be + preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize. metadata: + category: security confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - references: - - https://docs.angularjs.org/api/ng/function/angular.element - - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf - category: security - technology: - - angularjs + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint - shortlink: https://sg.run/5AQ0 + references: + - https://docs.angularjs.org/api/ng/function/angular.element + - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf semgrep.dev: rule: + origin: community r_id: 21503 - rv_id: 1263091 rule_id: GdUP71 + rv_id: 1263091 + url: + https://semgrep.dev/playground/r/44TEj8L/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint version_id: 44TEj8L - url: https://semgrep.dev/playground/r/44TEj8L/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/5AQ0 + source: https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint + subcategory: + - vuln + technology: + - angularjs + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern: $sce.getTrustedHtml(...) + - pattern: $sanitize(...) + - pattern: DOMPurify.sanitize(...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "angular.element(...). ... .$SINK($QUERY)\n" + - pattern-inside: "$ANGULAR = angular.element(...)\n...\n$ANGULAR. ... .$SINK($QUERY)\n" + - metavariable-regex: + metavariable: $SINK + regex: ^(after|append|html|prepend|replaceWith|wrap)$ + - focus-metavariable: $QUERY pattern-sources: - patterns: - pattern-either: @@ -9116,248 +8227,193 @@ rules: metavariable: $METHOD regex: ^(get|delete|head|jsonp|post|put|patch) - pattern: $RES.data - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: 'angular.element(...). ... .$SINK($QUERY) - - ' - - pattern-inside: '$ANGULAR = angular.element(...) - - ... - - $ANGULAR. ... .$SINK($QUERY) - - ' - - metavariable-regex: - metavariable: $SINK - regex: ^(after|append|html|prepend|replaceWith|wrap)$ - - focus-metavariable: $QUERY - pattern-sanitizers: - - patterns: - - pattern-either: - - pattern: $sce.getTrustedHtml(...) - - pattern: $sanitize(...) - - pattern: DOMPurify.sanitize(...) + severity: WARNING - id: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled - message: $sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide - additional attack surface for XSS vulnerabilities. + languages: + - javascript + - typescript + message: $sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could + provide additional attack surface for XSS vulnerabilities. metadata: - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - references: - - https://docs.angularjs.org/api/ng/service/$sce - - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf category: security - technology: - - angular + confidence: HIGH + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled - shortlink: https://sg.run/N4DG + references: + - https://docs.angularjs.org/api/ng/service/$sce + - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf semgrep.dev: rule: + origin: community r_id: 9227 - rv_id: 1263094 rule_id: EwU20Z + rv_id: 1263094 + url: + https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled version_id: 5PTo1EW - url: https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled - origin: community + shortlink: https://sg.run/N4DG + source: https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled + subcategory: + - vuln + technology: + - angular + vulnerability_class: + - Cross-Site-Scripting (XSS) + pattern: "$sceProvider.enabled(false);\n" + severity: ERROR +- id: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method languages: - javascript - typescript - severity: ERROR - pattern: '$sceProvider.enabled(false); - - ' -- id: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method message: The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API. metadata: - references: - - https://docs.angularjs.org/api/ng/service/$sce - - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - technology: - - angular + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method - shortlink: https://sg.run/OPW2 + references: + - https://docs.angularjs.org/api/ng/service/$sce + - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf semgrep.dev: rule: + origin: community r_id: 9231 - rv_id: 1263098 rule_id: gxU1QX + rv_id: 1263098 + url: + https://semgrep.dev/playground/r/BjTkZv0/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method version_id: BjTkZv0 - url: https://semgrep.dev/playground/r/BjTkZv0/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/OPW2 + source: + https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method + subcategory: + - vuln + technology: + - angular + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-inside: 'app.controller(..., function($scope,$sce) { - - ... - - }); - - ' - - pattern: $scope.$X pattern-sinks: - pattern: $sce.trustAs(...) - pattern: $sce.trustAsHtml(...) + pattern-sources: + - patterns: + - pattern-inside: "app.controller(..., function($scope,$sce) {\n...\n});\n" + - pattern: $scope.$X + severity: WARNING - id: javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config - message: Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee - an adversary has no direct access to the computing environment. + languages: + - javascript + - typescript + message: Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can + guarantee an adversary has no direct access to the computing environment. metadata: - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html - - https://eprint.iacr.org/2016/759.pdf - - https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf - - https://datatracker.ietf.org/doc/html/rfc9106#section-4 category: security + confidence: MEDIUM cwe: - 'CWE-916: Use of Password Hash With Insufficient Computational Effort' - technology: - - argon2 - - cryptography + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - impact: LOW - likelihood: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config - shortlink: https://sg.run/ALq4 + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html + - https://eprint.iacr.org/2016/759.pdf + - https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf + - https://datatracker.ietf.org/doc/html/rfc9106#section-4 semgrep.dev: rule: + origin: community r_id: 20150 - rv_id: 1263103 rule_id: DbU2X8 + rv_id: 1263103 + url: + https://semgrep.dev/playground/r/qkTR7Jk/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config version_id: qkTR7Jk - url: https://semgrep.dev/playground/r/qkTR7Jk/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/ALq4 + source: https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config + subcategory: + - vuln + technology: + - argon2 + - cryptography + vulnerability_class: + - Insecure Hashing Algorithm mode: taint - pattern-sources: + pattern-sanitizers: - patterns: - - pattern-inside: '$ARGON = require(''argon2''); - - ... - - ' - - pattern: '{type: ...} - - ' + - pattern: '{type: $ARGON.argon2id}' pattern-sinks: - patterns: - - pattern: '$Y - - ' - - pattern-inside: '$ARGON.hash(...,$Y) - - ' - pattern-sanitizers: + - pattern: "$Y\n" + - pattern-inside: "$ARGON.hash(...,$Y)\n" + pattern-sources: - patterns: - - pattern: '{type: $ARGON.argon2id}' + - pattern-inside: "$ARGON = require('argon2');\n...\n" + - pattern: "{type: ...}\n" + severity: WARNING - id: javascript.aws-lambda.security.detect-child-process.detect-child-process - message: Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command - injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let - running arbitrary commands, use a white list for inputs. + languages: + - javascript + - typescript + message: Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a + command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then + do not let running arbitrary commands, use a white list for inputs. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - javascript - - aws-lambda - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process - shortlink: https://sg.run/Ggoq semgrep.dev: rule: + origin: community r_id: 18248 - rv_id: 1263105 rule_id: r6UDNQ + rv_id: 1263105 + url: + https://semgrep.dev/playground/r/YDTZe4o/javascript.aws-lambda.security.detect-child-process.detect-child-process version_id: YDTZe4o - url: https://semgrep.dev/playground/r/YDTZe4o/javascript.aws-lambda.security.detect-child-process.detect-child-process - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/Ggoq + source: https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process + subcategory: + - vuln + technology: + - javascript + - aws-lambda + vulnerability_class: + - Command Injection mode: taint - pattern-sources: - - patterns: - - pattern: $EVENT - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' pattern-sinks: - patterns: - focus-metavariable: $CMD @@ -9371,171 +8427,121 @@ rules: - pattern: $CP.spawn($CMD,...) - pattern: $CP.spawnSync($CMD,...) - pattern-either: - - pattern-inside: 'require(''child_process'') - - ... - - ' - - pattern-inside: 'import ''child_process'' - - ... - - ' + - pattern-inside: "require('child_process')\n...\n" + - pattern-inside: "import 'child_process'\n...\n" + pattern-sources: + - patterns: + - pattern: $EVENT + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + severity: ERROR - id: javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object - message: Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable - is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly - to DynamoDB client. + languages: + - javascript + - typescript + message: Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the + variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from + `$EVENT` directly to DynamoDB client. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-943: Improper Neutralization of Special Elements in Data Query Logic' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - category: security - technology: - - javascript - - aws-lambda - - dynamodb - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object - shortlink: https://sg.run/X1e4 semgrep.dev: rule: + origin: community r_id: 21320 - rv_id: 945766 rule_id: 0oU1xk + rv_id: 945766 + url: + https://semgrep.dev/playground/r/GxTP7gN/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object version_id: GxTP7gN - url: https://semgrep.dev/playground/r/GxTP7gN/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/X1e4 + source: https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object + subcategory: + - vuln + technology: + - javascript + - aws-lambda + - dynamodb + vulnerability_class: + - Improper Validation mode: taint - pattern-sources: + pattern-sanitizers: - patterns: - - pattern: $EVENT - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' + - pattern: "{...}\n" pattern-sinks: - patterns: - focus-metavariable: $SINK - - pattern: '$DC.$METHOD($SINK, ...) - - ' + - pattern: "$DC.$METHOD($SINK, ...)\n" - metavariable-regex: metavariable: $METHOD - regex: (query|send|scan|delete|put|transactWrite|update|batchExecuteStatement|executeStatement|executeTransaction|transactWriteItems) - - pattern-either: - - pattern-inside: '$DC = new $AWS.DocumentClient(...); - - ... - - ' - - pattern-inside: '$DC = new $AWS.DynamoDB(...); - - ... - - ' - - pattern-inside: '$DC = new DynamoDBClient(...); - - ... - - ' - - pattern-inside: '$DC = DynamoDBDocumentClient.from(...); - - ... - - ' - pattern-sanitizers: + regex: + (query|send|scan|delete|put|transactWrite|update|batchExecuteStatement|executeStatement|executeTransaction|transactWriteItems) + - pattern-either: + - pattern-inside: "$DC = new $AWS.DocumentClient(...);\n...\n" + - pattern-inside: "$DC = new $AWS.DynamoDB(...);\n...\n" + - pattern-inside: "$DC = new DynamoDBClient(...);\n...\n" + - pattern-inside: "$DC = DynamoDBDocumentClient.from(...);\n...\n" + pattern-sources: - patterns: - - pattern: '{...} - - ' + - pattern: $EVENT + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + severity: ERROR - id: javascript.aws-lambda.security.knex-sqli.knex-sqli - message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + languages: + - javascript + - typescript + message: "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `knex.raw(''SELECT $1 from table'', [userinput])`' + instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`" metadata: - references: - - https://knexjs.org/#Builder-fromRaw - - https://knexjs.org/#Builder-whereRaw category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - knex - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli - shortlink: https://sg.run/RgWq + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://knexjs.org/#Builder-fromRaw + - https://knexjs.org/#Builder-whereRaw semgrep.dev: rule: + origin: community r_id: 18249 - rv_id: 1263106 rule_id: bwUBlj - version_id: JdTzxKg + rv_id: 1263106 url: https://semgrep.dev/playground/r/JdTzxKg/javascript.aws-lambda.security.knex-sqli.knex-sqli - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: JdTzxKg + shortlink: https://sg.run/RgWq + source: https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli + subcategory: + - vuln + technology: + - aws-lambda + - knex + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $QUERY @@ -9544,78 +8550,58 @@ rules: - pattern: $KNEX.whereRaw($QUERY, ...) - pattern: $KNEX.raw($QUERY, ...) - pattern-either: - - pattern-inside: 'require(''knex'') - - ... - - ' - - pattern-inside: 'import ''knex'' - - ... - - ' + - pattern-inside: "require('knex')\n...\n" + - pattern-inside: "import 'knex'\n...\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern: $EVENT + severity: WARNING - id: javascript.aws-lambda.security.mysql-sqli.mysql-sqli - message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + languages: + - javascript + - typescript + message: "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `connection.query(''SELECT $1 from table'', [userinput])`' + instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`" metadata: - references: - - https://www.npmjs.com/package/mysql2 category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://www.npmjs.com/package/mysql2 + semgrep.dev: + rule: + origin: community + r_id: 18250 + rule_id: NbUBJ2 + rv_id: 1263107 + url: https://semgrep.dev/playground/r/5PTo1En/javascript.aws-lambda.security.mysql-sqli.mysql-sqli + version_id: 5PTo1En + shortlink: https://sg.run/A502 + source: https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli + subcategory: + - vuln technology: - aws-lambda - mysql - mysql2 - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection - source: https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli - shortlink: https://sg.run/A502 - semgrep.dev: - rule: - r_id: 18250 - rv_id: 1263107 - rule_id: NbUBJ2 - version_id: 5PTo1En - url: https://semgrep.dev/playground/r/5PTo1En/javascript.aws-lambda.security.mysql-sqli.mysql-sqli - origin: community - languages: - - javascript - - typescript - severity: WARNING mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $QUERY @@ -9623,418 +8609,301 @@ rules: - pattern: $POOL.query($QUERY, ...) - pattern: $POOL.execute($QUERY, ...) - pattern-either: - - pattern-inside: 'require(''mysql'') - - ... - - ' - - pattern-inside: 'require(''mysql2'') - - ... - - ' - - pattern-inside: 'require(''mysql2/promise'') - - ... - - ' - - pattern-inside: 'import ''mysql'' - - ... - - ' - - pattern-inside: 'import ''mysql2'' - - ... - - ' - - pattern-inside: 'import ''mysql2/promise'' - - ... - - ' + - pattern-inside: "require('mysql')\n...\n" + - pattern-inside: "require('mysql2')\n...\n" + - pattern-inside: "require('mysql2/promise')\n...\n" + - pattern-inside: "import 'mysql'\n...\n" + - pattern-inside: "import 'mysql2'\n...\n" + - pattern-inside: "import 'mysql2/promise'\n...\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern: $EVENT + severity: WARNING - id: javascript.aws-lambda.security.pg-sqli.pg-sqli - message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + languages: + - javascript + - typescript + message: "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `connection.query(''SELECT $1 from table'', [userinput])`' + instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`" metadata: - references: - - https://node-postgres.com/features/queries category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://node-postgres.com/features/queries + semgrep.dev: + rule: + origin: community + r_id: 18251 + rule_id: kxU25P + rv_id: 1263108 + url: https://semgrep.dev/playground/r/GxTkeJL/javascript.aws-lambda.security.pg-sqli.pg-sqli + version_id: GxTkeJL + shortlink: https://sg.run/BGKA + source: https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli + subcategory: + - vuln technology: - aws-lambda - postgres - pg - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection - source: https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli - shortlink: https://sg.run/BGKA - semgrep.dev: - rule: - r_id: 18251 - rv_id: 1263108 - rule_id: kxU25P - version_id: GxTkeJL - url: https://semgrep.dev/playground/r/GxTkeJL/javascript.aws-lambda.security.pg-sqli.pg-sqli - origin: community - languages: - - javascript - - typescript - severity: WARNING mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern: $DB.query($QUERY, ...) - pattern-either: - - pattern-inside: 'require(''pg'') - - ... - - ' - - pattern-inside: 'import ''pg'' - - ... - - ' + - pattern-inside: "require('pg')\n...\n" + - pattern-inside: "import 'pg'\n...\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern: $EVENT + severity: WARNING - id: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli - message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is + languages: + - javascript + - typescript + message: "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `sequelize.query(''SELECT * FROM projects WHERE status = ?'', { - replacements: [''active''], type: QueryTypes.SELECT });`' + instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: + ['active'], type: QueryTypes.SELECT });`" metadata: - references: - - https://sequelize.org/master/manual/raw-queries.html category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - sequelize - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli - shortlink: https://sg.run/DAlP + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://sequelize.org/master/manual/raw-queries.html semgrep.dev: rule: + origin: community r_id: 18252 - rv_id: 1263109 rule_id: wdUA5o - version_id: RGT0LrD + rv_id: 1263109 url: https://semgrep.dev/playground/r/RGT0LrD/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: RGT0LrD + shortlink: https://sg.run/DAlP + source: https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli + subcategory: + - vuln + technology: + - aws-lambda + - sequelize + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern: $DB.query($QUERY, ...) - pattern-either: - - pattern-inside: 'require(''sequelize'') - - ... - - ' - - pattern-inside: 'import ''sequelize'' - - ... - - ' + - pattern-inside: "require('sequelize')\n...\n" + - pattern-inside: "import 'sequelize'\n...\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern: $EVENT + severity: WARNING - id: javascript.aws-lambda.security.tainted-html-response.tainted-html-response - message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering - HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers - steal sensitive user data. + languages: + - javascript + - typescript + message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of + rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. metadata: - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - owasp: - - A07:2017 - Cross-Site Scripting (XSS) - - A03:2021 - Injection - - A05:2025 - Injection category: security - technology: - - aws-lambda - cwe2022-top25: true + confidence: MEDIUM + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response - shortlink: https://sg.run/0Gvj semgrep.dev: rule: + origin: community r_id: 18254 - rv_id: 1263111 rule_id: OrUJBY + rv_id: 1263111 + url: + https://semgrep.dev/playground/r/BjTkZ8D/javascript.aws-lambda.security.tainted-html-response.tainted-html-response version_id: BjTkZ8D - url: https://semgrep.dev/playground/r/BjTkZ8D/javascript.aws-lambda.security.tainted-html-response.tainted-html-response - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/0Gvj + source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint + pattern-sinks: + - patterns: + - focus-metavariable: $BODY + - pattern-inside: "{..., headers: {..., 'Content-Type': 'text/html', ...}, body: $BODY, ... }\n" pattern-sources: - patterns: - pattern-either: - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" - pattern: $EVENT - pattern-sinks: - - patterns: - - focus-metavariable: $BODY - - pattern-inside: '{..., headers: {..., ''Content-Type'': ''text/html'', ...}, body: $BODY, ... } - - ' + severity: WARNING - id: javascript.aws-lambda.security.tainted-html-string.tainted-html-string - message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods - of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could - let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use - templates which will safely render HTML instead. + languages: + - javascript + - typescript + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure + methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, + which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered + safely. Otherwise, use templates which will safely render HTML instead. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - aws-lambda - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string - shortlink: https://sg.run/Lgqr semgrep.dev: rule: + origin: community r_id: 18483 - rv_id: 1263112 rule_id: PeUxwW + rv_id: 1263112 + url: + https://semgrep.dev/playground/r/DkTRbvp/javascript.aws-lambda.security.tainted-html-string.tainted-html-string version_id: DkTRbvp - url: https://semgrep.dev/playground/r/DkTRbvp/javascript.aws-lambda.security.tainted-html-string.tainted-html-string - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/Lgqr + source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern: $EVENT pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - - pattern: '"$HTMLSTR" + $EXPR - - ' - - pattern: '"$HTMLSTR".concat(...) - - ' + - pattern: "\"$HTMLSTR\" + $EXPR\n" + - pattern: "\"$HTMLSTR\".concat(...)\n" - pattern: $UTIL.format($HTMLSTR, ...) - pattern: format($HTMLSTR, ...) - metavariable-pattern: - metavariable: $HTMLSTR language: generic + metavariable: $HTMLSTR pattern: <$TAG ... - patterns: - - pattern: '`...${...}...` - - ' - - pattern-regex: '.*<\w+.* - - ' - - pattern-not-inside: 'console.$LOG(...) - - ' + - pattern: "`...${...}...`\n" + - pattern-regex: ".*<\\w+.*\n" + - pattern-not-inside: "console.$LOG(...)\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern: $EVENT + severity: WARNING - id: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection - message: The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a - security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input - it could result in command injection. Do not let user input in `vm` functions. + languages: + - javascript + - typescript + message: The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not + a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user + input it could result in command injection. Do not let user input in `vm` functions. metadata: - owasp: - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' category: security - technology: - - javascript - - aws-lambda + confidence: MEDIUM + cwe: + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" cwe2022-top25: true - subcategory: - - vuln - likelihood: MEDIUM impact: MEDIUM - confidence: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A03:2021 - Injection + - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection - shortlink: https://sg.run/q9w7 semgrep.dev: rule: + origin: community r_id: 18256 - rv_id: 1263114 rule_id: v8UOdZ + rv_id: 1263114 + url: + https://semgrep.dev/playground/r/0bTKz9J/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection version_id: 0bTKz9J - url: https://semgrep.dev/playground/r/0bTKz9J/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/q9w7 + source: https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection + subcategory: + - vuln + technology: + - javascript + - aws-lambda + vulnerability_class: + - Code Injection mode: taint - pattern-sources: - - patterns: - - pattern: $EVENT - - pattern-either: - - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" - - pattern-inside: 'function $FUNC ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' - - pattern-inside: '$FUNC = function ($EVENT, ...) {...} - - ... - - exports.handler = $FUNC - - ' pattern-sinks: - patterns: - pattern-either: - - pattern-inside: 'require(''vm''); - - ... - - ' - - pattern-inside: 'import ''vm'' - - ... - - ' + - pattern-inside: "require('vm');\n...\n" + - pattern-inside: "import 'vm'\n...\n" - pattern-either: - pattern: $VM.runInContext($X,...) - pattern: $VM.runInNewContext($X,...) @@ -10048,111 +8917,61 @@ rules: - pattern: compileFunction($X,...) - pattern: new Script($X,...) - pattern: new SourceTextModule($X,...) + pattern-sources: + - patterns: + - pattern: $EVENT + - pattern-either: + - pattern-inside: "exports.handler = function ($EVENT, ...) {\n ...\n}\n" + - pattern-inside: "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + - pattern-inside: "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" + severity: ERROR - id: javascript.browser.security.open-redirect.js-open-redirect - message: The application accepts potentially user-controlled input `$PROP` which can control the location of the current - window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript - URIs. It is recommended to validate user-controllable input before allowing it to control the redirection. - options: - interfile: true + languages: + - javascript + - typescript + message: The application accepts potentially user-controlled input `$PROP` which can control the location of the + current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) + with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the + redirection. metadata: - interfile: true - cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control asvs: - section: V5 Validation, Sanitization and Encoding control_id: 5.5.1 Insecue Redirect - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation + section: V5 Validation, Sanitization and Encoding version: '4' category: security confidence: HIGH - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html - technology: - - browser - subcategory: - - vuln - likelihood: HIGH + cwe: + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" impact: MEDIUM + interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect - shortlink: https://sg.run/3xRe + likelihood: HIGH + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9243 - rv_id: 1263122 rule_id: WAUopl - version_id: pZT03x0 + rv_id: 1263122 url: https://semgrep.dev/playground/r/pZT03x0/javascript.browser.security.open-redirect.js-open-redirect - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: pZT03x0 + shortlink: https://sg.run/3xRe + source: https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect + subcategory: + - vuln + technology: + - browser + vulnerability_class: + - Open Redirect mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: 'new URLSearchParams($WINDOW. ... .location.search).get(''...'') - - ' - - pattern: 'new URLSearchParams(location.search).get(''...'') - - ' - - pattern: 'new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get(''...'') - - ' - - pattern: 'new URLSearchParams(location.hash.substring(1)).get(''...'') - - ' - - patterns: - - pattern-either: - - pattern-inside: '$PROPS = new URLSearchParams($WINDOW. ... .location.search) - - ... - - ' - - pattern-inside: '$PROPS = new URLSearchParams(location.search) - - ... - - ' - - pattern-inside: '$PROPS = new URLSearchParams($WINDOW. ... .location.hash.substring(1)) - - ... - - ' - - pattern-inside: '$PROPS = new URLSearchParams(location.hash.substring(1)) - - ... - - ' - - pattern: $PROPS.get('...') - - patterns: - - pattern-either: - - pattern-inside: '$PROPS = new URL($WINDOW. ... .location.href) - - ... - - ' - - pattern-inside: '$PROPS = new URL(location.href) - - ... - - ' - - pattern: $PROPS.searchParams.get('...') - - patterns: - - pattern-either: - - pattern: 'new URL($WINDOW. ... .location.href).searchParams.get(''...'') - - ' - - pattern: 'new URL(location.href).searchParams.get(''...'') - - ' + options: + interfile: true pattern-sinks: - patterns: - pattern-either: @@ -10164,62 +8983,115 @@ rules: - pattern: $WINDOW. ... .location = $SINK - focus-metavariable: $SINK - metavariable-pattern: - patterns: - - pattern-not: '"..." + $VALUE - - ' - - pattern-not: '`...${$VALUE}` - - ' metavariable: $SINK + patterns: + - pattern-not: "\"...\" + $VALUE\n" + - pattern-not: "`...${$VALUE}`\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern: "new URLSearchParams($WINDOW. ... .location.search).get('...')\n" + - pattern: "new URLSearchParams(location.search).get('...')\n" + - pattern: "new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...')\n" + - pattern: "new URLSearchParams(location.hash.substring(1)).get('...')\n" + - patterns: + - pattern-either: + - pattern-inside: "$PROPS = new URLSearchParams($WINDOW. ... .location.search)\n...\n" + - pattern-inside: "$PROPS = new URLSearchParams(location.search)\n...\n" + - pattern-inside: "$PROPS = new URLSearchParams($WINDOW. ... .location.hash.substring(1))\n...\n" + - pattern-inside: "$PROPS = new URLSearchParams(location.hash.substring(1))\n...\n" + - pattern: $PROPS.get('...') + - patterns: + - pattern-either: + - pattern-inside: "$PROPS = new URL($WINDOW. ... .location.href)\n...\n" + - pattern-inside: "$PROPS = new URL(location.href)\n...\n" + - pattern: $PROPS.searchParams.get('...') + - patterns: + - pattern-either: + - pattern: "new URL($WINDOW. ... .location.href).searchParams.get('...')\n" + - pattern: "new URL(location.href).searchParams.get('...')\n" + severity: WARNING - id: javascript.browser.security.raw-html-concat.raw-html-concat + languages: + - javascript + - typescript message: User controlled data in a HTML string may result in XSS metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/www-community/attacks/xss/ - category: security - technology: - - browser - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat - shortlink: https://sg.run/4xAx semgrep.dev: rule: + origin: community r_id: 9244 - rv_id: 1263123 rule_id: 0oU5b5 - version_id: 2KTv2wp + rv_id: 1263123 url: https://semgrep.dev/playground/r/2KTv2wp/javascript.browser.security.raw-html-concat.raw-html-concat - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: 2KTv2wp + shortlink: https://sg.run/4xAx + source: https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat + subcategory: + - vuln + technology: + - browser + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: + pattern-sanitizers: - patterns: - pattern-either: - - pattern: location.href - - pattern: location.hash - - pattern: location.search - - pattern: $WINDOW. ... .location.href - - pattern: $WINDOW. ... .location.hash - - pattern: $WINDOW. ... .location.search + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "import * as $S from \"underscore.string\"\n...\n" + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "$S = require(\"underscore.string\")\n...\n" + - pattern-either: + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: "import $S from \"dompurify\"\n...\n" + - pattern-inside: "import { ..., $S,... } from \"dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"dompurify\"\n...\n" + - pattern-inside: "$S = require(\"dompurify\")\n...\n" + - pattern-inside: "import $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "$S = require(\"isomorphic-dompurify\")\n...\n" + - pattern-either: + - patterns: + - pattern-inside: "$VALUE = $S(...)\n...\n" + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: "$VALUE = $S.sanitize\n...\n" + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: "import $S from 'xss';\n...\n" + - pattern-inside: "import * as $S from 'xss';\n...\n" + - pattern-inside: "$S = require(\"xss\")\n...\n" + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: "import $S from 'sanitize-html';\n...\n" + - pattern-inside: "import * as $S from \"sanitize-html\";\n...\n" + - pattern-inside: "$S = require(\"sanitize-html\")\n...\n" + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: "$S = new Remarkable()\n...\n" + - pattern: $S.render(...) pattern-sinks: - patterns: - pattern-either: @@ -10227,1110 +9099,683 @@ rules: - pattern: $STRING + $EXPR - pattern-not: $STRING + "..." - metavariable-pattern: + language: generic + metavariable: $STRING patterns: - pattern: <$TAG ... - pattern-not: <$TAG ...>...... - metavariable: $STRING - language: generic - patterns: - pattern: $EXPR + $STRING - pattern-not: '"..." + $STRING' - metavariable-pattern: + language: generic + metavariable: $STRING patterns: - pattern: '... ,...) - - pattern-not-inside: '$OPTS = <... {name:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.name = ...; - - ... - - $SESSION($OPTS,...); - - ' -- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain - message: 'Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare - against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.' + - pattern-not-inside: "$OPTS = <... {name:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.name = ...;\n...\n$SESSION($OPTS,...);\n" severity: WARNING +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain languages: - javascript - typescript + message: 'Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare + against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html - category: security - technology: - - express - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: LOW - confidence: MEDIUM references: - https://owasp.org/Top10/A04_2021-Insecure_Design - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain - shortlink: https://sg.run/rd41 semgrep.dev: rule: + origin: community r_id: 9269 - rv_id: 1263133 rule_id: ZqU5Pn + rv_id: 1263133 + url: + https://semgrep.dev/playground/r/w8TRoyd/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain version_id: w8TRoyd - url: https://semgrep.dev/playground/r/w8TRoyd/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain - origin: community + shortlink: https://sg.run/rd41 + source: + https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern-inside: '$SESSION = require(''cookie-session''); - - ... - - ' - - pattern-inside: '$SESSION = require(''express-session''); - - ... - - ' + - pattern-inside: "$SESSION = require('cookie-session');\n...\n" + - pattern-inside: "$SESSION = require('express-session');\n...\n" - pattern: $SESSION(...) - pattern-not-inside: $SESSION(<... {cookie:{domain:...}} ...>,...) - - pattern-not-inside: '$OPTS = <... {cookie:{domain:...}} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE = <... {domain:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie = <... {domain:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE.domain = ...; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie.domain = ...; - - ... - - $SESSION($OPTS,...); - - ' -- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires - message: 'Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.' + - pattern-not-inside: "$OPTS = <... {cookie:{domain:...}} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE = <... {domain:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie = <... {domain:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE.domain = ...;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie.domain = ...;\n...\n$SESSION($OPTS,...);\n" severity: WARNING +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires languages: - javascript - typescript + message: 'Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html - category: security - technology: - - express - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: LOW - confidence: MEDIUM references: - https://owasp.org/Top10/A04_2021-Insecure_Design - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires - shortlink: https://sg.run/N4eG semgrep.dev: rule: + origin: community r_id: 9271 - rv_id: 1263135 rule_id: EwU2DZ + rv_id: 1263135 + url: + https://semgrep.dev/playground/r/O9TpxRq/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires version_id: O9TpxRq - url: https://semgrep.dev/playground/r/O9TpxRq/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires - origin: community + shortlink: https://sg.run/N4eG + source: + https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern-inside: '$SESSION = require(''cookie-session''); - - ... - - ' - - pattern-inside: '$SESSION = require(''express-session''); - - ... - - ' + - pattern-inside: "$SESSION = require('cookie-session');\n...\n" + - pattern-inside: "$SESSION = require('express-session');\n...\n" - pattern: $SESSION(...) - pattern-not-inside: $SESSION(<... {cookie:{expires:...}} ...>,...) - - pattern-not-inside: '$OPTS = <... {cookie:{expires:...}} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE = <... {expires:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie = <... {expires:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE.expires = ...; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie.expires = ...; - - ... - - $SESSION($OPTS,...);' -- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly - message: 'Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not - client JavaScript, helping to protect against cross-site scripting attacks.' + - pattern-not-inside: "$OPTS = <... {cookie:{expires:...}} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE = <... {expires:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie = <... {expires:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE.expires = ...;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie.expires = ...;\n...\n$SESSION($OPTS,...);" severity: WARNING +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly languages: - javascript - typescript + message: 'Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not + client JavaScript, helping to protect against cross-site scripting attacks.' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html - category: security - technology: - - express - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: LOW - confidence: MEDIUM references: - https://owasp.org/Top10/A04_2021-Insecure_Design - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly - shortlink: https://sg.run/ydBO semgrep.dev: rule: + origin: community r_id: 9268 - rv_id: 1263132 rule_id: d8UjGo + rv_id: 1263132 + url: + https://semgrep.dev/playground/r/kbTzGev/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly version_id: kbTzGev - url: https://semgrep.dev/playground/r/kbTzGev/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly - origin: community + shortlink: https://sg.run/ydBO + source: + https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern-inside: '$SESSION = require(''cookie-session''); - - ... - - ' - - pattern-inside: '$SESSION = require(''express-session''); - - ... - - ' + - pattern-inside: "$SESSION = require('cookie-session');\n...\n" + - pattern-inside: "$SESSION = require('express-session');\n...\n" - pattern: $SESSION(...) - pattern-not-inside: $SESSION(<... {cookie:{httpOnly:true}} ...>,...) - - pattern-not-inside: '$OPTS = <... {cookie:{httpOnly:true}} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE = <... {httpOnly:true} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie = <... {httpOnly:true} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE.httpOnly = true; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie.httpOnly = true; - - ... - - $SESSION($OPTS,...); - - ' -- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path - message: 'Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against - the request path. If this and domain match, then send the cookie in the request.' + - pattern-not-inside: "$OPTS = <... {cookie:{httpOnly:true}} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE = <... {httpOnly:true} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie = <... {httpOnly:true} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE.httpOnly = true;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie.httpOnly = true;\n...\n$SESSION($OPTS,...);\n" severity: WARNING +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path languages: - javascript - typescript + message: 'Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against + the request path. If this and domain match, then send the cookie in the request.' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html - category: security - technology: - - express - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: LOW - confidence: MEDIUM references: - https://owasp.org/Top10/A04_2021-Insecure_Design - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path - shortlink: https://sg.run/b7pd semgrep.dev: rule: + origin: community r_id: 9270 - rv_id: 1263134 rule_id: nJUz4X + rv_id: 1263134 + url: + https://semgrep.dev/playground/r/xyTjzQD/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path version_id: xyTjzQD - url: https://semgrep.dev/playground/r/xyTjzQD/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path - origin: community + shortlink: https://sg.run/b7pd + source: + https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern-inside: '$SESSION = require(''cookie-session''); - - ... - - ' - - pattern-inside: '$SESSION = require(''express-session''); - - ... - - ' + - pattern-inside: "$SESSION = require('cookie-session');\n...\n" + - pattern-inside: "$SESSION = require('express-session');\n...\n" - pattern: $SESSION(...) - pattern-not-inside: $SESSION(<... {cookie:{path:...}} ...>,...) - - pattern-not-inside: '$OPTS = <... {cookie:{path:...}} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE = <... {path:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie = <... {path:...} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE.path = ...; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie.path = ...; - - ... - - $SESSION($OPTS,...); - - ' -- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure - message: 'Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.' + - pattern-not-inside: "$OPTS = <... {cookie:{path:...}} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE = <... {path:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie = <... {path:...} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE.path = ...;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie.path = ...;\n...\n$SESSION($OPTS,...);\n" severity: WARNING +- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure languages: - javascript - typescript + message: 'Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html - category: security - technology: - - express - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: LOW - confidence: MEDIUM references: - https://owasp.org/Top10/A04_2021-Insecure_Design - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure - shortlink: https://sg.run/9oKz semgrep.dev: rule: + origin: community r_id: 9267 - rv_id: 1263131 rule_id: v8Unzw + rv_id: 1263131 + url: + https://semgrep.dev/playground/r/NdTzyrv/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure version_id: NdTzyrv - url: https://semgrep.dev/playground/r/NdTzyrv/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure - origin: community + shortlink: https://sg.run/9oKz + source: + https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure + source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern-inside: '$SESSION = require(''cookie-session''); - - ... - - ' - - pattern-inside: '$SESSION = require(''express-session''); - - ... - - ' + - pattern-inside: "$SESSION = require('cookie-session');\n...\n" + - pattern-inside: "$SESSION = require('express-session');\n...\n" - pattern: $SESSION(...) - pattern-not-inside: $SESSION(<... {cookie:{secure:true}} ...>,...) - - pattern-not-inside: '$OPTS = <... {cookie:{secure:true}} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE = <... {secure:true} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie = <... {secure:true} ...>; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $COOKIE.secure = true; - - ... - - $SESSION($OPTS,...); - - ' - - pattern-not-inside: '$OPTS = ...; - - ... - - $OPTS.cookie.secure = true; - - ... - - $SESSION($OPTS,...); - - ' + - pattern-not-inside: "$OPTS = <... {cookie:{secure:true}} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE = <... {secure:true} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie = <... {secure:true} ...>;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$COOKIE.secure = true;\n...\n$SESSION($OPTS,...);\n" + - pattern-not-inside: "$OPTS = ...;\n...\n$OPTS.cookie.secure = true;\n...\n$SESSION($OPTS,...);\n" + severity: WARNING - id: javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked - message: No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider - using function as the `isRevoked` option. + languages: + - javascript + - typescript + message: No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. + Consider using function as the `isRevoked` option. metadata: + asvs: + control_id: 3.5.3 Insecure Stateless Session Tokens + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' + version: '4' + category: security + confidence: MEDIUM cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - source-rule-url: https://github.com/goldbergyoni/nodebestpractices/blob/master/sections/security/expirejwt.md - asvs: - section: 'V3: Session Management Verification Requirements' - control_id: 3.5.3 Insecure Stateless Session Tokens - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management - version: '4' - category: security - technology: - - express - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM references: - https://owasp.org/Top10/A04_2021-Insecure_Design - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked - shortlink: https://sg.run/kXNo semgrep.dev: rule: + origin: community r_id: 9272 - rv_id: 1263137 rule_id: 7KUQ9k + rv_id: 1263137 + url: + https://semgrep.dev/playground/r/vdT06Bg/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked version_id: vdT06Bg - url: https://semgrep.dev/playground/r/vdT06Bg/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/kXNo + source: https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked + source-rule-url: https://github.com/goldbergyoni/nodebestpractices/blob/master/sections/security/expirejwt.md + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: '$JWT = require(''express-jwt''); - - ... - - ' + - pattern-inside: "$JWT = require('express-jwt');\n...\n" - pattern: $JWT(...) - pattern-not-inside: $JWT(<... {isRevoked:...} ...>,...) - - pattern-not-inside: '$OPTS = <... {isRevoked:...} ...>; - - ... - - $JWT($OPTS,...);' + - pattern-not-inside: "$OPTS = <... {isRevoked:...} ...>;\n...\n$JWT($OPTS,...);" + severity: WARNING - id: javascript.express.security.audit.express-libxml-noent.express-libxml-noent - message: The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable - to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure - you are protected. - options: - interfile: true + languages: + - javascript + - typescript + message: The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being + vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this + feature to ensure you are protected. metadata: - interfile: true - references: - - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html - technology: - - express category: security + confidence: HIGH cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent - shortlink: https://sg.run/Z75x + references: + - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 22079 - rv_id: 1263138 rule_id: pKUNeD + rv_id: 1263138 + url: + https://semgrep.dev/playground/r/d6TyxpX/javascript.express.security.audit.express-libxml-noent.express-libxml-noent version_id: d6TyxpX - url: https://semgrep.dev/playground/r/d6TyxpX/javascript.express.security.audit.express-libxml-noent.express-libxml-noent - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/Z75x + source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent + subcategory: + - vuln + technology: + - express + vulnerability_class: + - XML Injection mode: taint + options: + interfile: true + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: "$XML = require('$IMPORT')\n...\n" + - pattern-inside: "import $XML from '$IMPORT'\n ...\n" + - pattern-inside: "import * as $XML from '$IMPORT'\n...\n" + - metavariable-regex: + metavariable: $IMPORT + regex: ^(libxmljs|libxmljs2)$ + - pattern-inside: $XML.$FUNC($QUERY, {...,noent:true,...}) + - metavariable-regex: + metavariable: $FUNC + regex: ^(parseXmlString|parseXml)$ + - focus-metavariable: $QUERY pattern-sources: - patterns: - pattern-either: @@ -11353,14 +9798,8 @@ rules: - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -11370,105 +9809,48 @@ rules: - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') - pattern-sinks: - - pattern-either: - - patterns: - - pattern-either: - - pattern-inside: '$XML = require(''$IMPORT'') - - ... - - ' - - pattern-inside: "import $XML from '$IMPORT'\n ...\n" - - pattern-inside: 'import * as $XML from ''$IMPORT'' - - ... - - ' - - metavariable-regex: - metavariable: $IMPORT - regex: ^(libxmljs|libxmljs2)$ - - pattern-inside: $XML.$FUNC($QUERY, {...,noent:true,...}) - - metavariable-regex: - metavariable: $FUNC - regex: ^(parseXmlString|parseXml)$ - - focus-metavariable: $QUERY + severity: ERROR - id: javascript.express.security.audit.express-open-redirect.express-open-redirect - message: The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect - users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected - to a third-party website. + languages: + - javascript + - typescript + message: The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could + redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they + are being redirected to a third-party website. metadata: - technology: - - express - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html - cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' category: security + confidence: HIGH + cwe: + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect - shortlink: https://sg.run/EpoP + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 22081 - rv_id: 1263140 rule_id: X5ULkq + rv_id: 1263140 + url: + https://semgrep.dev/playground/r/nWT2L0v/javascript.express.security.audit.express-open-redirect.express-open-redirect version_id: nWT2L0v - url: https://semgrep.dev/playground/r/nWT2L0v/javascript.express.security.audit.express-open-redirect.express-open-redirect - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/EpoP + source: https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Open Redirect + mode: taint options: - taint_unify_mvars: true symbolic_propagation: true - mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: function ... ($REQ, $RES) {...} - - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - - patterns: - - pattern-either: - - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - - metavariable-regex: - metavariable: $METHOD - regex: ^(get|post|put|head|delete|options)$ - - pattern-either: - - pattern: $REQ.query - - pattern: $REQ.body - - pattern: $REQ.params - - pattern: $REQ.cookies - - pattern: $REQ.headers - - patterns: - - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' - - focus-metavariable: $REQ - - pattern-either: - - pattern: params - - pattern: query - - pattern: cookies - - pattern: headers - - pattern: body + taint_unify_mvars: true pattern-sinks: - patterns: - pattern-either: @@ -11497,73 +9879,17 @@ rules: - pattern: $REQ.$VALUE - patterns: - pattern-either: - - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE - - ... - - ' - - pattern-inside: '$ASSIGN = $REQ.$VALUE[''...''] - - ... - - ' - - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE + $...A - - ... - - ' + - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE\n...\n" + - pattern-inside: "$ASSIGN = $REQ.$VALUE['...']\n...\n" + - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE + $...A\n...\n" - pattern-inside: "$ASSIGN = $REQ.$VALUE['...'] + $...A\n... \n" - - pattern-inside: '$ASSIGN = `${$REQ. ... .$VALUE}...` - - ... - - ' + - pattern-inside: "$ASSIGN = `${$REQ. ... .$VALUE}...`\n...\n" - pattern-inside: "$ASSIGN = `${$REQ.$VALUE['...']}...`\n... \n" - pattern-either: - pattern: $RES.redirect($ASSIGN) - pattern: $RES.redirect($ASSIGN + $...FOO) - pattern: $RES.redirect(`${$ASSIGN}...`) - focus-metavariable: $ASSIGN -- id: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal - message: Possible writing outside of the destination, make sure that the target path is nested in the intended destination - metadata: - owasp: - - A05:2017 - Broken Access Control - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' - category: security - references: - - https://owasp.org/www-community/attacks/Path_Traversal - technology: - - express - - node.js - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal - shortlink: https://sg.run/weRn - semgrep.dev: - rule: - r_id: 9273 - rv_id: 1263141 - rule_id: L1Uyb8 - version_id: ExTExX0 - url: https://semgrep.dev/playground/r/ExTExX0/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal - origin: community - languages: - - javascript - - typescript - severity: WARNING - mode: taint pattern-sources: - patterns: - pattern-either: @@ -11584,14 +9910,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -11599,80 +9919,151 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - focus-metavariable: $SINK - - pattern-either: - - pattern-inside: '$PATH = require(''path''); - - ... - - ' - - pattern-inside: 'import $PATH from ''path''; - - ... - - ' - - pattern-either: - - pattern: $PATH.join(...,$SINK,...) - - pattern: $PATH.resolve(...,$SINK,...) - - patterns: - - focus-metavariable: $SINK - - pattern-inside: 'import ''path''; - - ... - - ' - - pattern-either: - - pattern: path.join(...,$SINK,...) - - pattern: path.resolve(...,$SINK,...) - pattern-sanitizers: - - pattern: $Y.replace(...) - - pattern: $Y.indexOf(...) - - pattern: "function ... (...) {\n ...\n <... $Y.indexOf(...) ...>\n ...\n}\n" - - patterns: - - pattern: $FUNC(...) - - metavariable-regex: - metavariable: $FUNC - regex: sanitize -- id: javascript.express.security.audit.express-res-sendfile.express-res-sendfile - message: The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily - read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing - the path. This allows you to validate the path against the intended directory it should be accessing. + severity: WARNING +- id: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal + languages: + - javascript + - typescript + message: Possible writing outside of the destination, make sure that the target path is nested in the intended + destination metadata: - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html - technology: - - express category: security + confidence: MEDIUM cwe: - - 'CWE-73: External Control of File Name or Path' + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - - A04:2021 - Insecure Design - - A06:2025 - Insecure Design + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/www-community/attacks/Path_Traversal + semgrep.dev: + rule: + origin: community + r_id: 9273 + rule_id: L1Uyb8 + rv_id: 1263141 + url: + https://semgrep.dev/playground/r/ExTExX0/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal + version_id: ExTExX0 + shortlink: https://sg.run/weRn + source: + https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal subcategory: - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - express + - node.js vulnerability_class: - Path Traversal - source: https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile - shortlink: https://sg.run/7DJk + mode: taint + pattern-sanitizers: + - pattern: $Y.replace(...) + - pattern: $Y.indexOf(...) + - pattern: "function ... (...) {\n ...\n <... $Y.indexOf(...) ...>\n ...\n}\n" + - patterns: + - pattern: $FUNC(...) + - metavariable-regex: + metavariable: $FUNC + regex: sanitize + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern-either: + - pattern-inside: "$PATH = require('path');\n...\n" + - pattern-inside: "import $PATH from 'path';\n...\n" + - pattern-either: + - pattern: $PATH.join(...,$SINK,...) + - pattern: $PATH.resolve(...,$SINK,...) + - patterns: + - focus-metavariable: $SINK + - pattern-inside: "import 'path';\n...\n" + - pattern-either: + - pattern: path.join(...,$SINK,...) + - pattern: path.resolve(...,$SINK,...) + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + severity: WARNING +- id: javascript.express.security.audit.express-res-sendfile.express-res-sendfile + languages: + - javascript + - typescript + message: The application processes user-input, this is passed to res.sendFile which can allow an attacker to + arbitrarily read files on the system through path traversal. It is recommended to perform input validation in + addition to canonicalizing the path. This allows you to validate the path against the intended directory it should + be accessing. + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-73: External Control of File Name or Path' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 22082 - rv_id: 1263142 rule_id: j2UzDx + rv_id: 1263142 + url: + https://semgrep.dev/playground/r/7ZTE3X9/javascript.express.security.audit.express-res-sendfile.express-res-sendfile version_id: 7ZTE3X9 - url: https://semgrep.dev/playground/r/7ZTE3X9/javascript.express.security.audit.express-res-sendfile.express-res-sendfile - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/7DJk + source: https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Path Traversal mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.$METH($QUERY,...) + - pattern-not-inside: $RES.$METH($QUERY,$OPTIONS) + - metavariable-regex: + metavariable: $METH + regex: ^(sendfile|sendFile)$ + - focus-metavariable: $QUERY pattern-sources: - patterns: - pattern-either: @@ -11693,14 +10084,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - pattern-either: - pattern: params - pattern: query @@ -11711,187 +10096,116 @@ rules: - pattern-either: - patterns: - pattern-either: - - pattern-inside: 'function ... (...,$REQ: $TYPE, ...) {...} - - ' + - pattern-inside: "function ... (...,$REQ: $TYPE, ...) {...}\n" - metavariable-regex: metavariable: $TYPE regex: ^(string|String) - pattern-sinks: - - patterns: - - pattern-either: - - pattern: $RES.$METH($QUERY,...) - - pattern-not-inside: $RES.$METH($QUERY,$OPTIONS) - - metavariable-regex: - metavariable: $METH - regex: ^(sendfile|sendFile)$ - - focus-metavariable: $QUERY + severity: WARNING - id: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). - options: - interfile: true + languages: + - javascript + - typescript + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - interfile: true + category: security + confidence: HIGH cwe: - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - category: security - technology: - - express - - secrets - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: HIGH - confidence: HIGH + interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret - shortlink: https://sg.run/LYvG + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 22083 - rv_id: 1263143 rule_id: 10Uo39 + rv_id: 1263143 + url: + https://semgrep.dev/playground/r/LjTkgle/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret version_id: LjTkgle - url: https://semgrep.dev/playground/r/LjTkgle/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/LYvG + source: + https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret + subcategory: + - vuln + technology: + - express + - secrets + vulnerability_class: + - Hard-coded Secrets + options: + interfile: true patterns: - pattern-either: - - pattern-inside: '$SESSION = require(''express-session''); - - ... - - ' - - pattern-inside: 'import $SESSION from ''express-session'' - - ... - - ' - - pattern-inside: 'import {..., $SESSION, ...} from ''express-session'' - - ... - - ' - - pattern-inside: 'import * as $SESSION from ''express-session'' - - ... - - ' + - pattern-inside: "$SESSION = require('express-session');\n...\n" + - pattern-inside: "import $SESSION from 'express-session'\n...\n" + - pattern-inside: "import {..., $SESSION, ...} from 'express-session'\n...\n" + - pattern-inside: "import * as $SESSION from 'express-session'\n...\n" - patterns: - pattern-either: - pattern-inside: $APP.use($SESSION({...})) - - pattern: '$SECRET = $VALUE - - ... - - $APP.use($SESSION($SECRET)) - - ' - - pattern: 'secret: ''$Y'' - - ' + - pattern: "$SECRET = $VALUE\n...\n$APP.use($SESSION($SECRET))\n" + - pattern: "secret: '$Y'\n" + severity: WARNING - id: javascript.express.security.audit.express-ssrf.express-ssrf + languages: + - javascript + - typescript message: 'The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. ' metadata: - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' - technology: - - express - category: security - owasp: - - A10:2021 - Server-Side Request Forgery (SSRF) - - A01:2025 - Broken Access Control - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf - shortlink: https://sg.run/0PNw + likelihood: MEDIUM + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 22554 - rv_id: 1263144 rule_id: eqU9l2 - version_id: 8KT5rBr + rv_id: 1263144 url: https://semgrep.dev/playground/r/8KT5rBr/javascript.express.security.audit.express-ssrf.express-ssrf - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: 8KT5rBr + shortlink: https://sg.run/0PNw + source: https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint options: taint_unify_mvars: true - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: function ... ($REQ, ...) {...} - - pattern-either: - - pattern: $REQ.query - - pattern: $REQ.body - - pattern: $REQ.params - - pattern: $REQ.cookies - - pattern: $REQ.headers - - patterns: - - pattern-either: - - pattern-inside: '({ $REQ }: Request,...) => - - {...} - - ' - - pattern-inside: '({ $REQ }: $EXPRESS.Request,...) => {...} - - ' - - focus-metavariable: $REQ - - pattern-either: - - pattern: params - - pattern: query - - pattern: cookies - - pattern: headers - - pattern: body pattern-sinks: - patterns: - pattern-either: - - pattern-inside: '$REQUEST = require(''request'') - - ... - - ' - - pattern-inside: 'import * as $REQUEST from ''request'' - - ... - - ' - - pattern-inside: 'import $REQUEST from ''request'' - - ... - - ' + - pattern-inside: "$REQUEST = require('request')\n...\n" + - pattern-inside: "import * as $REQUEST from 'request'\n...\n" + - pattern-inside: "import $REQUEST from 'request'\n...\n" - pattern-either: - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE) - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE + $...A) @@ -11909,21 +10223,9 @@ rules: - pattern: $REQ. ... .$VALUE - patterns: - pattern-either: - - pattern-inside: '$REQUEST = require(''request'') - - ... - - ' - - pattern-inside: 'import * as $REQUEST from ''request'' - - ... - - ' - - pattern-inside: 'import $REQUEST from ''request'' - - ... - - ' + - pattern-inside: "$REQUEST = require('request')\n...\n" + - pattern-inside: "import * as $REQUEST from 'request'\n...\n" + - pattern-inside: "import $REQUEST from 'request'\n...\n" - pattern-either: - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE,...) - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE + $...A,...) @@ -11934,21 +10236,9 @@ rules: regex: ^(get|post|put|patch|del|head|delete)$ - patterns: - pattern-either: - - pattern-inside: '$REQUEST = require(''request'') - - ... - - ' - - pattern-inside: 'import * as $REQUEST from ''request'' - - ... - - ' - - pattern-inside: 'import $REQUEST from ''request'' - - ... - - ' + - pattern-inside: "$REQUEST = require('request')\n...\n" + - pattern-inside: "import * as $REQUEST from 'request'\n...\n" + - pattern-inside: "import $REQUEST from 'request'\n...\n" - pattern-either: - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'],...) - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'] + $...A,...) @@ -11959,71 +10249,23 @@ rules: regex: ^(get|post|put|patch|del|head|delete)$ - patterns: - pattern-either: - - pattern-inside: '$REQUEST = require(''request'') - - ... - - ' - - pattern-inside: 'import * as $REQUEST from ''request'' - - ... - - ' - - pattern-inside: 'import $REQUEST from ''request'' - - ... - - ' - - pattern-either: - - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE - - ... - - ' - - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE[''...''] - - ... - - ' - - pattern-inside: '$ASSIGN = $REQ. ... .$VALUE + $...A - - ... - - ' + - pattern-inside: "$REQUEST = require('request')\n...\n" + - pattern-inside: "import * as $REQUEST from 'request'\n...\n" + - pattern-inside: "import $REQUEST from 'request'\n...\n" + - pattern-either: + - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE\n...\n" + - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE['...']\n...\n" + - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE + $...A\n...\n" - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE['...'] + $...A\n... \n" - - pattern-inside: '$ASSIGN = `${$REQ. ... .$VALUE}...` - - ... - - ' + - pattern-inside: "$ASSIGN = `${$REQ. ... .$VALUE}...`\n...\n" - pattern-inside: "$ASSIGN = `${$REQ. ... .$VALUE['...']}...`\n... \n" - patterns: - pattern-either: - - pattern-inside: '$ASSIGN = "$HTTP"+ $REQ. ... .$VALUE - - ... - - ' - - pattern-inside: '$ASSIGN = "$HTTP"+$REQ. ... .$VALUE + $...A - - ... - - ' - - pattern-inside: '$ASSIGN = "$HTTP"+$REQ.$VALUE[...] - - ... - - ' - - pattern-inside: '$ASSIGN = "$HTTP"+$REQ.$VALUE[...] + $...A - - ... - - ' - - pattern-inside: '$ASSIGN = `$HTTP${$REQ.$VALUE[...]}...` - - ... - - ' + - pattern-inside: "$ASSIGN = \"$HTTP\"+ $REQ. ... .$VALUE\n...\n" + - pattern-inside: "$ASSIGN = \"$HTTP\"+$REQ. ... .$VALUE + $...A\n...\n" + - pattern-inside: "$ASSIGN = \"$HTTP\"+$REQ.$VALUE[...]\n...\n" + - pattern-inside: "$ASSIGN = \"$HTTP\"+$REQ.$VALUE[...] + $...A\n...\n" + - pattern-inside: "$ASSIGN = `$HTTP${$REQ.$VALUE[...]}...`\n...\n" - metavariable-regex: metavariable: $HTTP regex: ^(https?:\/\/|//)$ @@ -12043,52 +10285,90 @@ rules: - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|patch|del|head|delete)$ -- id: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization - message: The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) - through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and - Buffer.from(). - options: - interfile: true - metadata: - interfile: true - technology: - - express + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, ...) {...} + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: "({ $REQ }: Request,...) =>\n{...}\n" + - pattern-inside: "({ $REQ }: $EXPRESS.Request,...) => {...}\n" + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + severity: WARNING +- id: + javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization + languages: + - javascript + - typescript + message: The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution + (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as + JSON.parse() and Buffer.from(). + metadata: category: security + confidence: HIGH cwe: - 'CWE-502: Deserialization of Untrusted Data' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html - source_rule_url: - - https://github.com/ajinabraham/njsscan/blob/75bfbeb9c8d72999e4d527dfa2548f7f0f3cc48a/njsscan/rules/semantic_grep/eval/eval_deserialize.yaml + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization - shortlink: https://sg.run/8W5j + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 22084 - rv_id: 1263145 rule_id: 9AUyqj + rv_id: 1263145 + url: + https://semgrep.dev/playground/r/gETB7nD/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization version_id: gETB7nD - url: https://semgrep.dev/playground/r/gETB7nD/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/8W5j + source: + https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization + source_rule_url: + - https://github.com/ajinabraham/njsscan/blob/75bfbeb9c8d72999e4d527dfa2548f7f0f3cc48a/njsscan/rules/semantic_grep/eval/eval_deserialize.yaml + subcategory: + - vuln + technology: + - express + vulnerability_class: + - 'Insecure Deserialization ' mode: taint + options: + interfile: true + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: "$SER = require('$IMPORT')\n...\n" + - pattern-inside: "import $SER from '$IMPORT'\n ...\n" + - pattern-inside: "import * as $SER from '$IMPORT'\n...\n" + - metavariable-regex: + metavariable: $IMPORT + regex: ^(node-serialize|serialize-to-js)$ + - pattern: $SER.$FUNC(...) + - metavariable-regex: + metavariable: $FUNC + regex: ^(unserialize|deserialize)$ pattern-sources: - patterns: - pattern-either: @@ -12111,14 +10391,8 @@ rules: - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -12128,68 +10402,55 @@ rules: - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') - pattern-sinks: - - pattern-either: - - patterns: - - pattern-either: - - pattern-inside: '$SER = require(''$IMPORT'') - - ... - - ' - - pattern-inside: "import $SER from '$IMPORT'\n ...\n" - - pattern-inside: 'import * as $SER from ''$IMPORT'' - - ... - - ' - - metavariable-regex: - metavariable: $IMPORT - regex: ^(node-serialize|serialize-to-js)$ - - pattern: $SER.$FUNC(...) - - metavariable-regex: - metavariable: $FUNC - regex: ^(unserialize|deserialize)$ + severity: WARNING - id: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event - message: Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it - can result in XML External or Internal Entity (XXE) Processing vulnerabilities + languages: + - javascript + - typescript + message: Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as + it can result in XML External or Internal Entity (XXE) Processing vulnerabilities metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - cwe: - - 'CWE-611: Improper Restriction of XML External Entity Reference' - category: security - technology: - - express references: - https://www.npmjs.com/package/xml2json - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event - shortlink: https://sg.run/x1AA semgrep.dev: rule: + origin: community r_id: 9274 - rv_id: 1263146 rule_id: 8GUjkk + rv_id: 1263146 + url: + https://semgrep.dev/playground/r/QkTGqgo/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event version_id: QkTGqgo - url: https://semgrep.dev/playground/r/QkTGqgo/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/x1AA + source: + https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event + subcategory: + - vuln + technology: + - express + vulnerability_class: + - XML Injection mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "require('xml2json');\n...\n" + - pattern-inside: "import 'xml2json';\n...\n" + - pattern: $REQ.on('...', function(...) { ... $EXPAT.toJson($INPUT,...); ... }) + - focus-metavariable: $INPUT pattern-sources: - patterns: - pattern-either: @@ -12210,12 +10471,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -12223,63 +10480,54 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: 'require(''xml2json''); - - ... - - ' - - pattern-inside: 'import ''xml2json''; - - ... - - ' - - pattern: $REQ.on('...', function(...) { ... $EXPAT.toJson($INPUT,...); ... }) - - focus-metavariable: $INPUT + severity: WARNING - id: javascript.express.security.audit.res-render-injection.res-render-injection - message: User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages - that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` - to access other HTML pages on the file system. Where possible, do not allow users to define what should be loaded in - $RES.render or use an allow list for the existing application. - options: - interfile: true + languages: + - javascript + - typescript + message: User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating + pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. + `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what + should be loaded in $RES.render or use an allow list for the existing application. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' + impact: MEDIUM interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' - category: security - technology: - - express references: - http://expressjs.com/en/4x/api.html#res.render - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection - shortlink: https://sg.run/eLjd semgrep.dev: rule: + origin: community r_id: 9276 - rv_id: 1263149 rule_id: QrUzrq + rv_id: 1263149 + url: + https://semgrep.dev/playground/r/PkTR3OY/javascript.express.security.audit.res-render-injection.res-render-injection version_id: PkTR3OY - url: https://semgrep.dev/playground/r/PkTR3OY/javascript.express.security.audit.res-render-injection.res-render-injection - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/eLjd + source: https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Improper Authorization mode: taint + options: + interfile: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.render($SINK, ...) + - focus-metavariable: $SINK pattern-sources: - patterns: - pattern-either: @@ -12300,14 +10548,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -12315,261 +10557,102 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern: $RES.render($SINK, ...) - - focus-metavariable: $SINK + severity: WARNING - id: javascript.express.security.audit.xss.direct-response-write.direct-response-write - message: Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may - expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped - HTML. - options: - interfile: true + languages: + - javascript + - typescript + message: Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and + may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render + safely escaped HTML. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM interfile: true - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - category: security - technology: - - express - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - vulnerability_class: - - Cross-Site-Scripting (XSS) - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write - shortlink: https://sg.run/vzGl + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9277 - rv_id: 1263150 rule_id: 3qUPA1 + rv_id: 1263150 + url: + https://semgrep.dev/playground/r/JdTzxeg/javascript.express.security.audit.xss.direct-response-write.direct-response-write version_id: JdTzxeg - url: https://semgrep.dev/playground/r/JdTzxeg/javascript.express.security.audit.xss.direct-response-write.direct-response-write - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/vzGl + source: https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: function ... ($REQ, $RES) {...} - - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - - patterns: - - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - - metavariable-regex: - metavariable: $METHOD - regex: ^(get|post|put|head|delete|options) - - pattern-not-inside: "function ... ($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" - - pattern-not-inside: "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n\ - })\n" - - pattern-not-inside: "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" - - pattern-not-inside: "function ... ($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n}\n" - - pattern-not-inside: "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n})\n" - - pattern-not-inside: "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.set('$TYPE')\n}\n" - - pattern-either: - - pattern: $REQ.query - - pattern: $REQ.body - - pattern: $REQ.params - - patterns: - - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' - - pattern-not-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.$SET('Content-Type',\ - \ '$TYPE')\n}\n" - - pattern-not-inside: "({ $REQ }: Request,$RES: Response) => {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" - - pattern-not-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.set('$TYPE')\n\ - }\n" - - focus-metavariable: $REQ - - pattern-either: - - pattern: params - - pattern: query - - pattern: body - pattern-sinks: - - patterns: - - pattern-inside: function ... (..., $RES,...) {...} - - pattern-either: - - pattern: $RES.write($ARG) - - pattern: $RES.send($ARG) - - pattern-not: $RES. ... .set('...'). ... .send($ARG) - - pattern-not: $RES. ... .type('...'). ... .send($ARG) - - pattern-not-inside: $RES.$METHOD({ ... }) - - focus-metavariable: $ARG + options: + interfile: true pattern-sanitizers: - patterns: - pattern-either: - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import * as $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: '$S = require("underscore.string") - - ... - - ' + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "import * as $S from \"underscore.string\"\n...\n" + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "$S = require(\"underscore.string\")\n...\n" - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from "dompurify" - - ... - - ' - - pattern-inside: 'import { ..., $S,... } from "dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "dompurify" - - ... - - ' - - pattern-inside: '$S = require("dompurify") - - ... - - ' - - pattern-inside: 'import $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: '$S = require("isomorphic-dompurify") - - ... - - ' + - pattern-inside: "import $S from \"dompurify\"\n...\n" + - pattern-inside: "import { ..., $S,... } from \"dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"dompurify\"\n...\n" + - pattern-inside: "$S = require(\"dompurify\")\n...\n" + - pattern-inside: "import $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "$S = require(\"isomorphic-dompurify\")\n...\n" - pattern-either: - patterns: - - pattern-inside: '$VALUE = $S(...) - - ... - - ' + - pattern-inside: "$VALUE = $S(...)\n...\n" - pattern: $VALUE.sanitize(...) - patterns: - - pattern-inside: '$VALUE = $S.sanitize - - ... - - ' + - pattern-inside: "$VALUE = $S.sanitize\n...\n" - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''xss''; - - ... - - ' - - pattern-inside: 'import * as $S from ''xss''; - - ... - - ' - - pattern-inside: '$S = require("xss") - - ... - - ' + - pattern-inside: "import $S from 'xss';\n...\n" + - pattern-inside: "import * as $S from 'xss';\n...\n" + - pattern-inside: "$S = require(\"xss\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''sanitize-html''; - - ... - - ' - - pattern-inside: 'import * as $S from "sanitize-html"; - - ... - - ' - - pattern-inside: '$S = require("sanitize-html") - - ... - - ' + - pattern-inside: "import $S from 'sanitize-html';\n...\n" + - pattern-inside: "import * as $S from \"sanitize-html\";\n...\n" + - pattern-inside: "$S = require(\"sanitize-html\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: '$S = new Remarkable() - - ... - - ' + - pattern-inside: "$S = new Remarkable()\n...\n" - pattern: $S.render(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''express-xss-sanitizer''; - - ... - - ' - - pattern-inside: 'import * as $S from "express-xss-sanitizer"; - - ... - - ' - - pattern-inside: 'const { ..., $S, ... } = require(''express-xss-sanitizer''); - - ... - - ' - - pattern-inside: 'var { ..., $S, ... } = require(''express-xss-sanitizer''); - - ... - - ' - - pattern-inside: 'let { ...,$S,... } = require(''express-xss-sanitizer''); - - ... - - ' - - pattern-inside: '$S = require("express-xss-sanitizer") - - ... - - ' + - pattern-inside: "import $S from 'express-xss-sanitizer';\n...\n" + - pattern-inside: "import * as $S from \"express-xss-sanitizer\";\n...\n" + - pattern-inside: "const { ..., $S, ... } = require('express-xss-sanitizer');\n...\n" + - pattern-inside: "var { ..., $S, ... } = require('express-xss-sanitizer');\n...\n" + - pattern-inside: "let { ...,$S,... } = require('express-xss-sanitizer');\n...\n" + - pattern-inside: "$S = require(\"express-xss-sanitizer\")\n...\n" - pattern: $S(...) - patterns: - pattern: $RES. ... .type('$F'). ... .send(...) @@ -12577,50 +10660,104 @@ rules: metavariable: $F regex: (?!.*text/html) - patterns: - - pattern-inside: '$X = [...]; - - ... - - ' + - pattern-inside: "$X = [...];\n...\n" - pattern: "if(<... !$X.includes($SOURCE)...>) {\n ...\n return ...\n}\n...\n" - pattern: $SOURCE + pattern-sinks: + - patterns: + - pattern-inside: function ... (..., $RES,...) {...} + - pattern-either: + - pattern: $RES.write($ARG) + - pattern: $RES.send($ARG) + - pattern-not: $RES. ... .set('...'). ... .send($ARG) + - pattern-not: $RES. ... .type('...'). ... .send($ARG) + - pattern-not-inside: $RES.$METHOD({ ... }) + - focus-metavariable: $ARG + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options) + - pattern-not-inside: "function ... ($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" + - pattern-not-inside: "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n\ + })\n" + - pattern-not-inside: "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" + - pattern-not-inside: "function ... ($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n}\n" + - pattern-not-inside: "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n})\n" + - pattern-not-inside: "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.set('$TYPE')\n}\n" + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - patterns: + - pattern-either: + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" + - pattern-not-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.$SET('Content-Type', + '$TYPE')\n}\n" + - pattern-not-inside: "({ $REQ }: Request,$RES: Response) => {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" + - pattern-not-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.set('$TYPE')\n\ + }\n" + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: body + severity: WARNING - id: javascript.express.security.cors-misconfiguration.cors-misconfiguration - message: By letting user input control CORS parameters, there is a risk that software does not properly verify that the - source of data or communication is valid. Use literal values for CORS settings. + languages: + - javascript + - typescript + message: By letting user input control CORS parameters, there is a risk that software does not properly verify that + the source of data or communication is valid. Use literal values for CORS settings. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-346: Origin Validation Error' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - cwe: - - 'CWE-346: Origin Validation Error' - category: security references: - https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS - technology: - - express - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration - shortlink: https://sg.run/nKXO semgrep.dev: rule: + origin: community r_id: 13580 - rv_id: 1263162 rule_id: 5rULJQ + rv_id: 1263162 + url: + https://semgrep.dev/playground/r/YDTZe8Y/javascript.express.security.cors-misconfiguration.cors-misconfiguration version_id: YDTZe8Y - url: https://semgrep.dev/playground/r/YDTZe8Y/javascript.express.security.cors-misconfiguration.cors-misconfiguration - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/nKXO + source: https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Improper Authentication mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.set($HEADER, $X) + - pattern: $RES.header($HEADER, $X) + - pattern: $RES.setHeader($HEADER, $X) + - pattern: "$RES.set({$HEADER: $X}, ...)\n" + - pattern: "$RES.writeHead($STATUS, {$HEADER: $X}, ...)\n" + - focus-metavariable: $X + - metavariable-regex: + metavariable: $HEADER + regex: .*(Access-Control-Allow-Origin|access-control-allow-origin).* pattern-sources: - patterns: - pattern-either: @@ -12641,14 +10778,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -12656,70 +10787,67 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern: $RES.set($HEADER, $X) - - pattern: $RES.header($HEADER, $X) - - pattern: $RES.setHeader($HEADER, $X) - - pattern: '$RES.set({$HEADER: $X}, ...) - - ' - - pattern: '$RES.writeHead($STATUS, {$HEADER: $X}, ...) - - ' - - focus-metavariable: $X - - metavariable-regex: - metavariable: $HEADER - regex: .*(Access-Control-Allow-Origin|access-control-allow-origin).* + severity: WARNING - id: javascript.express.security.express-expat-xxe.express-expat-xxe - message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal - Entity (XXE) Processing vulnerabilities. - options: - interfile: true + languages: + - javascript + - typescript + message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or + Internal Entity (XXE) Processing vulnerabilities. metadata: - interfile: true - owasp: - - A04:2017 - XML External Entities (XXE) - - A05:2021 - Security Misconfiguration - - A02:2025 - Security Misconfiguration - cwe: - - 'CWE-611: Improper Restriction of XML External Entity Reference' asvs: - section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding version: '4' - references: - - https://github.com/astro/node-expat category: security - technology: - - express - cwe2022-top25: true + confidence: MEDIUM + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM + interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe - shortlink: https://sg.run/BkXx + likelihood: MEDIUM + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://github.com/astro/node-expat semgrep.dev: rule: + origin: community r_id: 9251 - rv_id: 1263164 rule_id: zdUkJl - version_id: o5TbD5l + rv_id: 1263164 url: https://semgrep.dev/playground/r/o5TbD5l/javascript.express.security.express-expat-xxe.express-expat-xxe - origin: community - languages: - - javascript - - typescript - severity: ERROR + version_id: o5TbD5l + shortlink: https://sg.run/BkXx + source: https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe + subcategory: + - vuln + technology: + - express + vulnerability_class: + - XML Injection mode: taint + options: + interfile: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "$XML = require('node-expat')\n...\n" + - pattern-inside: "import $XML from 'node-expat'\n...\n" + - pattern-inside: "import * as $XML from 'node-expat'\n...\n" + - pattern-either: + - pattern-inside: "$PARSER = new $XML.Parser(...);\n...\n" + - pattern-either: + - pattern: $PARSER.parse($QUERY) + - pattern: $PARSER.write($QUERY) + - focus-metavariable: $QUERY pattern-sources: - patterns: - pattern-either: @@ -12740,14 +10868,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -12755,50 +10877,44 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '$XML = require(''node-expat'') - - ... - - ' - - pattern-inside: 'import $XML from ''node-expat'' - - ... - - ' - - pattern-inside: 'import * as $XML from ''node-expat'' - - ... - - ' - - pattern-either: - - pattern-inside: '$PARSER = new $XML.Parser(...); - - ... - - ' - - pattern-either: - - pattern: $PARSER.parse($QUERY) - - pattern: $PARSER.write($QUERY) - - focus-metavariable: $QUERY + severity: ERROR - id: javascript.express.security.express-insecure-template-usage.express-insecure-template-usage - message: User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) - vulnerability. - options: - interfile: true + languages: + - javascript + - typescript + message: User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection + (SSTI) vulnerability. metadata: - interfile: true category: security + confidence: MEDIUM cwe: - 'CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine' + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A01:2017 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html + semgrep.dev: + rule: + origin: community + r_id: 19226 + rule_id: EwUr9k + rv_id: 1263165 + url: + https://semgrep.dev/playground/r/zyTb2eD/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage + version_id: zyTb2eD + shortlink: https://sg.run/b49v + source: + https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage + source_rule_url: + - https://github.com/github/codeql/blob/2ba2642c7ab29b9eedef33bcc2b8cd1d203d0c10/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/template-sinks.js + subcategory: + - vuln technology: - javascript - typescript @@ -12814,94 +10930,23 @@ rules: - hogan.js - eta - squirrelly - source_rule_url: - - https://github.com/github/codeql/blob/2ba2642c7ab29b9eedef33bcc2b8cd1d203d0c10/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/template-sinks.js - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection - source: https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage - shortlink: https://sg.run/b49v - semgrep.dev: - rule: - r_id: 19226 - rv_id: 1263165 - rule_id: EwUr9k - version_id: zyTb2eD - url: https://semgrep.dev/playground/r/zyTb2eD/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage - origin: community - languages: - - javascript - - typescript - severity: WARNING mode: taint + options: + interfile: true pattern-propagators: - - pattern: $MODEL.$FIND($E).then((...,$S,...)=>{...}) - from: $E + - from: $E + pattern: $MODEL.$FIND($E).then((...,$S,...)=>{...}) to: $S - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: function ... ($REQ, $RES) {...} - - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - - patterns: - - pattern-either: - - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - - metavariable-regex: - metavariable: $METHOD - regex: ^(get|post|put|head|delete|options)$ - - pattern-either: - - pattern: $REQ.query - - pattern: $REQ.body - - pattern: $REQ.params - - pattern: $REQ.cookies - - pattern: $REQ.headers - - patterns: - - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' - - focus-metavariable: $REQ - - pattern-either: - - pattern: params - - pattern: query - - pattern: cookies - - pattern: headers - - pattern: body pattern-sinks: - pattern-either: - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''pug'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''pug'' - - ... - - ' - - pattern-inside: '$PUG = require(''jade'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''jade'' - - ... - - ' + - pattern-inside: "$PUG = require('pug')\n...\n" + - pattern-inside: "import * as $PUG from 'pug'\n...\n" + - pattern-inside: "$PUG = require('jade')\n...\n" + - pattern-inside: "import * as $PUG from 'jade'\n...\n" - pattern-either: - pattern: $PUG.compile(...) - pattern: $PUG.compileClient(...) @@ -12909,234 +10954,183 @@ rules: - pattern: $PUG.render(...) - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''dot'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''dot'' - - ... - - ' + - pattern-inside: "$PUG = require('dot')\n...\n" + - pattern-inside: "import * as $PUG from 'dot'\n...\n" - pattern-either: - pattern: $PUG.template(...) - pattern: $PUG.compile(...) - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''ejs'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''ejs'' - - ... - - ' + - pattern-inside: "$PUG = require('ejs')\n...\n" + - pattern-inside: "import * as $PUG from 'ejs'\n...\n" - pattern-either: - pattern: $PUG.render(...) - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''nunjucks'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''nunjucks'' - - ... - - ' + - pattern-inside: "$PUG = require('nunjucks')\n...\n" + - pattern-inside: "import * as $PUG from 'nunjucks'\n...\n" - pattern-either: - pattern: $PUG.renderString(...) - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''lodash'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''lodash'' - - ... - - ' + - pattern-inside: "$PUG = require('lodash')\n...\n" + - pattern-inside: "import * as $PUG from 'lodash'\n...\n" - pattern-either: - pattern: $PUG.template(...) - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''mustache'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''mustache'' - - ... - - ' - - pattern-inside: '$PUG = require(''eta'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''eta'' - - ... - - ' - - pattern-inside: '$PUG = require(''squirrelly'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''squirrelly'' - - ... - - ' + - pattern-inside: "$PUG = require('mustache')\n...\n" + - pattern-inside: "import * as $PUG from 'mustache'\n...\n" + - pattern-inside: "$PUG = require('eta')\n...\n" + - pattern-inside: "import * as $PUG from 'eta'\n...\n" + - pattern-inside: "$PUG = require('squirrelly')\n...\n" + - pattern-inside: "import * as $PUG from 'squirrelly'\n...\n" - pattern-either: - pattern: $PUG.render(...) - patterns: - pattern-either: - - pattern-inside: '$PUG = require(''hogan.js'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''hogan.js'' - - ... - - ' - - pattern-inside: '$PUG = require(''handlebars'') - - ... - - ' - - pattern-inside: 'import * as $PUG from ''handlebars'' - - ... - - ' + - pattern-inside: "$PUG = require('hogan.js')\n...\n" + - pattern-inside: "import * as $PUG from 'hogan.js'\n...\n" + - pattern-inside: "$PUG = require('handlebars')\n...\n" + - pattern-inside: "import * as $PUG from 'handlebars'\n...\n" - pattern-either: - pattern: $PUG.compile(...) + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: function ... ($REQ, $RES) {...} + - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} + - patterns: + - pattern-either: + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) + - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) + - metavariable-regex: + metavariable: $METHOD + regex: ^(get|post|put|head|delete|options)$ + - pattern-either: + - pattern: $REQ.query + - pattern: $REQ.body + - pattern: $REQ.params + - pattern: $REQ.cookies + - pattern: $REQ.headers + - patterns: + - pattern-either: + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" + - focus-metavariable: $REQ + - pattern-either: + - pattern: params + - pattern: query + - pattern: cookies + - pattern: headers + - pattern: body + severity: WARNING - id: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). - options: - interfile: true + languages: + - javascript + - typescript + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - interfile: true + category: security + confidence: HIGH cwe: - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - category: security - technology: - - express - - secrets - cwe2022-top25: true cwe2021-top25: true - subcategory: - - audit - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: HIGH + interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret - shortlink: https://sg.run/Do1d + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9252 - rv_id: 1263166 rule_id: pKUOjy + rv_id: 1263166 + url: + https://semgrep.dev/playground/r/pZT03Q0/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret version_id: pZT03Q0 - url: https://semgrep.dev/playground/r/pZT03Q0/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/Do1d + source: https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret + subcategory: + - audit + technology: + - express + - secrets + vulnerability_class: + - Hard-coded Secrets + options: + interfile: true patterns: - pattern-either: - - pattern-inside: '$JWT = require(''express-jwt''); - - ... - - ' - - pattern-inside: 'import $JWT from ''express-jwt''; - - ... - - ' - - pattern-inside: 'import * as $JWT from ''express-jwt''; - - ... - - ' - - pattern-inside: 'import { ..., $JWT, ... } from ''express-jwt''; - - ... - - ' + - pattern-inside: "$JWT = require('express-jwt');\n...\n" + - pattern-inside: "import $JWT from 'express-jwt';\n...\n" + - pattern-inside: "import * as $JWT from 'express-jwt';\n...\n" + - pattern-inside: "import { ..., $JWT, ... } from 'express-jwt';\n...\n" - pattern-either: - - pattern: '$JWT({...,secret: "$Y",...},...) - - ' - - pattern: '$OPTS = "$Y"; - - ... - - $JWT({...,secret: $OPTS},...); - - ' + - pattern: "$JWT({...,secret: \"$Y\",...},...)\n" + - pattern: "$OPTS = \"$Y\";\n...\n$JWT({...,secret: $OPTS},...);\n" - focus-metavariable: $Y + severity: WARNING - id: javascript.express.security.express-phantom-injection.express-phantom-injection - message: If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities + languages: + - javascript + - typescript + message: If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery + vulnerabilities metadata: - owasp: - - A10:2021 - Server-Side Request Forgery (SSRF) - - A01:2025 - Broken Access Control + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' - category: security - technology: - - express - references: - - https://phantomjs.org/page-automation.html - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection - shortlink: https://sg.run/W8BL + likelihood: MEDIUM + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://phantomjs.org/page-automation.html semgrep.dev: rule: + origin: community r_id: 9253 - rv_id: 1263167 rule_id: 2ZUbx3 + rv_id: 1263167 + url: + https://semgrep.dev/playground/r/2KTv26p/javascript.express.security.express-phantom-injection.express-phantom-injection version_id: 2KTv26p - url: https://semgrep.dev/playground/r/2KTv26p/javascript.express.security.express-phantom-injection.express-phantom-injection - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/W8BL + source: https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "require('phantom');\n...\n" + - pattern-inside: "import 'phantom';\n...\n" + - pattern-either: + - pattern: $PAGE.open($SINK,...) + - pattern: $PAGE.setContent($SINK,...) + - pattern: $PAGE.openUrl($SINK,...) + - pattern: $PAGE.evaluateJavaScript($SINK,...) + - pattern: $PAGE.property("content",$SINK,...) + - focus-metavariable: $SINK pattern-sources: - patterns: - pattern-either: @@ -13157,14 +11151,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -13172,64 +11160,61 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: 'require(''phantom''); - - ... - - ' - - pattern-inside: 'import ''phantom''; - - ... - - ' - - pattern-either: - - pattern: $PAGE.open($SINK,...) - - pattern: $PAGE.setContent($SINK,...) - - pattern: $PAGE.openUrl($SINK,...) - - pattern: $PAGE.evaluateJavaScript($SINK,...) - - pattern: $PAGE.property("content",$SINK,...) - - focus-metavariable: $SINK + severity: ERROR - id: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection - message: If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities + languages: + - javascript + - typescript + message: If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery + vulnerabilities metadata: - owasp: - - A10:2021 - Server-Side Request Forgery (SSRF) - - A01:2025 - Broken Access Control + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' - category: security - technology: - - express - references: - - https://pptr.dev/api/puppeteer.page - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection - shortlink: https://sg.run/0QJB + likelihood: MEDIUM + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://pptr.dev/api/puppeteer.page semgrep.dev: rule: + origin: community r_id: 9254 - rv_id: 1263168 rule_id: X5U8Nz + rv_id: 1263168 + url: + https://semgrep.dev/playground/r/X0TzyJY/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection version_id: X0TzyJY - url: https://semgrep.dev/playground/r/X0TzyJY/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/0QJB + source: https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "require('puppeteer');\n...\n" + - pattern-inside: "import 'puppeteer';\n...\n" + - pattern-either: + - pattern: $PAGE.goto($SINK,...) + - pattern: $PAGE.setContent($SINK,...) + - pattern: $PAGE.evaluate($SINK,...) + - pattern: $PAGE.evaluate($CODE,$SINK,...) + - pattern: $PAGE.evaluateHandle($SINK,...) + - pattern: $PAGE.evaluateHandle($CODE,$SINK,...) + - pattern: $PAGE.evaluateOnNewDocument($SINK,...) + - pattern: $PAGE.evaluateOnNewDocument($CODE,$SINK,...) + - focus-metavariable: $SINK pattern-sources: - patterns: - pattern-either: @@ -13250,14 +11235,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -13265,66 +11244,53 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: 'require(''puppeteer''); - - ... - - ' - - pattern-inside: 'import ''puppeteer''; - - ... - - ' - - pattern-either: - - pattern: $PAGE.goto($SINK,...) - - pattern: $PAGE.setContent($SINK,...) - - pattern: $PAGE.evaluate($SINK,...) - - pattern: $PAGE.evaluate($CODE,$SINK,...) - - pattern: $PAGE.evaluateHandle($SINK,...) - - pattern: $PAGE.evaluateHandle($CODE,$SINK,...) - - pattern: $PAGE.evaluateOnNewDocument($SINK,...) - - pattern: $PAGE.evaluateOnNewDocument($CODE,$SINK,...) - - focus-metavariable: $SINK + severity: ERROR - id: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection + languages: + - javascript + - typescript message: Make sure that unverified user data can not reach `sandbox`. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html - cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' - category: security - technology: - - express - cwe2022-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection - shortlink: https://sg.run/KlwL semgrep.dev: rule: + origin: community r_id: 9255 - rv_id: 1263169 rule_id: j2UvXB + rv_id: 1263169 + url: + https://semgrep.dev/playground/r/jQTn59D/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection version_id: jQTn59D - url: https://semgrep.dev/playground/r/jQTn59D/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/KlwL + source: https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Code Injection mode: taint + pattern-sinks: + - patterns: + - pattern-inside: "$SANDBOX = require('sandbox');\n...\n" + - pattern-either: + - patterns: + - pattern-inside: "$S = new $SANDBOX(...);\n...\n" + - pattern: "$S.run(...)\n" + - pattern: "new $SANDBOX($OPTS).run(...)\n" + - pattern: new $SANDBOX().run(...) pattern-sources: - patterns: - pattern-either: @@ -13345,14 +11311,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -13360,64 +11320,53 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-inside: '$SANDBOX = require(''sandbox''); - - ... - - ' - - pattern-either: - - patterns: - - pattern-inside: '$S = new $SANDBOX(...); - - ... - - ' - - pattern: '$S.run(...) - - ' - - pattern: 'new $SANDBOX($OPTS).run(...) - - ' - - pattern: new $SANDBOX().run(...) + severity: ERROR - id: javascript.express.security.express-vm-injection.express-vm-injection + languages: + - javascript + - typescript message: Make sure that unverified user data can not reach `$VM`. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html - cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' - category: security - technology: - - express - cwe2022-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection - shortlink: https://sg.run/jkqJ semgrep.dev: rule: + origin: community r_id: 12821 - rv_id: 1263170 rule_id: DbUKPX + rv_id: 1263170 + url: + https://semgrep.dev/playground/r/1QTypXQ/javascript.express.security.express-vm-injection.express-vm-injection version_id: 1QTypXQ - url: https://semgrep.dev/playground/r/1QTypXQ/javascript.express.security.express-vm-injection.express-vm-injection - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/jkqJ + source: https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Code Injection mode: taint + pattern-sinks: + - patterns: + - pattern-inside: "$VM = require('vm');\n...\n" + - pattern-either: + - pattern: "$VM.runInContext(...)\n" + - pattern: "$VM.runInNewContext(...)\n" + - pattern: "$VM.compileFunction(...)\n" + - pattern: "$VM.runInThisContext(...)\n" + - pattern: new $VM.Script(...) pattern-sources: - patterns: - pattern-either: @@ -13438,14 +11387,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -13453,64 +11396,58 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-inside: '$VM = require(''vm''); - - ... - - ' - - pattern-either: - - pattern: '$VM.runInContext(...) - - ' - - pattern: '$VM.runInNewContext(...) - - ' - - pattern: '$VM.compileFunction(...) - - ' - - pattern: '$VM.runInThisContext(...) - - ' - - pattern: new $VM.Script(...) + severity: ERROR - id: javascript.express.security.express-vm2-injection.express-vm2-injection + languages: + - javascript + - typescript message: Make sure that unverified user data can not reach `vm2`. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html - cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' - category: security - technology: - - express - cwe2022-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection - shortlink: https://sg.run/1GWv semgrep.dev: rule: + origin: community r_id: 12822 - rv_id: 1263171 rule_id: WAUPXJ + rv_id: 1263171 + url: + https://semgrep.dev/playground/r/9lT4bnX/javascript.express.security.express-vm2-injection.express-vm2-injection version_id: 9lT4bnX - url: https://semgrep.dev/playground/r/9lT4bnX/javascript.express.security.express-vm2-injection.express-vm2-injection - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/1GWv + source: https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Code Injection mode: taint + pattern-sinks: + - patterns: + - pattern-inside: "require('vm2')\n...\n" + - pattern-either: + - patterns: + - pattern-either: + - pattern-inside: "$VM = new VM(...)\n...\n" + - pattern-inside: "$VM = new NodeVM(...)\n...\n" + - pattern: "$VM.run(...)\n" + - pattern: "new VM(...).run(...)\n" + - pattern: "new NodeVM(...).run(...)\n" + - pattern: "new VMScript(...)\n" + - pattern: "new VM(...)\n" + - pattern: new NodeVM(...) pattern-sources: - patterns: - pattern-either: @@ -13531,14 +11468,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -13546,87 +11477,60 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-inside: 'require(''vm2'') - - ... - - ' - - pattern-either: - - patterns: - - pattern-either: - - pattern-inside: '$VM = new VM(...) - - ... - - ' - - pattern-inside: '$VM = new NodeVM(...) - - ... - - ' - - pattern: '$VM.run(...) - - ' - - pattern: 'new VM(...).run(...) - - ' - - pattern: 'new NodeVM(...).run(...) - - ' - - pattern: 'new VMScript(...) - - ' - - pattern: 'new VM(...) - - ' - - pattern: new NodeVM(...) + severity: WARNING - id: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe - message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal - Entity (XXE) Processing vulnerabilities + languages: + - javascript + - typescript + message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or + Internal Entity (XXE) Processing vulnerabilities metadata: - owasp: - - A04:2017 - XML External Entities (XXE) - - A05:2021 - Security Misconfiguration - - A02:2025 - Security Misconfiguration - cwe: - - 'CWE-611: Improper Restriction of XML External Entity Reference' asvs: - section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding version: '4' category: security - technology: - - express - references: - - https://www.npmjs.com/package/xml2json - cwe2022-top25: true + confidence: MEDIUM + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe - shortlink: https://sg.run/XBD4 + likelihood: MEDIUM + owasp: + - A04:2017 - XML External Entities (XXE) + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://www.npmjs.com/package/xml2json semgrep.dev: rule: + origin: community r_id: 9264 - rv_id: 1263174 rule_id: x8Uneb + rv_id: 1263174 + url: + https://semgrep.dev/playground/r/bZT534J/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe version_id: bZT534J - url: https://semgrep.dev/playground/r/bZT534J/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/XBD4 + source: https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe + subcategory: + - vuln + technology: + - express + vulnerability_class: + - XML Injection mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "require('xml2json');\n...\n" + - pattern-inside: "import 'xml2json';\n...\n" + - pattern: $EXPAT.toJson($SINK,...) + - focus-metavariable: $SINK pattern-sources: - patterns: - pattern-either: @@ -13649,14 +11553,8 @@ rules: - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -13666,66 +11564,68 @@ rules: - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: 'require(''xml2json''); - - ... - - ' - - pattern-inside: 'import ''xml2json''; - - ... - - ' - - pattern: $EXPAT.toJson($SINK,...) - - focus-metavariable: $SINK + severity: ERROR - id: javascript.express.security.injection.raw-html-format.raw-html-format - message: User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting - (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to - sanitize the HTML within. + languages: + - javascript + - typescript + message: User data flows into the host portion of this manually-constructed HTML. This can introduce a + Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization + library such as DOMPurify to sanitize the HTML within. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html - category: security - technology: - - express - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format - shortlink: https://sg.run/5DO3 semgrep.dev: rule: + origin: community r_id: 14691 - rv_id: 1263175 rule_id: 5rUL0X + rv_id: 1263175 + url: + https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format version_id: NdTzyQv - url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format - origin: community - languages: - - javascript - - typescript - severity: WARNING - mode: taint - pattern-sources: - - label: EXPRESS - patterns: - - pattern-either: + shortlink: https://sg.run/5DO3 + source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Cross-Site-Scripting (XSS) + mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: '"$HTMLSTR" + $EXPR' + - pattern: '"$HTMLSTR".concat(...)' + - pattern: util.format($HTMLSTR, ...) + - metavariable-pattern: + language: generic + metavariable: $HTMLSTR + pattern: <$TAG ... + - patterns: + - pattern: "`...`\n" + - pattern-regex: ".*<\\w+.*\n" + requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN) + pattern-sources: + - label: EXPRESS + patterns: + - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: @@ -13744,14 +11644,8 @@ rules: - label: EXPRESSTS patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -13759,8 +11653,8 @@ rules: - pattern: cookies - pattern: headers - pattern: body - - label: CLEAN - by-side-effect: true + - by-side-effect: true + label: CLEAN patterns: - pattern-either: - pattern: $A($SOURCE) @@ -13770,67 +11664,51 @@ rules: - metavariable-regex: metavariable: $A regex: (?i)(.*valid|.*sanitiz) - pattern-sinks: - - requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN) - patterns: - - pattern-either: - - patterns: - - pattern-either: - - pattern: '"$HTMLSTR" + $EXPR' - - pattern: '"$HTMLSTR".concat(...)' - - pattern: util.format($HTMLSTR, ...) - - metavariable-pattern: - metavariable: $HTMLSTR - language: generic - pattern: <$TAG ... - - patterns: - - pattern: '`...` - - ' - - pattern-regex: '.*<\w+.* - - ' + severity: WARNING - id: javascript.express.security.require-request.require-request - message: If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the - server. - options: - interfile: true + languages: + - javascript + - typescript + message: If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on + the server. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' + impact: MEDIUM interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-706: Use of Incorrectly-Resolved Name or Reference' - source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html - category: security - technology: - - express references: - https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/javascript.express.security.require-request.require-request - shortlink: https://sg.run/jRbl semgrep.dev: rule: + origin: community r_id: 9265 - rv_id: 1263177 rule_id: OrU3WK - version_id: w8TRo0d + rv_id: 1263177 url: https://semgrep.dev/playground/r/w8TRo0d/javascript.express.security.require-request.require-request - origin: community - languages: - - javascript - - typescript - severity: ERROR + version_id: w8TRo0d + shortlink: https://sg.run/jRbl + source: https://semgrep.dev/r/javascript.express.security.require-request.require-request + source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Improper Authorization mode: taint + options: + interfile: true + pattern-sinks: + - patterns: + - pattern: require($SINK) + - focus-metavariable: $SINK pattern-sources: - patterns: - pattern-either: @@ -13851,14 +11729,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -13866,47 +11738,56 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern: require($SINK) - - focus-metavariable: $SINK + severity: ERROR - id: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration - message: By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify - whether or not a browser should be allowed to render a page in an `iframe`. + languages: + - javascript + - typescript + message: By letting user input control `X-Frame-Options` header, there is a risk that software does not properly + verify whether or not a browser should be allowed to render a page in an `iframe`. metadata: - references: - - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options - owasp: - - A04:2021 - Insecure Design - - A06:2025 - Insecure Design + category: security + confidence: MEDIUM cwe: - 'CWE-451: User Interface (UI) Misrepresentation of Critical Information' - category: security - technology: - - express - subcategory: - - vuln - likelihood: MEDIUM impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration - shortlink: https://sg.run/EvjA + likelihood: MEDIUM + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options semgrep.dev: rule: + origin: community r_id: 13581 - rv_id: 1263178 rule_id: GdUrLy + rv_id: 1263178 + url: + https://semgrep.dev/playground/r/xyTjz3D/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration version_id: xyTjz3D - url: https://semgrep.dev/playground/r/xyTjz3D/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/EvjA + source: + https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration + subcategory: + - vuln + technology: + - express + vulnerability_class: + - Other mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $RES.set($HEADER, ...) + - pattern: $RES.header($HEADER, ...) + - pattern: $RES.setHeader($HEADER, ...) + - pattern: "$RES.set({$HEADER: ...}, ...)\n" + - pattern: "$RES.writeHead($STATUS, {$HEADER: ...}, ...)\n" + - metavariable-regex: + metavariable: $HEADER + regex: .*(X-Frame-Options|x-frame-options).* pattern-sources: - patterns: - pattern-either: @@ -13927,14 +11808,8 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -13942,447 +11817,344 @@ rules: - pattern: cookies - pattern: headers - pattern: body - pattern-sinks: - - patterns: - - pattern-either: - - pattern: $RES.set($HEADER, ...) - - pattern: $RES.header($HEADER, ...) - - pattern: $RES.setHeader($HEADER, ...) - - pattern: '$RES.set({$HEADER: ...}, ...) - - ' - - pattern: '$RES.writeHead($STATUS, {$HEADER: ...}, ...) - - ' - - metavariable-regex: - metavariable: $HEADER - regex: .*(X-Frame-Options|x-frame-options).* + severity: WARNING - id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + languages: + - javascript + - typescript + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - interfile: true - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures asvs: - section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' version: '4' category: security - technology: - - jose - - jwt - - secrets - cwe2022-top25: true + confidence: HIGH + cwe: + - 'CWE-798: Use of Hard-coded Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: HIGH + interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret - shortlink: https://sg.run/Ro1g + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9293 - rv_id: 1263182 rule_id: JDUyRl - version_id: d6TyxbX + rv_id: 1263182 url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: d6TyxbX + shortlink: https://sg.run/Ro1g + source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret + subcategory: + - vuln + technology: + - jose + - jwt + - secrets + vulnerability_class: + - Hard-coded Secrets + options: + interfile: true + symbolic_propagation: true patterns: - - pattern-inside: '$JOSE = require("jose"); - - ... - - ' + - pattern-inside: "$JOSE = require(\"jose\");\n...\n" - pattern-either: - - pattern-inside: 'var {JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'var {JWK, JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'const {JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'const {JWK, JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'let {JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'let {JWK, JWT} = $JOSE; - - ... - - ' + - pattern-inside: "var {JWT} = $JOSE;\n...\n" + - pattern-inside: "var {JWK, JWT} = $JOSE;\n...\n" + - pattern-inside: "const {JWT} = $JOSE;\n...\n" + - pattern-inside: "const {JWK, JWT} = $JOSE;\n...\n" + - pattern-inside: "let {JWT} = $JOSE;\n...\n" + - pattern-inside: "let {JWK, JWT} = $JOSE;\n...\n" - pattern-either: - - pattern: 'JWT.verify($P, "...", ...); - - ' - - pattern: 'JWT.sign($P, "...", ...); - - ' + - pattern: "JWT.verify($P, \"...\", ...);\n" + - pattern: "JWT.sign($P, \"...\", ...);\n" - pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...); \n" - - pattern: '$JWT.sign($P, JWK.asKey("..."), ...); - - ' - options: - symbolic_propagation: true - interfile: true + - pattern: "$JWT.sign($P, JWK.asKey(\"...\"), ...);\n" + severity: WARNING - id: javascript.jose.security.jwt-none-alg.jwt-none-alg - message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has - already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do - not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + languages: + - javascript + - typescript + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token + has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be + verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: + asvs: + control_id: 3.5.3 Insecue Stateless Session Tokens + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - asvs: - section: 'V3: Session Management Verification Requirements' - control_id: 3.5.3 Insecue Stateless Session Tokens - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management - version: '4' - category: security - technology: - - jose - - jwt - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg - shortlink: https://sg.run/AvRL semgrep.dev: rule: + origin: community r_id: 9294 - rv_id: 1263183 rule_id: 5rUOGN - version_id: ZRTKAyb + rv_id: 1263183 url: https://semgrep.dev/playground/r/ZRTKAyb/javascript.jose.security.jwt-none-alg.jwt-none-alg - origin: community + version_id: ZRTKAyb + shortlink: https://sg.run/AvRL + source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - vuln + technology: + - jose + - jwt + vulnerability_class: + - Cryptographic Issues + pattern-either: + - pattern: "var $JOSE = require(\"jose\");\n...\nvar { JWK, JWT } = $JOSE;\n...\nvar $T = JWT.verify($P, JWK.None,...);\n" + - pattern: "var $JOSE = require(\"jose\");\n...\nvar { JWK, JWT } = $JOSE;\n...\n$T = JWT.verify($P, JWK.None,...);\n" + - pattern: "var $JOSE = require(\"jose\");\n...\nvar { JWK, JWT } = $JOSE;\n...\nJWT.verify($P, JWK.None,...);\n" + severity: ERROR +- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret languages: - javascript - typescript - severity: ERROR - pattern-either: - - pattern: 'var $JOSE = require("jose"); - - ... - - var { JWK, JWT } = $JOSE; - - ... - - var $T = JWT.verify($P, JWK.None,...); - - ' - - pattern: 'var $JOSE = require("jose"); - - ... - - var { JWK, JWT } = $JOSE; - - ... - - $T = JWT.verify($P, JWK.None,...); - - ' - - pattern: 'var $JOSE = require("jose"); - - ... - - var { JWK, JWT } = $JOSE; - - ... - - JWT.verify($P, JWK.None,...); - - ' -- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures asvs: - section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' version: '4' category: security - technology: - - jwt - - javascript - - secrets - cwe2022-top25: true + confidence: HIGH + cwe: + - 'CWE-798: Use of Hard-coded Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret - shortlink: https://sg.run/4xN9 + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9300 - rv_id: 1263189 rule_id: WAUon7 - version_id: gETB75D + rv_id: 1263189 url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: gETB75D + shortlink: https://sg.run/4xN9 + source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret + subcategory: + - vuln + technology: + - jwt + - javascript + - secrets + vulnerability_class: + - Hard-coded Secrets mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "$JWT = require(\"jsonwebtoken\")\n...\n" + - pattern-inside: "import $JWT from \"jsonwebtoken\"\n...\n" + - pattern-inside: "import * as $JWT from \"jsonwebtoken\"\n...\n" + - pattern-inside: "import {...,$JWT,...} from \"jsonwebtoken\"\n...\n" + - pattern-either: + - pattern-inside: "$JWT.sign($DATA,$VALUE,...);\n" + - pattern-inside: "$JWT.verify($DATA,$VALUE,...);\n" + - focus-metavariable: $VALUE pattern-sources: - patterns: - pattern: "$X = '...' \n" - pattern: "$X = '$Y' \n" - patterns: - pattern-either: - - pattern-inside: '$JWT.sign($DATA,"...",...); - - ' - - pattern-inside: '$JWT.verify($DATA,"...",...); - - ' - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '$JWT = require("jsonwebtoken") - - ... - - ' - - pattern-inside: 'import $JWT from "jsonwebtoken" - - ... - - ' - - pattern-inside: 'import * as $JWT from "jsonwebtoken" - - ... - - ' - - pattern-inside: 'import {...,$JWT,...} from "jsonwebtoken" - - ... - - ' - - pattern-either: - - pattern-inside: '$JWT.sign($DATA,$VALUE,...); - - ' - - pattern-inside: '$JWT.verify($DATA,$VALUE,...); - - ' - - focus-metavariable: $VALUE + - pattern-inside: "$JWT.sign($DATA,\"...\",...);\n" + - pattern-inside: "$JWT.verify($DATA,\"...\",...);\n" + severity: WARNING - id: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg - message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has - already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do - not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + languages: + - javascript + - typescript + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token + has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be + verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: + asvs: + control_id: 3.5.3 Insecue Stateless Session Tokens + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' + version: '4' + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - asvs: - section: 'V3: Session Management Verification Requirements' - control_id: 3.5.3 Insecue Stateless Session Tokens - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management - version: '4' - category: security - technology: - - jwt - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg - shortlink: https://sg.run/PJXv semgrep.dev: rule: + origin: community r_id: 9301 - rv_id: 1263190 rule_id: 0oU53g - version_id: QkTGqQo + rv_id: 1263190 url: https://semgrep.dev/playground/r/QkTGqQo/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg - origin: community - languages: - - javascript - - typescript - severity: ERROR + version_id: QkTGqQo + shortlink: https://sg.run/PJXv + source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - vuln + technology: + - jwt + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: '$JWT = require("jsonwebtoken"); - - ... - - ' + - pattern-inside: "$JWT = require(\"jsonwebtoken\");\n...\n" - pattern: $JWT.verify($P, $X, {algorithms:[...,'none',...]},...) -- id: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify - message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the - token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` - before using the token. severity: ERROR +- id: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify + languages: + - javascript + - typescript + message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise + the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' + to `true` before using the token. metadata: - owasp: - - A05:2021 - Security Misconfiguration - - A07:2021 - Identification and Authentication Failures - - A02:2025 - Security Misconfiguration - - A07:2025 - Authentication Failures + category: security + confidence: HIGH cwe: - 'CWE-287: Improper Authentication' - 'CWE-345: Insufficient Verification of Data Authenticity' - 'CWE-347: Improper Verification of Cryptographic Signature' - category: security - subcategory: - - vuln - technology: - - jwt-simple - - jwt - confidence: HIGH - likelihood: MEDIUM impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A05:2021 - Security Misconfiguration + - A07:2021 - Identification and Authentication Failures + - A02:2025 - Security Misconfiguration + - A07:2025 - Authentication Failures references: - https://www.npmjs.com/package/jwt-simple - https://cwe.mitre.org/data/definitions/287 - https://cwe.mitre.org/data/definitions/345 - https://cwe.mitre.org/data/definitions/347 - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - - Improper Authentication - source: https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify - shortlink: https://sg.run/zdjod semgrep.dev: rule: + origin: community r_id: 120561 - rv_id: 1263191 rule_id: r6UyNLy + rv_id: 1263191 + url: + https://semgrep.dev/playground/r/3ZT4Xxv/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify version_id: 3ZT4Xxv - url: https://semgrep.dev/playground/r/3ZT4Xxv/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify - origin: community - languages: - - javascript - - typescript + shortlink: https://sg.run/zdjod + source: https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify + subcategory: + - vuln + technology: + - jwt-simple + - jwt + vulnerability_class: + - Cryptographic Issues + - Improper Authentication patterns: - - pattern-inside: '$JWT = require(''jwt-simple''); - - ... - - ' + - pattern-inside: "$JWT = require('jwt-simple');\n...\n" - pattern: $JWT.decode($TOKEN, $SECRET, $NOVERIFY, ...) - metavariable-pattern: metavariable: $NOVERIFY patterns: - pattern-either: - - pattern: 'true - - ' - - pattern: '"..." - - ' + - pattern: "true\n" + - pattern: "\"...\"\n" + severity: ERROR - id: javascript.lang.security.audit.code-string-concat.code-string-concat - message: Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead - to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible. - options: - interfile: true + languages: + - javascript + - typescript + message: Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can + lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever + possible. metadata: - interfile: true + category: security confidence: HIGH + cwe: + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: MEDIUM + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' references: - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval - https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback - https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/ - https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html - category: security + semgrep.dev: + rule: + origin: community + r_id: 13023 + rule_id: DbUKEz + rv_id: 1263192 + url: + https://semgrep.dev/playground/r/44TEjYX/javascript.lang.security.audit.code-string-concat.code-string-concat + version_id: 44TEjYX + shortlink: https://sg.run/96Yk + source: https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat + subcategory: + - vuln technology: - node.js - Express - Next.js - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection - source: https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat - shortlink: https://sg.run/96Yk - semgrep.dev: - rule: - r_id: 13023 - rv_id: 1263192 - rule_id: DbUKEz - version_id: 44TEjYX - url: https://semgrep.dev/playground/r/44TEjYX/javascript.lang.security.audit.code-string-concat.code-string-concat - origin: community - languages: - - javascript - - typescript - severity: ERROR mode: taint + options: + interfile: true + pattern-sinks: + - patterns: + - pattern: "eval(...)\n" pattern-sources: - pattern-either: - patterns: @@ -14404,100 +12176,80 @@ rules: - pattern: $REQ.headers - patterns: - pattern-either: - - pattern-inside: 'import { ...,$IMPORT,... } from ''next/router'' - - ... - - ' - - pattern-inside: 'import $IMPORT from ''next/router''; - - ... - - ' + - pattern-inside: "import { ...,$IMPORT,... } from 'next/router'\n...\n" + - pattern-inside: "import $IMPORT from 'next/router';\n...\n" - pattern-either: - patterns: - - pattern-inside: '$ROUTER = $IMPORT() - - ... - - ' + - pattern-inside: "$ROUTER = $IMPORT()\n...\n" - pattern-either: - - pattern-inside: 'const { ...,$PROPS,... } = $ROUTER.query - - ... - - ' - - pattern-inside: 'var { ...,$PROPS,... } = $ROUTER.query - - ... - - ' - - pattern-inside: 'let { ...,$PROPS,... } = $ROUTER.query - - ... - - ' + - pattern-inside: "const { ...,$PROPS,... } = $ROUTER.query\n...\n" + - pattern-inside: "var { ...,$PROPS,... } = $ROUTER.query\n...\n" + - pattern-inside: "let { ...,$PROPS,... } = $ROUTER.query\n...\n" - focus-metavariable: $PROPS - patterns: - - pattern-inside: '$ROUTER = $IMPORT() - - ... - - ' + - pattern-inside: "$ROUTER = $IMPORT()\n...\n" - pattern: "$ROUTER.query.$VALUE \n" - patterns: - pattern: $IMPORT().query.$VALUE - pattern-sinks: - - patterns: - - pattern: 'eval(...) - - ' + severity: ERROR - id: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli - message: 'Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled + languages: + - javascript + - typescript + message: "Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared - statements. An example of parameterized queries like so: `knex.raw(''SELECT $1 from table'', [userinput])` can help prevent - SQLi.' + statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent + SQLi." metadata: - confidence: MEDIUM - references: - - https://knexjs.org/#Builder-fromRaw - - https://knexjs.org/#Builder-whereRaw - - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - express - - nodejs - - knex - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli - shortlink: https://sg.run/l9eE + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://knexjs.org/#Builder-fromRaw + - https://knexjs.org/#Builder-whereRaw + - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 18257 - rv_id: 1263205 rule_id: d8UKLD - version_id: l4TJRey + rv_id: 1263205 url: https://semgrep.dev/playground/r/l4TJRey/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: l4TJRey + shortlink: https://sg.run/l9eE + source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli + subcategory: + - vuln + technology: + - express + - nodejs + - knex + vulnerability_class: + - SQL Injection mode: taint + pattern-sanitizers: + - patterns: + - pattern: parseInt(...) + pattern-sinks: + - patterns: + - focus-metavariable: $QUERY + - pattern-either: + - pattern-inside: $KNEX.fromRaw($QUERY, ...) + - pattern-inside: $KNEX.whereRaw($QUERY, ...) + - pattern-inside: $KNEX.raw($QUERY, ...) + - pattern-either: + - pattern-inside: "require('knex')\n...\n" + - pattern-inside: "import 'knex'\n...\n" pattern-sources: - patterns: - pattern-either: @@ -14520,14 +12272,8 @@ rules: - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -14537,65 +12283,66 @@ rules: - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') - pattern-sinks: - - patterns: - - focus-metavariable: $QUERY - - pattern-either: - - pattern-inside: $KNEX.fromRaw($QUERY, ...) - - pattern-inside: $KNEX.whereRaw($QUERY, ...) - - pattern-inside: $KNEX.raw($QUERY, ...) - - pattern-either: - - pattern-inside: 'require(''knex'') - - ... - - ' - - pattern-inside: 'import ''knex'' - - ... - - ' - pattern-sanitizers: - - patterns: - - pattern: parseInt(...) + severity: WARNING - id: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression - message: Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting - (XSS). Where possible avoid including user-input in functions which dynamically execute user-input. + languages: + - javascript + - typescript + message: Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to + Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute + user-input. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js references: - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval! - category: security - technology: - - javascript - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression - shortlink: https://sg.run/6nwK semgrep.dev: rule: + origin: community r_id: 9315 - rv_id: 1263214 rule_id: yyUngo + rv_id: 1263214 + url: + https://semgrep.dev/playground/r/WrTqKkJ/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression version_id: WrTqKkJ - url: https://semgrep.dev/playground/r/WrTqKkJ/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/6nwK + source: https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression + source-rule-url: + https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js + subcategory: + - vuln + technology: + - javascript + vulnerability_class: + - Code Injection mode: taint + pattern-sanitizers: + - patterns: + - pattern-either: + - pattern: location.href = $FUNC(...) + - pattern: location.hash = $FUNC(...) + - pattern: location.search = $FUNC(...) + - pattern: $WINDOW. ... .location.href = $FUNC(...) + - pattern: $WINDOW. ... .location.hash = $FUNC(...) + - pattern: $WINDOW. ... .location.search = $FUNC(...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: eval(<... $SINK ...>) + - pattern: window.eval(<... $SINK ...>) + - pattern: new Function(<... $SINK ...>) + - pattern: new Function(<... $SINK ...>)(...) + - pattern: setTimeout(<... $SINK ...>,...) + - pattern: setInterval(<... $SINK ...>,...) + - focus-metavariable: $SINK pattern-sources: - patterns: - pattern-either: @@ -14609,11 +12356,7 @@ rules: - pattern-inside: "$PROPS = new URLSearchParams($WINDOW. ... .location.search)\n ...\n" - pattern-inside: "$PROPS = new URLSearchParams(location.search)\n ...\n" - pattern-inside: "$PROPS = new\nURLSearchParams($WINDOW. ... .location.hash.substring(1))\n ...\n" - - pattern-inside: '$PROPS = new URLSearchParams(location.hash.substring(1)) - - ... - - ' + - pattern-inside: "$PROPS = new URLSearchParams(location.hash.substring(1))\n...\n" - pattern: $PROPS.get('...') - focus-metavariable: $PROPS - patterns: @@ -14624,317 +12367,241 @@ rules: - pattern: $WINDOW. ... .location.href - pattern: $WINDOW. ... .location.hash - pattern: $WINDOW. ... .location.search - pattern-sinks: - - patterns: - - pattern-either: - - pattern: eval(<... $SINK ...>) - - pattern: window.eval(<... $SINK ...>) - - pattern: new Function(<... $SINK ...>) - - pattern: new Function(<... $SINK ...>)(...) - - pattern: setTimeout(<... $SINK ...>,...) - - pattern: setInterval(<... $SINK ...>,...) - - focus-metavariable: $SINK - pattern-sanitizers: - - patterns: - - pattern-either: - - pattern: location.href = $FUNC(...) - - pattern: location.hash = $FUNC(...) - - pattern: location.search = $FUNC(...) - - pattern: $WINDOW. ... .location.href = $FUNC(...) - - pattern: $WINDOW. ... .location.hash = $FUNC(...) - - pattern: $WINDOW. ... .location.search = $FUNC(...) + severity: WARNING - id: javascript.node-crypto.security.aead-no-final.aead-no-final - message: The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing - to call 'final' will invalidate all integrity guarantees of the released ciphertext. + languages: + - javascript + - typescript + message: The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. + Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext. metadata: + category: security + confidence: HIGH cwe: - 'CWE-310: CWE CATEGORY: Cryptographic Issues' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - category: security - subcategory: - - vuln - technology: - - node-crypto - likelihood: HIGH - impact: MEDIUM - confidence: HIGH references: - https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/ - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final - shortlink: https://sg.run/r6EEA semgrep.dev: rule: + origin: community r_id: 146569 - rv_id: 1263222 rule_id: 2ZUz884 - version_id: zyTb2X0 + rv_id: 1263222 url: https://semgrep.dev/playground/r/zyTb2X0/javascript.node-crypto.security.aead-no-final.aead-no-final - origin: community - languages: - - javascript - - typescript - severity: ERROR + version_id: zyTb2X0 + shortlink: https://sg.run/r6EEA + source: https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final + subcategory: + - vuln + technology: + - node-crypto + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: '$DECIPHER = $CRYPTO.createDecipheriv(''$ALGO'', ...) - - ... - - $DECIPHER.update(...) - - ' - - pattern-not-inside: '$DECIPHER = $CRYPTO.createDecipheriv(''$ALGO'', ...) - - ... - - $DECIPHER.final(...) - - ' + - pattern: "$DECIPHER = $CRYPTO.createDecipheriv('$ALGO', ...)\n...\n$DECIPHER.update(...)\n" + - pattern-not-inside: "$DECIPHER = $CRYPTO.createDecipheriv('$ALGO', ...)\n...\n$DECIPHER.final(...)\n" - metavariable-regex: metavariable: $ALGO regex: .*(-gcm|-ccm|-ocb|chacha20-poly1305)$ + severity: ERROR - id: javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length - message: The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication - tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be - tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts - or recover the implicit authentication key of GCM, allowing arbitrary forgeries. + languages: + - javascript + - typescript + message: The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected + authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the + application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an + attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-310: CWE CATEGORY: Cryptographic Issues' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - category: security - subcategory: - - vuln - technology: - - node-crypto - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM references: - https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/ - https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/ - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length - shortlink: https://sg.run/NbGG1 semgrep.dev: rule: + origin: community r_id: 146571 - rv_id: 1263223 rule_id: j2UgPP3 + rv_id: 1263223 + url: + https://semgrep.dev/playground/r/pZT03qd/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length version_id: pZT03qd - url: https://semgrep.dev/playground/r/pZT03qd/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/NbGG1 + source: https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length + subcategory: + - vuln + technology: + - node-crypto + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: '$CRYPTO.createDecipheriv(''$ALGO'', $KEY, $IV) - - ' + - pattern: "$CRYPTO.createDecipheriv('$ALGO', $KEY, $IV)\n" - metavariable-regex: metavariable: $ALGO regex: .*(-gcm)$ + severity: ERROR - id: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + languages: + - javascript + - typescript + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures asvs: - section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' version: '4' category: security - technology: - - jwt - - nodejs - - secrets - cwe2022-top25: true + confidence: HIGH + cwe: + - 'CWE-798: Use of Hard-coded Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret - shortlink: https://sg.run/vz70 + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9333 - rv_id: 1263225 rule_id: QrUzq6 + rv_id: 1263225 + url: + https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret version_id: X0TzyoE - url: https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret - origin: community - languages: - - javascript - - typescript - severity: WARNING - mode: taint - pattern-sources: - - by-side-effect: true - patterns: + shortlink: https://sg.run/vz70 + source: https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret + subcategory: + - vuln + technology: + - jwt + - nodejs + - secrets + vulnerability_class: + - Hard-coded Secrets + mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "$F = require(\"$I\").Strategy\n...\n" + - pattern-inside: "$F = require(\"$I\")\n...\n" + - pattern-inside: "import { $STRAT as $F } from '$I'\n...\n" + - pattern-inside: "import $F from '$I'\n...\n" + - metavariable-regex: + metavariable: $I + regex: (passport-.*) + - pattern-inside: "new $F($VALUE,...)\n" + - focus-metavariable: $VALUE + pattern-sources: + - by-side-effect: true + patterns: - pattern-either: - - pattern: '{..., clientSecret: "...", ...} - - ' - - pattern: '{..., secretOrKey: "...", ...} - - ' - - pattern: '{..., consumerSecret: "...", ...} - - ' + - pattern: "{..., clientSecret: \"...\", ...}\n" + - pattern: "{..., secretOrKey: \"...\", ...}\n" + - pattern: "{..., consumerSecret: \"...\", ...}\n" - patterns: - - pattern-inside: '$OBJ = {} - - ... - - ' + - pattern-inside: "$OBJ = {}\n...\n" - pattern-either: - - pattern: '$OBJ.clientSecret = "..." - - ' - - pattern: '$OBJ.secretOrKey = "..." - - ' - - pattern: '$OBJ.consumerSecret = "..." - - ' + - pattern: "$OBJ.clientSecret = \"...\"\n" + - pattern: "$OBJ.secretOrKey = \"...\"\n" + - pattern: "$OBJ.consumerSecret = \"...\"\n" - pattern: $OBJ - patterns: - - pattern-inside: '$SECRET = ''...'' - - ... - - ' + - pattern-inside: "$SECRET = '...'\n...\n" - pattern-either: - - pattern: '{..., clientSecret: $SECRET, ...} - - ' - - pattern: '{..., secretOrKey: $SECRET, ...} - - ' - - pattern: '{..., consumerSecret: $SECRET, ...} - - ' + - pattern: "{..., clientSecret: $SECRET, ...}\n" + - pattern: "{..., secretOrKey: $SECRET, ...}\n" + - pattern: "{..., consumerSecret: $SECRET, ...}\n" - patterns: - - pattern-inside: '$SECRET = ''...'' - - ... - - ' + - pattern-inside: "$SECRET = '...'\n...\n" - pattern-either: - - pattern-inside: '$VALUE = {..., clientSecret: $SECRET, ...} - - ... - - ' - - pattern-inside: '$VALUE = {..., secretOrKey: $SECRET, ...} - - ... - - ' - - pattern-inside: '$VALUE = {..., consumerSecret: $SECRET, ...} - - ... - - ' + - pattern-inside: "$VALUE = {..., clientSecret: $SECRET, ...}\n...\n" + - pattern-inside: "$VALUE = {..., secretOrKey: $SECRET, ...}\n...\n" + - pattern-inside: "$VALUE = {..., consumerSecret: $SECRET, ...}\n...\n" - pattern: $VALUE - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '$F = require("$I").Strategy - - ... - - ' - - pattern-inside: '$F = require("$I") - - ... - - ' - - pattern-inside: 'import { $STRAT as $F } from ''$I'' - - ... - - ' - - pattern-inside: 'import $F from ''$I'' - - ... - - ' - - metavariable-regex: - metavariable: $I - regex: (passport-.*) - - pattern-inside: 'new $F($VALUE,...) - - ' - - focus-metavariable: $VALUE + severity: WARNING - id: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection - message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable - is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized - queries or prepared statements. - options: - interfile: true + languages: + - javascript + - typescript + message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the + variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to + use parameterized queries or prepared statements. metadata: - interfile: true - references: - - https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements category: security - technology: - - express + confidence: HIGH cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + interfile: true + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection - shortlink: https://sg.run/gjoe + references: + - https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements semgrep.dev: rule: + origin: community r_id: 22085 - rv_id: 1263241 rule_id: yyU0GX + rv_id: 1263241 + url: + https://semgrep.dev/playground/r/nWT2Llx/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection version_id: nWT2Llx - url: https://semgrep.dev/playground/r/nWT2Llx/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection - origin: community - languages: - - javascript - - typescript - severity: ERROR + shortlink: https://sg.run/gjoe + source: + https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection + subcategory: + - vuln + technology: + - express + vulnerability_class: + - SQL Injection mode: taint + options: + interfile: true + pattern-sanitizers: + - pattern-either: + - pattern: parseInt(...) + - pattern: $FUNC. ... .hash(...) + pattern-sinks: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sequelize.query($QUERY,...) + - pattern: $DB.sequelize.query($QUERY,...) + - focus-metavariable: $QUERY pattern-sources: - patterns: - pattern-either: @@ -14957,14 +12624,8 @@ rules: - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - - pattern-inside: '({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => - - {...} - - ' - - pattern-inside: '({ $REQ }: Request,$RES: Response) => {...} - - ' + - pattern-inside: "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" + - pattern-inside: "({ $REQ }: Request,$RES: Response) => {...}\n" - focus-metavariable: $REQ - pattern-either: - pattern: params @@ -14974,52 +12635,42 @@ rules: - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') - pattern-sinks: - - pattern-either: - - patterns: - - pattern-either: - - pattern: sequelize.query($QUERY,...) - - pattern: $DB.sequelize.query($QUERY,...) - - focus-metavariable: $QUERY - pattern-sanitizers: - - pattern-either: - - pattern: parseInt(...) - - pattern: $FUNC. ... .hash(...) + severity: ERROR - id: json.aws.security.public-s3-bucket.public-s3-bucket languages: - json - message: Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level - of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket - configuration to make sure they are set with intended values. + message: Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact + level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please + review the bucket configuration to make sure they are set with intended values. metadata: category: security + confidence: MEDIUM cwe: - 'CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html - technology: - - aws - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket - shortlink: https://sg.run/lxv5 semgrep.dev: rule: + origin: community r_id: 13413 - rv_id: 1263254 rule_id: 7KUpLy - version_id: RGT0Ld0 + rv_id: 1263254 url: https://semgrep.dev/playground/r/RGT0Ld0/json.aws.security.public-s3-bucket.public-s3-bucket - origin: community + version_id: RGT0Ld0 + shortlink: https://sg.run/lxv5 + source: https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket + subcategory: + - vuln + technology: + - aws + vulnerability_class: + - Improper Authorization patterns: - pattern-inside: "$BUCKETNAME: {\n \"Type\": \"AWS::S3::Bucket\",\n \"Properties\": {\n ...,\n },\n ...,\n}\n" - pattern-either: @@ -15029,131 +12680,129 @@ rules: - pattern: "\"PublicAccessBlockConfiguration\": {\n ...,\n \"BlockPublicPolicy\": false,\n ...,\n },\n" severity: WARNING - id: json.aws.security.public-s3-policy-statement.public-s3-policy-statement - pattern: "{\n \"Effect\": \"Allow\",\n \"Principal\": \"*\",\n \"Resource\": [\n ..., \"=~/arn:aws:s3.*/\", ...\n\ - \ ],\n ...\n}\n" - message: Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. - Do not do this unless you will never have sensitive data inside the bucket. + languages: + - json + message: Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the + bucket. Do not do this unless you will never have sensitive data inside the bucket. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls' references: - https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html - category: security - technology: - - aws - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement - shortlink: https://sg.run/Yv1d semgrep.dev: rule: + origin: community r_id: 9358 - rv_id: 1263255 rule_id: 9AU1br + rv_id: 1263255 + url: + https://semgrep.dev/playground/r/A8Tgdxq/json.aws.security.public-s3-policy-statement.public-s3-policy-statement version_id: A8Tgdxq - url: https://semgrep.dev/playground/r/A8Tgdxq/json.aws.security.public-s3-policy-statement.public-s3-policy-statement - origin: community + shortlink: https://sg.run/Yv1d + source: https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement + subcategory: + - vuln + technology: + - aws + vulnerability_class: + - Improper Authorization + pattern: "{\n \"Effect\": \"Allow\",\n \"Principal\": \"*\",\n \"Resource\": [\n ..., \"=~/arn:aws:s3.*/\", ...\n\ + \ ],\n ...\n}\n" severity: WARNING +- id: json.aws.security.wildcard-assume-role.wildcard-assume-role languages: - json -- id: json.aws.security.wildcard-assume-role.wildcard-assume-role - patterns: - - pattern-inside: '"Statement": [...] - - ' - - pattern-inside: '{..., "Effect": "Allow", ..., "Action": "sts:AssumeRole", ...} - - ' - - pattern: '"Principal": {..., "AWS": "*", ...} - - ' message: 'Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam:::root`.' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-250: Execution with Unnecessary Privileges' - category: security - technology: - - aws - references: - - https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A06:2017 - Security Misconfiguration - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role - shortlink: https://sg.run/7YEZ + references: + - https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ semgrep.dev: rule: + origin: community r_id: 15138 - rv_id: 1263256 rule_id: JDULx5 - version_id: BjTkZoy + rv_id: 1263256 url: https://semgrep.dev/playground/r/BjTkZoy/json.aws.security.wildcard-assume-role.wildcard-assume-role - origin: community - languages: - - json + version_id: BjTkZoy + shortlink: https://sg.run/7YEZ + source: https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role + subcategory: + - vuln + technology: + - aws + vulnerability_class: + - Improper Authorization + patterns: + - pattern-inside: "\"Statement\": [...]\n" + - pattern-inside: "{..., \"Effect\": \"Allow\", ..., \"Action\": \"sts:AssumeRole\", ...}\n" + - pattern: "\"Principal\": {..., \"AWS\": \"*\", ...}\n" severity: ERROR - id: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded - message: A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and - other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate - the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables - can be used if allowed by your company policy. - severity: WARNING + languages: + - kotlin + message: A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, + and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is + recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), + alternatively environment variables can be used if allowed by your company policy. metadata: - likelihood: LOW - impact: HIGH - confidence: MEDIUM category: security - subcategory: - - vuln + confidence: MEDIUM cwe: - 'CWE-798: Use of Hard-coded Credentials' cwe2020-top25: true cwe2021-top25: true cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures - technology: - - secrets - vulnerability_class: - - Hard-coded Secrets - source_rule_url: https://semgrep.dev/playground/r/d8Ur5BA/achufistov6_personal_org.build-gradle-password-hardcoded - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded - shortlink: https://sg.run/qN29x semgrep.dev: rule: + origin: community r_id: 137856 - rv_id: 1263257 rule_id: ReUD6Kg + rv_id: 1263257 + url: + https://semgrep.dev/playground/r/DkTRbLX/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded version_id: DkTRbLX - url: https://semgrep.dev/playground/r/DkTRbLX/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded - origin: community - languages: - - kotlin + shortlink: https://sg.run/qN29x + source: https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded + source_rule_url: https://semgrep.dev/playground/r/d8Ur5BA/achufistov6_personal_org.build-gradle-password-hardcoded + subcategory: + - vuln + technology: + - secrets + vulnerability_class: + - Hard-coded Secrets options: symbolic_propagation: true + paths: + include: + - '*build.gradle.kts' patterns: - pattern-either: - pattern: '$PASS = env[...] ?: $VALUE' @@ -15166,305 +12815,315 @@ rules: patterns: - pattern-either: - pattern-regex: ^[A-Za-z0-9/+=]+$ - paths: - include: - - '*build.gradle.kts' + severity: WARNING - id: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind + languages: + - kt + message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing + authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information. metadata: - cwe: + category: security + confidence: MEDIUM + cwe: - 'CWE-287: Improper Authentication' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS - category: security - technology: - - kotlin references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind - shortlink: https://sg.run/rY2n semgrep.dev: rule: + origin: community r_id: 15125 - rv_id: 1263258 rule_id: v8U9Q7 - version_id: WrTqKgJ + rv_id: 1263258 url: https://semgrep.dev/playground/r/WrTqKgJ/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind - origin: community - message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication - for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information. + version_id: WrTqKgJ + shortlink: https://sg.run/rY2n + source: https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS + subcategory: + - vuln + technology: + - kotlin + vulnerability_class: + - Improper Authentication + pattern: "$ENV.put($CTX.SECURITY_AUTHENTICATION, \"none\")\n...\n$DCTX = InitialDirContext($ENV, ...)\n" severity: WARNING - pattern: '$ENV.put($CTX.SECURITY_AUTHENTICATION, "none") - - ... - - $DCTX = InitialDirContext($ENV, ...) - - ' +- id: kotlin.lang.security.ecb-cipher.ecb-cipher languages: - kt -- id: kotlin.lang.security.ecb-cipher.ecb-cipher + message: Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows + an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See + https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE - category: security - technology: - - kotlin references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher - shortlink: https://sg.run/DzLj semgrep.dev: rule: + origin: community r_id: 14696 - rv_id: 1263263 rule_id: DbU1Zd - version_id: YDTZexg + rv_id: 1263263 url: https://semgrep.dev/playground/r/YDTZexg/kotlin.lang.security.ecb-cipher.ecb-cipher - origin: community - message: Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an - attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY. - severity: WARNING - languages: - - kt + version_id: YDTZexg + shortlink: https://sg.run/DzLj + source: https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE + subcategory: + - vuln + technology: + - kotlin + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern: 'val $VAR : Cipher = $CIPHER.getInstance($MODE) - - ' - - pattern: 'var $VAR : Cipher = $CIPHER.getInstance($MODE) - - ' - - pattern: 'val $VAR = $CIPHER.getInstance($MODE) - - ' - - pattern: 'var $VAR = $CIPHER.getInstance($MODE) - - ' + - pattern: "val $VAR : Cipher = $CIPHER.getInstance($MODE)\n" + - pattern: "var $VAR : Cipher = $CIPHER.getInstance($MODE)\n" + - pattern: "val $VAR = $CIPHER.getInstance($MODE)\n" + - pattern: "var $VAR = $CIPHER.getInstance($MODE)\n" - metavariable-regex: metavariable: $MODE regex: .*ECB.* + severity: WARNING - id: kotlin.lang.security.no-null-cipher.no-null-cipher - pattern: NullCipher(...) + languages: + - kt + - scala + message: 'NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use + a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions + for more information.' metadata: + asvs: + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.5 Insecure Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' - category: security - technology: - - kotlin references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher - shortlink: https://sg.run/0ywb semgrep.dev: rule: + origin: community r_id: 14698 - rv_id: 1263265 rule_id: 0oU2Yy - version_id: o5TbDPj + rv_id: 1263265 url: https://semgrep.dev/playground/r/o5TbDPj/kotlin.lang.security.no-null-cipher.no-null-cipher - origin: community - message: 'NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use - a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions - for more information.' + version_id: o5TbDPj + shortlink: https://sg.run/0ywb + source: https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER + subcategory: + - vuln + technology: + - kotlin + vulnerability_class: + - Cryptographic Issues + pattern: NullCipher(...) severity: WARNING - languages: - - kt - - scala - id: kotlin.lang.security.use-of-md5.use-of-md5 - message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use SHA256 or SHA3 instead. languages: - kt - severity: WARNING + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-328: Use of Weak Hash' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-328: Use of Weak Hash' - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5 - category: security - technology: - - kotlin references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5 - shortlink: https://sg.run/4eQx semgrep.dev: rule: + origin: community r_id: 14700 - rv_id: 1263267 rule_id: qNUXPj - version_id: pZT03Jd + rv_id: 1263267 url: https://semgrep.dev/playground/r/pZT03Jd/kotlin.lang.security.use-of-md5.use-of-md5 - origin: community + version_id: pZT03Jd + shortlink: https://sg.run/4eQx + source: https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5 + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5 + subcategory: + - vuln + technology: + - kotlin + vulnerability_class: + - Insecure Hashing Algorithm pattern-either: - - pattern: 'java.security.MessageDigest.getInstance("MD5") - - ' - - pattern: 'org.apache.commons.codec.digest.DigestUtils.getMd5Digest() - - ' + - pattern: "java.security.MessageDigest.getInstance(\"MD5\")\n" + - pattern: "org.apache.commons.codec.digest.DigestUtils.getMd5Digest()\n" + severity: WARNING - id: kotlin.lang.security.use-of-sha1.use-of-sha1 - message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not - suitable as a cryptographic signature. Use SHA256 or SHA3 instead. languages: - kt - severity: WARNING + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore + not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1 asvs: - section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements version: '4' category: security - technology: - - kotlin - references: - - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM confidence: MEDIUM + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1 - shortlink: https://sg.run/N1pp + likelihood: LOW + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures semgrep.dev: rule: + origin: community r_id: 15127 - rv_id: 1263268 rule_id: ZqUOdd - version_id: 2KTv2XZ + rv_id: 1263268 url: https://semgrep.dev/playground/r/2KTv2XZ/kotlin.lang.security.use-of-sha1.use-of-sha1 - origin: community + version_id: 2KTv2XZ + shortlink: https://sg.run/N1pp + source: https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1 + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1 + subcategory: + - vuln + technology: + - kotlin + vulnerability_class: + - Cryptographic Issues pattern-either: - patterns: - - pattern: '$VAR = $MD.getInstance("$ALGO") - - ' + - pattern: "$VAR = $MD.getInstance(\"$ALGO\")\n" - metavariable-regex: metavariable: $ALGO regex: (SHA1|SHA-1) - - pattern: '$DU.getSha1Digest().digest(...) - - ' + - pattern: "$DU.getSha1Digest().digest(...)\n" + severity: WARNING - id: kotlin.lang.security.weak-rsa.use-of-weak-rsa-key - message: RSA keys should be at least 2048 bits based on NIST recommendation. languages: - kt - severity: WARNING + message: RSA keys should be at least 2048 bits based on NIST recommendation. metadata: + asvs: + control_id: 6.2.5 Insecure Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_KEY_SIZE - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.5 Insecure Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms - category: security - technology: - - kotlin - subcategory: - - audit - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key - shortlink: https://sg.run/krq7 semgrep.dev: rule: + origin: community r_id: 15128 - rv_id: 1263269 rule_id: nJUZNL - version_id: X0TzypE + rv_id: 1263269 url: https://semgrep.dev/playground/r/X0TzypE/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key - origin: community + version_id: X0TzypE + shortlink: https://sg.run/krq7 + source: https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_KEY_SIZE + subcategory: + - audit + technology: + - kotlin + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - - pattern: '$KEY = $G.getInstance("RSA") - - ... - - $KEY.initialize($BITS) - - ' + - pattern: "$KEY = $G.getInstance(\"RSA\")\n...\n$KEY.initialize($BITS)\n" - metavariable-comparison: - metavariable: $BITS comparison: $BITS < 2048 + metavariable: $BITS + severity: WARNING - id: package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age + languages: + - generic + message: 'This bunfig.toml does not set a minimum release age or sets it too low. Newly published packages can be malicious + or unstable. Add `minimumReleaseAge = 604800` under the `[install]` section to wait 7 days before resolving newly published + package versions. Added in: v1.3 Reference: https://bun.sh/docs/runtime/bunfig' + metadata: + category: security + confidence: HIGH + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A08:2021 - Software and Data Integrity Failures + references: + - https://bun.sh/docs/runtime/bunfig + semgrep.dev: + rule: + origin: community + r_id: 291646 + rule_id: oqUyJOb + rv_id: 1423385 + url: + https://semgrep.dev/playground/r/BjTyRe5/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age + version_id: BjTyRe5 + shortlink: https://sg.run/JqPrR + source: https://semgrep.dev/r/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age + subcategory: + - audit + technology: + - bun + - javascript + vulnerability_class: + - Insecure Configuration + paths: + include: + - '**/bunfig.toml' + - '**/.bunfig.toml' pattern-either: - patterns: - pattern-regex: (?ms)\[install\](?P[^\[]*?)(?=\[|\z) @@ -15476,54 +13135,54 @@ rules: - pattern-regex: minimumReleaseAge\s*=\s*\d+ - pattern-regex: =\s*(?P\d+) - metavariable-comparison: - metavariable: $AGE comparison: int($AGE) < 604800 + metavariable: $AGE - focus-metavariable: $AGE - patterns: - pattern-regex: (?m)minimumReleaseAge[ \t]*=[ \t]*(?P[^\s\d][^\n]*) - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)minimumReleaseAge\s*=\s*$ - message: 'This bunfig.toml does not set a minimum release age or sets it too low. Newly published packages can be malicious - or unstable. Add `minimumReleaseAge = 604800` under the `[install]` section to wait 7 days before resolving newly published - package versions. Added in: v1.3 Reference: https://bun.sh/docs/runtime/bunfig' - languages: - - generic severity: MEDIUM - paths: - include: - - '**/bunfig.toml' - - '**/.bunfig.toml' +- id: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + languages: + - yaml + message: 'This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. + Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before + proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown' metadata: category: security - technology: - - bun - - javascript + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://bun.sh/docs/runtime/bunfig - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age - shortlink: https://sg.run/JqPrR + - https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown semgrep.dev: rule: - r_id: 291646 - rv_id: 1423385 - rule_id: oqUyJOb - version_id: BjTyRe5 - url: https://semgrep.dev/playground/r/BjTyRe5/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age origin: community -- id: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + r_id: 291647 + rule_id: zdUArOL + rv_id: 1423386 + url: + https://semgrep.dev/playground/r/DkTwEGl/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + version_id: DkTwEGl + shortlink: https://sg.run/5WvGK + source: https://semgrep.dev/r/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + subcategory: + - audit + technology: + - dependabot + vulnerability_class: + - Insecure Configuration + paths: + include: + - '**/.github/dependabot.yml' + - '**/.github/dependabot.yaml' pattern-either: - patterns: - pattern-inside: "updates:\n ...\n" @@ -15533,8 +13192,8 @@ rules: - pattern-inside: "updates:\n ...\n" - pattern-regex: default-days\s*:\s*(?P\d+) - metavariable-comparison: - metavariable: $DAYS comparison: int($DAYS) < 7 + metavariable: $DAYS - focus-metavariable: $DAYS - patterns: - pattern-inside: "updates:\n ...\n" @@ -15543,45 +13202,47 @@ rules: metavariable: $DAYS regex: ^\D - focus-metavariable: $DAYS - message: 'This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. - Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before - proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown' - languages: - - yaml severity: MEDIUM - paths: - include: - - '**/.github/dependabot.yml' - - '**/.github/dependabot.yaml' +- id: package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + languages: + - generic + message: 'This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or + unstable. Add `min-release-age = 7` to wait 7 days before resolving newly published package versions. Added in: v11.10 + Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/' metadata: category: security - technology: - - dependabot + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown - shortlink: https://sg.run/5WvGK + - https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/ + - https://github.com/npm/cli/pull/8965 semgrep.dev: rule: - r_id: 291647 - rv_id: 1423386 - rule_id: zdUArOL - version_id: DkTwEGl - url: https://semgrep.dev/playground/r/DkTwEGl/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown origin: community -- id: package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + r_id: 291648 + rule_id: pKU6A82 + rv_id: 1423387 + url: + https://semgrep.dev/playground/r/WrT7LdL/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + version_id: WrT7LdL + shortlink: https://sg.run/GRo1z + source: https://semgrep.dev/r/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + subcategory: + - audit + technology: + - npm + - javascript + vulnerability_class: + - Insecure Configuration + paths: + include: + - '**/.npmrc' pattern-either: - patterns: - pattern-regex: (?:(?:^---\n)(?:[^\n]*\n)|^)(?P(?:(?!\n---)[\s\S])*\S(?:(?!\n---)[\s\S])*) @@ -15591,222 +13252,214 @@ rules: - pattern-regex: min-release-age\s*=\s*\d+ - pattern-regex: =\s*(?P\d+) - metavariable-comparison: - metavariable: $AGE comparison: int($AGE) < 7 + metavariable: $AGE - focus-metavariable: $AGE - patterns: - pattern-regex: (?m)min-release-age[ \t]*=[ \t]*(?P[^\s\d][^\n]*) - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)min-release-age\s*=\s*$ - message: 'This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or - unstable. Add `min-release-age = 7` to wait 7 days before resolving newly published package versions. Added in: v11.10 - Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/' - languages: - - generic severity: MEDIUM - paths: - include: - - '**/.npmrc' +- id: package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies + languages: + - yaml + message: 'Missing or incorrect blockExoticSubdeps. Set `blockExoticSubdeps: true` to transitive dependencies from being + installed from untrusted sources. Added in: v10.26.0 Reference: https://pnpm.io/settings#blockexoticsubdeps' metadata: category: security - technology: - - npm - - javascript + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/ - - https://github.com/npm/cli/pull/8965 - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age - shortlink: https://sg.run/GRo1z + - https://pnpm.io/settings#blockexoticsubdeps semgrep.dev: rule: - r_id: 291648 - rv_id: 1423387 - rule_id: pKU6A82 - version_id: WrT7LdL - url: https://semgrep.dev/playground/r/WrT7LdL/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age origin: community -- id: package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies - message: 'Missing or incorrect blockExoticSubdeps. Set `blockExoticSubdeps: true` to transitive dependencies from being - installed from untrusted sources. Added in: v10.26.0 Reference: https://pnpm.io/settings#blockexoticsubdeps' - languages: - - yaml - severity: MEDIUM + r_id: 291649 + rule_id: 2ZUQEZ5 + rv_id: 1423388 + url: + https://semgrep.dev/playground/r/0bTGnwj/package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies + version_id: 0bTGnwj + shortlink: https://sg.run/RrWRv + source: + https://semgrep.dev/r/package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies + subcategory: + - audit + technology: + - pnpm + vulnerability_class: + - Insecure Configuration paths: include: - '**/pnpm-workspace.yaml' pattern-either: - patterns: - - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^blockExoticSubdeps\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^blockExoticSubdeps\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) + - pattern-regex: + (?ms)(?:\A|^---$\n)(?:(?!^blockExoticSubdeps\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^blockExoticSubdeps\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) - focus-metavariable: $TARGET - patterns: - - pattern: 'blockExoticSubdeps: $VAL - - ' + - pattern: "blockExoticSubdeps: $VAL\n" - metavariable-regex: metavariable: $VAL regex: ^(?!true$).+ - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)^\s*blockExoticSubdeps\s*:\s*$ + severity: MEDIUM +- id: package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age + languages: + - yaml + message: 'This pnpm workspace configuration does not set a minimum release age. Newly published packages can be malicious + or unstable. Add `minimumReleaseAge: 10080` (minutes) to wait at least seven days before installing newly published package + versions. Added in: v10.16.0 Reference: https://pnpm.io/settings#minimumreleaseage' metadata: category: security - technology: - - pnpm + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://pnpm.io/settings#blockexoticsubdeps - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies - shortlink: https://sg.run/RrWRv + - https://pnpm.io/settings#minimumreleaseage semgrep.dev: rule: - r_id: 291649 - rv_id: 1423388 - rule_id: 2ZUQEZ5 - version_id: 0bTGnwj - url: https://semgrep.dev/playground/r/0bTGnwj/package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies origin: community -- id: package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age - message: 'This pnpm workspace configuration does not set a minimum release age. Newly published packages can be malicious - or unstable. Add `minimumReleaseAge: 10080` (minutes) to wait at least seven days before installing newly published package - versions. Added in: v10.16.0 Reference: https://pnpm.io/settings#minimumreleaseage' - languages: - - yaml - severity: MEDIUM + r_id: 291650 + rule_id: X5Uwn1n + rv_id: 1423389 + url: + https://semgrep.dev/playground/r/K3TgxrW/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age + version_id: K3TgxrW + shortlink: https://sg.run/Aj0o0 + source: https://semgrep.dev/r/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age + subcategory: + - audit + technology: + - pnpm + vulnerability_class: + - Insecure Configuration paths: include: - '**/pnpm-workspace.yaml' pattern-either: - patterns: - - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) + - pattern-regex: + (?ms)(?:\A|^---$\n)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) - focus-metavariable: $TARGET - patterns: - pattern-regex: ^\s*minimumReleaseAge\s*:\s*(?P\d+) - metavariable-comparison: - metavariable: $AGE comparison: int($AGE) < 10080 + metavariable: $AGE - focus-metavariable: $AGE - patterns: - - pattern: 'minimumReleaseAge: $AGE - - ' + - pattern: "minimumReleaseAge: $AGE\n" - metavariable-regex: metavariable: $AGE regex: ^\D - focus-metavariable: $AGE - patterns: - pattern-regex: (?m)^\s*minimumReleaseAge\s*:\s*$ + severity: MEDIUM +- id: package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy + languages: + - yaml + message: 'Missing or incorrect trustPolicy. Set `trustPolicy: no-downgrade` to prevent malicious package updates from downgrading + security settings. Added in: v10.21.0 Reference: https://pnpm.io/settings#trustpolicy' metadata: category: security - technology: - - pnpm + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - https://pnpm.io/settings#minimumreleaseage - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age - shortlink: https://sg.run/Aj0o0 semgrep.dev: rule: - r_id: 291650 - rv_id: 1423389 - rule_id: X5Uwn1n - version_id: K3TgxrW - url: https://semgrep.dev/playground/r/K3TgxrW/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age origin: community -- id: package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy - message: 'Missing or incorrect trustPolicy. Set `trustPolicy: no-downgrade` to prevent malicious package updates from downgrading - security settings. Added in: v10.21.0 Reference: https://pnpm.io/settings#trustpolicy' - languages: - - yaml - severity: MEDIUM + r_id: 291651 + rule_id: j2U6J8N + rv_id: 1423390 + url: https://semgrep.dev/playground/r/qkTvDQn/package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy + version_id: qkTvDQn + shortlink: https://sg.run/B2Kz7 + source: https://semgrep.dev/r/package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy + subcategory: + - audit + technology: + - pnpm + vulnerability_class: + - Insecure Configuration paths: include: - '**/pnpm-workspace.yaml' pattern-either: - patterns: - - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^trustPolicy\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^trustPolicy\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) + - pattern-regex: + (?ms)(?:\A|^---$\n)(?:(?!^trustPolicy\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^trustPolicy\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) - focus-metavariable: $TARGET - patterns: - - pattern: 'trustPolicy: $VAL - - ' + - pattern: "trustPolicy: $VAL\n" - metavariable-regex: metavariable: $VAL regex: ^(?!no-downgrade$).+ - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)^\s*trustPolicy\s*:\s*$ + severity: MEDIUM +- id: package_managers.poetry.poetry-missing-solver-min-release-age.poetry-missing-solver-min-release-age + languages: + - generic + message: 'This poetry.toml does not set a dependency cooldown via `solver.min-release-age`. Without a cooldown, Poetry may + resolve newly published package versions that have not yet been vetted by the community. Supply chain attacks frequently + involve publishing a malicious version of a popular package and waiting for it to be pulled in — most are detected and + removed within days. Set `min-release-age = 7` under `[solver]` to require that package versions are at least 7 days old + before they are considered during dependency resolution. Added in: v2.4.0' metadata: category: security - technology: - - pnpm + confidence: MEDIUM cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://pnpm.io/settings#minimumreleaseage - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy - shortlink: https://sg.run/B2Kz7 + - https://python-poetry.org/docs/configuration/#solvermin-release-age semgrep.dev: rule: - r_id: 291651 - rv_id: 1423390 - rule_id: j2U6J8N - version_id: qkTvDQn - url: https://semgrep.dev/playground/r/qkTvDQn/package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy origin: community -- id: package_managers.poetry.poetry-missing-solver-min-release-age.poetry-missing-solver-min-release-age - message: 'This poetry.toml does not set a dependency cooldown via `solver.min-release-age`. Without a cooldown, Poetry may - resolve newly published package versions that have not yet been vetted by the community. Supply chain attacks frequently - involve publishing a malicious version of a popular package and waiting for it to be pulled in — most are detected and - removed within days. Set `min-release-age = 7` under `[solver]` to require that package versions are at least 7 days old - before they are considered during dependency resolution. Added in: v2.4.0' - languages: - - generic - severity: MEDIUM + r_id: 309390 + rule_id: kxUjBPy + rv_id: 1443453 + url: + https://semgrep.dev/playground/r/X0TYPX6/package_managers.poetry.poetry-missing-solver-min-release-age.poetry-missing-solver-min-release-age + version_id: X0TYPX6 + shortlink: https://sg.run/JqnYZ + source: + https://semgrep.dev/r/package_managers.poetry.poetry-missing-solver-min-release-age.poetry-missing-solver-min-release-age + subcategory: + - audit + technology: + - poetry + - python + vulnerability_class: + - Insecure Configuration paths: include: - '**/poetry.toml' @@ -15814,128 +13467,124 @@ rules: pattern-either: - pattern-regex: (?m)^\[solver\]\n(?:^(?!min-release-age|\[|---).*\n)*(?=^\[|^---|\z) - pattern-regex: (?ms)^\[solver\](?:[^\[]*?)min-release-age\s*=\s*(?P"[^"]*"|[0-6](?:\s|#|$)|false) + severity: MEDIUM +- id: package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + languages: + - json + message: 'This Renovate configuration does not set a minimum release age. Newly published packages can be malicious or unstable. + Add `"minimumReleaseAge": "7 days"` within a `packageRules` entry to wait 7 days before proposing updates to newly published + package versions. Set `"minimumReleaseAge": false` to set an exception for minimal release age for the package rule. Added + in: v42' metadata: category: security - technology: - - poetry - - python + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: MEDIUM - likelihood: LOW - impact: MEDIUM - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://python-poetry.org/docs/configuration/#solvermin-release-age - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.poetry.poetry-missing-solver-min-release-age.poetry-missing-solver-min-release-age - shortlink: https://sg.run/JqnYZ + - https://docs.renovatebot.com/configuration-options/#minimumreleaseage semgrep.dev: rule: - r_id: 309390 - rv_id: 1443453 - rule_id: kxUjBPy - version_id: X0TYPX6 - url: https://semgrep.dev/playground/r/X0TYPX6/package_managers.poetry.poetry-missing-solver-min-release-age.poetry-missing-solver-min-release-age origin: community -- id: package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + r_id: 291652 + rule_id: 10UbQrX + rv_id: 1443454 + url: + https://semgrep.dev/playground/r/jQT1KAX/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + version_id: jQT1KAX + shortlink: https://sg.run/D8l2q + source: + https://semgrep.dev/r/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + subcategory: + - audit + technology: + - renovate + vulnerability_class: + - Insecure Configuration + paths: + include: + - '**/renovate.json' + - '**/renovate.json5' + - '**/.renovaterc' + - '**/.renovaterc.json' + - '**/.renovaterc.json5' pattern-either: - patterns: - pattern-inside: "\"packageRules\": [\n ...\n]\n" - pattern-either: - - pattern: '{ ..., "matchPackageNames": [...], ... } - - ' - - pattern: '{ ..., "matchPackagePatterns": [...], ... } - - ' - - pattern: '{ ..., "matchDepTypes": [...], ... } - - ' + - pattern: "{ ..., \"matchPackageNames\": [...], ... }\n" + - pattern: "{ ..., \"matchPackagePatterns\": [...], ... }\n" + - pattern: "{ ..., \"matchDepTypes\": [...], ... }\n" - pattern-not: "{\n ...,\n \"minimumReleaseAge\": $AGE,\n ...\n}\n" - pattern-not: "{\n ...,\n \"minimumReleaseAge\": false,\n ...\n}\n" - patterns: - pattern-inside: "\"packageRules\": [\n ...\n]\n" - pattern-regex: '"minimumReleaseAge":\s*"(?P\d+) days?"' - metavariable-comparison: - metavariable: $AGE comparison: int($AGE) < 7 + metavariable: $AGE - focus-metavariable: $AGE - patterns: - pattern-inside: "\"packageRules\": [\n ...\n]\n" - - pattern: '"minimumReleaseAge": "$AGE" - - ' + - pattern: "\"minimumReleaseAge\": \"$AGE\"\n" - metavariable-regex: metavariable: $AGE regex: ^(?!\d+ days?$) - focus-metavariable: $AGE - message: 'This Renovate configuration does not set a minimum release age. Newly published packages can be malicious or unstable. - Add `"minimumReleaseAge": "7 days"` within a `packageRules` entry to wait 7 days before proposing updates to newly published - package versions. Set `"minimumReleaseAge": false` to set an exception for minimal release age for the package rule. Added - in: v42' - languages: - - json severity: MEDIUM - paths: - include: - - '**/renovate.json' - - '**/renovate.json5' - - '**/.renovaterc' - - '**/.renovaterc.json' - - '**/.renovaterc.json5' +- id: package_managers.ruby.bundler-gemfile-missing-cooldown.bundler-gemfile-missing-cooldown + languages: + - ruby + message: 'A Gemfile `source` declaration without a `cooldown` (or with a cooldown below 7 days) allows Bundler to resolve + newly published gem versions immediately, before the community has had time to detect malicious releases. The May 2026 + RubyGems supply-chain attack demonstrated that threat actors can push compromised gem versions and have them automatically + pulled into builds within minutes. Add `cooldown: 7` to each public source declaration so Bundler ignores gem versions + published within the last 7 days during dependency resolution (e.g. `source "https://rubygems.org", cooldown: 7`). If + you operate an internal or private registry where the supply-chain risk is lower, use `cooldown: 0` as an explicit bypass. + Note: this feature requires Bundler >= 4.0.13. Cooldown only applies during `bundle update` and `bundle add`; `bundle + install` with an existing lockfile is unaffected.' metadata: category: security - technology: - - renovate + confidence: MEDIUM cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://docs.renovatebot.com/configuration-options/#minimumreleaseage - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age - shortlink: https://sg.run/D8l2q + - https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html semgrep.dev: rule: - r_id: 291652 - rv_id: 1443454 - rule_id: 10UbQrX - version_id: jQT1KAX - url: https://semgrep.dev/playground/r/jQT1KAX/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age origin: community -- id: package_managers.ruby.bundler-gemfile-missing-cooldown.bundler-gemfile-missing-cooldown - message: 'A Gemfile `source` declaration without a `cooldown` (or with a cooldown below 7 days) allows Bundler to resolve - newly published gem versions immediately, before the community has had time to detect malicious releases. The May 2026 - RubyGems supply-chain attack demonstrated that threat actors can push compromised gem versions and have them automatically - pulled into builds within minutes. Add `cooldown: 7` to each public source declaration so Bundler ignores gem versions - published within the last 7 days during dependency resolution (e.g. `source "https://rubygems.org", cooldown: 7`). If - you operate an internal or private registry where the supply-chain risk is lower, use `cooldown: 0` as an explicit bypass. - Note: this feature requires Bundler >= 4.0.13. Cooldown only applies during `bundle update` and `bundle add`; `bundle - install` with an existing lockfile is unaffected.' - languages: - - ruby - severity: MEDIUM + r_id: 309391 + rule_id: wdUzPbP + rv_id: 1443455 + url: + https://semgrep.dev/playground/r/1QTEjAN/package_managers.ruby.bundler-gemfile-missing-cooldown.bundler-gemfile-missing-cooldown + version_id: 1QTEjAN + shortlink: https://sg.run/5Wlkl + source: + https://semgrep.dev/r/package_managers.ruby.bundler-gemfile-missing-cooldown.bundler-gemfile-missing-cooldown + subcategory: + - audit + technology: + - bundler + - ruby + vulnerability_class: + - Insecure Configuration paths: - include: - - '**/Gemfile' - - '**/gems.rb' exclude: - '**/vendor/**' - '**/.bundle/**' + include: + - '**/Gemfile' + - '**/gems.rb' pattern-either: - patterns: - pattern: source "...", ... @@ -15943,39 +13592,50 @@ rules: - patterns: - pattern: 'source "...", ..., cooldown: $N, ...' - metavariable-comparison: - metavariable: $N comparison: $N > 0 and $N < 7 + metavariable: $N - focus-metavariable: $N + severity: MEDIUM +- id: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + languages: + - generic + message: 'This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious + or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package + versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns' metadata: category: security - technology: - - bundler - - ruby + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: MEDIUM - likelihood: LOW - impact: MEDIUM - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.ruby.bundler-gemfile-missing-cooldown.bundler-gemfile-missing-cooldown - shortlink: https://sg.run/5Wlkl + - https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns semgrep.dev: rule: - r_id: 309391 - rv_id: 1443455 - rule_id: wdUzPbP - version_id: 1QTEjAN - url: https://semgrep.dev/playground/r/1QTEjAN/package_managers.ruby.bundler-gemfile-missing-cooldown.bundler-gemfile-missing-cooldown origin: community -- id: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + r_id: 291653 + rule_id: 9AUo6vE + rv_id: 1501839 + url: + https://semgrep.dev/playground/r/kbT3B1J/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + version_id: kbT3B1J + shortlink: https://sg.run/WeY0Z + source: https://semgrep.dev/r/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + subcategory: + - audit + technology: + - uv + - python + vulnerability_class: + - Insecure Configuration + paths: + include: + - '**/pyproject.toml' + - '**/uv.toml' pattern-either: - patterns: - pattern-regex: (?ms)\[tool\.uv\](?P[^\[]*?)(?=\[|\z) @@ -15986,64 +13646,66 @@ rules: - patterns: - pattern-regex: exclude-newer\s*=\s*"(?P\d+)\s*d(?:ays?)?" - metavariable-comparison: - metavariable: $DAYS comparison: int($DAYS) < 7 + metavariable: $DAYS - focus-metavariable: $DAYS - patterns: - pattern-regex: exclude-newer\s*=\s*"(?P[^"]+)" - metavariable-regex: metavariable: $VAL - regex: (?i)^(?!\d+\s*d(?:ays?)?\b)(?!\d+\s*(?:weeks?|wks?|w|months?|mos?|mo|years?|yrs?|y)\b)(?!P[^Tt]*[WMY])(?!P(?:[7-9]|[1-9]\d+)D\b) + regex: + (?i)^(?!\d+\s*d(?:ays?)?\b)(?!\d+\s*(?:weeks?|wks?|w|months?|mos?|mo|years?|yrs?|y)\b)(?!P[^Tt]*[WMY])(?!P(?:[7-9]|[1-9]\d+)D\b) - focus-metavariable: $VAL - message: 'This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious - or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package - versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns' - languages: - - generic severity: MEDIUM - paths: - include: - - '**/pyproject.toml' - - '**/uv.toml' +- id: package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + languages: + - yaml + message: 'This .yarnrc.yml does not set a minimal age gate or sets it too low. Newly published packages can be malicious + or unstable. Add `npmMinimalAgeGate: "7d"` to wait 7 days before resolving newly published package versions. Added in: + 4.10 Reference: https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate' metadata: category: security - technology: - - uv - - python + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown - shortlink: https://sg.run/WeY0Z + - https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate semgrep.dev: rule: - r_id: 291653 - rv_id: 1501839 - rule_id: 9AUo6vE - version_id: kbT3B1J - url: https://semgrep.dev/playground/r/kbT3B1J/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown origin: community -- id: package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + r_id: 291654 + rule_id: yyUBeEz + rv_id: 1423393 + url: + https://semgrep.dev/playground/r/JdTnXlj/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + version_id: JdTnXlj + shortlink: https://sg.run/0gvNq + source: https://semgrep.dev/r/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + subcategory: + - audit + technology: + - yarn + - javascript + vulnerability_class: + - Insecure Configuration + paths: + include: + - '**/.yarnrc.yml' pattern-either: - patterns: - - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?P^(?:nodeLinker|yarnPath|enableGlobalCache|npmScopes|npmRegistryServer)\s*:)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) + - pattern-regex: + (?ms)(?:\A|^---$\n)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?P^(?:nodeLinker|yarnPath|enableGlobalCache|npmScopes|npmRegistryServer)\s*:)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) - focus-metavariable: $TARGET - patterns: - pattern-regex: (?m)npmMinimalAgeGate\s*:\s*['"]?(?P\d+)d['"]? - metavariable-comparison: - metavariable: $DAYS comparison: int($DAYS) < 7 + metavariable: $DAYS - focus-metavariable: $DAYS - patterns: - pattern-regex: (?m)npmMinimalAgeGate[ \t]*:[ \t]*(?P\S+) @@ -16053,44 +13715,7 @@ rules: - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)^npmMinimalAgeGate\s*:\s*$ - message: 'This .yarnrc.yml does not set a minimal age gate or sets it too low. Newly published packages can be malicious - or unstable. Add `npmMinimalAgeGate: "7d"` to wait 7 days before resolving newly published package versions. Added in: - 4.10 Reference: https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate' - languages: - - yaml severity: MEDIUM - paths: - include: - - '**/.yarnrc.yml' - metadata: - category: security - technology: - - yarn - - javascript - cwe: - - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' - owasp: - - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration - references: - - https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate - shortlink: https://sg.run/0gvNq - semgrep.dev: - rule: - r_id: 291654 - rv_id: 1423393 - rule_id: yyUBeEz - version_id: JdTnXlj - url: https://semgrep.dev/playground/r/JdTnXlj/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate - origin: community - id: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query languages: - php @@ -16099,8 +13724,14 @@ rules: use parameterized queries or prepared statements instead.' metadata: category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -16108,28 +13739,23 @@ rules: references: - https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html - technology: - - doctrine - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query - shortlink: https://sg.run/jwDJ semgrep.dev: rule: + origin: community r_id: 13965 - rv_id: 1263271 rule_id: kxUw23 + rv_id: 1263271 + url: + https://semgrep.dev/playground/r/1QTypnG/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query version_id: 1QTypnG - url: https://semgrep.dev/playground/r/1QTypnG/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query - origin: community + shortlink: https://sg.run/jwDJ + source: https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query + subcategory: + - vuln + technology: + - doctrine + vulnerability_class: + - SQL Injection mode: taint pattern-sinks: - patterns: @@ -16159,232 +13785,244 @@ rules: - pattern: $QUERY->set($SINK,...) - pattern: $QUERY->setValue($SINK,...) - pattern-either: - - pattern-inside: '$Q = $X->createQueryBuilder(); - - ... - - ' - - pattern-inside: '$Q = new QueryBuilder(...); - - ... - - ' + - pattern-inside: "$Q = $X->createQueryBuilder();\n...\n" + - pattern-inside: "$Q = new QueryBuilder(...);\n...\n" pattern-sources: - patterns: - pattern-either: - pattern: sprintf(...) - - pattern: '"...".$SMTH - - ' + - pattern: "\"...\".$SMTH\n" severity: WARNING - id: php.lang.security.assert-use.assert-use - mode: taint - pattern-sources: - - pattern-either: - - patterns: - - pattern-either: - - pattern: $_GET - - pattern: $_POST - - pattern: $_COOKIE - - pattern: $_REQUEST - - pattern: $_SERVER - - patterns: - - pattern: 'Route::$METHOD($ROUTENAME, function(..., $ARG, ...) { ... }) - - ' - - focus-metavariable: $ARG - pattern-sinks: - - patterns: - - pattern: assert($SINK, ...); - - pattern-not: assert("...", ...); - - pattern: $SINK + languages: + - php message: Calling assert with user input is equivalent to eval'ing. metadata: + category: security + confidence: HIGH + cwe: + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' references: - https://www.php.net/manual/en/function.assert - https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php - category: security - technology: - - php - confidence: HIGH - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/php.lang.security.assert-use.assert-use - shortlink: https://sg.run/3xXW semgrep.dev: rule: + origin: community r_id: 9387 - rv_id: 1263272 rule_id: DbUpjk - version_id: 9lT4bLx + rv_id: 1263272 url: https://semgrep.dev/playground/r/9lT4bLx/php.lang.security.assert-use.assert-use - origin: community - languages: - - php + version_id: 9lT4bLx + shortlink: https://sg.run/3xXW + source: https://semgrep.dev/r/php.lang.security.assert-use.assert-use + subcategory: + - vuln + technology: + - php + vulnerability_class: + - Code Injection + mode: taint + pattern-sinks: + - patterns: + - pattern: assert($SINK, ...); + - pattern-not: assert("...", ...); + - pattern: $SINK + pattern-sources: + - pattern-either: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + - pattern: $_SERVER + - patterns: + - pattern: "Route::$METHOD($ROUTENAME, function(..., $ARG, ...) { ... })\n" + - focus-metavariable: $ARG severity: ERROR - id: php.lang.security.audit.sha224-hash.sha224-hash - pattern-either: - - pattern: hash('sha224', ...); - - pattern: hash('sha512/224', ...); - - pattern: hash('sha3-224', ...); - - pattern: hash_hmac('sha224', ...); - - pattern: hash_hmac('sha512/224', ...); - - pattern: hash_hmac('sha3-224', ...); - message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating - to a stronger hash function such as SHA-384 or higher to ensure compliance and security. + languages: + - php + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider + updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security. metadata: + category: security + confidence: HIGH cwe: - 'CWE-328: Use of Weak Hash' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures references: - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography - category: security - technology: - - php - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures - subcategory: - - audit - likelihood: LOW - impact: LOW - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/php.lang.security.audit.sha224-hash.sha224-hash - shortlink: https://sg.run/BYXqv semgrep.dev: rule: + origin: community r_id: 151751 - rv_id: 1263275 rule_id: AbU97EA - version_id: bZT53Jo + rv_id: 1263275 url: https://semgrep.dev/playground/r/bZT53Jo/php.lang.security.audit.sha224-hash.sha224-hash - origin: community - languages: - - php + version_id: bZT53Jo + shortlink: https://sg.run/BYXqv + source: https://semgrep.dev/r/php.lang.security.audit.sha224-hash.sha224-hash + subcategory: + - audit + technology: + - php + vulnerability_class: + - Insecure Hashing Algorithm + pattern-either: + - pattern: hash('sha224', ...); + - pattern: hash('sha512/224', ...); + - pattern: hash('sha3-224', ...); + - pattern: hash_hmac('sha224', ...); + - pattern: hash_hmac('sha512/224', ...); + - pattern: hash_hmac('sha3-224', ...); severity: WARNING - id: php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off - patterns: - - pattern-either: - - pattern: '$ARG = $IS_VERIFIED; - - ... - - curl_setopt(..., CURLOPT_SSL_VERIFYPEER, $ARG); - - ' - - pattern: curl_setopt(..., CURLOPT_SSL_VERIFYPEER, $IS_VERIFIED) - - metavariable-regex: - metavariable: $IS_VERIFIED - regex: 0|false|null + languages: + - php message: SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED) metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' - references: - - https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/ - category: security - technology: - - php + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off - shortlink: https://sg.run/PJqv + references: + - https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/ semgrep.dev: rule: + origin: community r_id: 9389 - rv_id: 1263277 rule_id: 0oU5Xg - version_id: kbTzG9b + rv_id: 1263277 url: https://semgrep.dev/playground/r/kbTzG9b/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off - origin: community - languages: - - php + version_id: kbTzG9b + shortlink: https://sg.run/PJqv + source: https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off + subcategory: + - vuln + technology: + - php + vulnerability_class: + - Mishandled Sensitive Information + patterns: + - pattern-either: + - pattern: "$ARG = $IS_VERIFIED;\n...\ncurl_setopt(..., CURLOPT_SSL_VERIFYPEER, $ARG);\n" + - pattern: curl_setopt(..., CURLOPT_SSL_VERIFYPEER, $IS_VERIFIED) + - metavariable-regex: + metavariable: $IS_VERIFIED + regex: 0|false|null severity: ERROR - id: php.lang.security.deserialization.extract-user-data - mode: taint - pattern-sources: - - pattern-either: - - pattern: $_GET[...] - - pattern: $_FILES[...] - - pattern: $_POST[...] - pattern-sinks: - - pattern: extract(...) - pattern-sanitizers: - - pattern: extract($VAR, EXTR_SKIP,...) - message: Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to - prevent overwriting existing variables. languages: - php + message: Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag + to prevent overwriting existing variables. metadata: category: security + confidence: MEDIUM cwe: - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - technology: - - php references: - https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data - shortlink: https://sg.run/6bv1 semgrep.dev: rule: + origin: community r_id: 18259 - rv_id: 1263278 rule_id: nJUykq - version_id: w8TRovw + rv_id: 1263278 url: https://semgrep.dev/playground/r/w8TRovw/php.lang.security.deserialization.extract-user-data - origin: community - severity: ERROR -- id: php.lang.security.injection.echoed-request.echoed-request + version_id: w8TRovw + shortlink: https://sg.run/6bv1 + source: https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data + subcategory: + - vuln + technology: + - php + vulnerability_class: + - 'Insecure Deserialization ' mode: taint - message: '`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data - to users.' + pattern-sanitizers: + - pattern: extract($VAR, EXTR_SKIP,...) + pattern-sinks: + - pattern: extract(...) + pattern-sources: + - pattern-either: + - pattern: $_GET[...] + - pattern: $_FILES[...] + - pattern: $_POST[...] + severity: ERROR +- fix: echo htmlentities($...VARS); + id: php.lang.security.injection.echoed-request.echoed-request languages: - php - severity: ERROR - pattern-sources: - - pattern: $_REQUEST - - pattern: $_GET - - pattern: $_POST - pattern-sinks: - - pattern: echo $...VARS; + message: '`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data + to users.' + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://www.php.net/manual/en/function.htmlentities.php + - https://www.php.net/manual/en/reserved.variables.request.php + - https://www.php.net/manual/en/reserved.variables.post.php + - https://www.php.net/manual/en/reserved.variables.get.php + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + semgrep.dev: + rule: + origin: community + r_id: 31707 + rule_id: BYUyyg + rv_id: 1263283 + url: https://semgrep.dev/playground/r/d6TyxE9/php.lang.security.injection.echoed-request.echoed-request + version_id: d6TyxE9 + shortlink: https://sg.run/Bqqb + source: https://semgrep.dev/r/php.lang.security.injection.echoed-request.echoed-request + subcategory: + - vuln + technology: + - php + vulnerability_class: + - Cross-Site-Scripting (XSS) + mode: taint pattern-sanitizers: - pattern: htmlentities(...) - pattern: htmlspecialchars(...) @@ -16403,56 +14041,56 @@ rules: - pattern: escapeHtml(...) - pattern: escapeHtml(...) - pattern: escapeHtmlAttr(...) - fix: echo htmlentities($...VARS); + pattern-sinks: + - pattern: echo $...VARS; + pattern-sources: + - pattern: $_REQUEST + - pattern: $_GET + - pattern: $_POST + severity: ERROR +- fix: print(htmlentities($...VARS)); + id: php.lang.security.injection.printed-request.printed-request + languages: + - php + message: '`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data + to users.' metadata: - technology: - - php + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security references: - https://www.php.net/manual/en/function.htmlentities.php - https://www.php.net/manual/en/reserved.variables.request.php - https://www.php.net/manual/en/reserved.variables.post.php - https://www.php.net/manual/en/reserved.variables.get.php - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html - cwe2022-top25: true - cwe2021-top25: true + semgrep.dev: + rule: + origin: community + r_id: 128886 + rule_id: KxUvRBw + rv_id: 1263284 + url: https://semgrep.dev/playground/r/ZRTKAk4/php.lang.security.injection.printed-request.printed-request + version_id: ZRTKAk4 + shortlink: https://sg.run/QrxEJ + source: https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request subcategory: - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - php vulnerability_class: - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/php.lang.security.injection.echoed-request.echoed-request - shortlink: https://sg.run/Bqqb - semgrep.dev: - rule: - r_id: 31707 - rv_id: 1263283 - rule_id: BYUyyg - version_id: d6TyxE9 - url: https://semgrep.dev/playground/r/d6TyxE9/php.lang.security.injection.echoed-request.echoed-request - origin: community -- id: php.lang.security.injection.printed-request.printed-request mode: taint - message: '`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data - to users.' - languages: - - php - severity: ERROR - pattern-sources: - - pattern: $_REQUEST - - pattern: $_GET - - pattern: $_POST - pattern-sinks: - - pattern: print($...VARS); pattern-sanitizers: - pattern: htmlentities(...) - pattern: htmlspecialchars(...) @@ -16471,86 +14109,47 @@ rules: - pattern: escapeHtml(...) - pattern: escapeHtml(...) - pattern: escapeHtmlAttr(...) - fix: print(htmlentities($...VARS)); - metadata: - technology: - - php - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - owasp: - - A07:2017 - Cross-Site Scripting (XSS) - - A03:2021 - Injection - - A05:2025 - Injection - category: security - references: - - https://www.php.net/manual/en/function.htmlentities.php - - https://www.php.net/manual/en/reserved.variables.request.php - - https://www.php.net/manual/en/reserved.variables.post.php - - https://www.php.net/manual/en/reserved.variables.get.php - - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request - shortlink: https://sg.run/QrxEJ - semgrep.dev: - rule: - r_id: 128886 - rv_id: 1263284 - rule_id: KxUvRBw - version_id: ZRTKAk4 - url: https://semgrep.dev/playground/r/ZRTKAk4/php.lang.security.injection.printed-request.printed-request - origin: community + pattern-sinks: + - pattern: print($...VARS); + pattern-sources: + - pattern: $_REQUEST + - pattern: $_GET + - pattern: $_POST + severity: ERROR - id: php.lang.security.injection.tainted-callable.tainted-callable - severity: WARNING + languages: + - php message: Callable based on user input risks remote code execution. metadata: - technology: - - php category: security + confidence: MEDIUM cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://www.php.net/manual/en/language.types.callable.php - subcategory: - - vuln - impact: HIGH - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable - shortlink: https://sg.run/YGb33 semgrep.dev: rule: + origin: community r_id: 141958 - rv_id: 1263285 rule_id: 0oULBKK - version_id: nWT2L5x + rv_id: 1263285 url: https://semgrep.dev/playground/r/nWT2L5x/php.lang.security.injection.tainted-callable.tainted-callable - origin: community - languages: - - php + version_id: nWT2L5x + shortlink: https://sg.run/YGb33 + source: https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable + subcategory: + - vuln + technology: + - php + vulnerability_class: + - Code Injection mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: $_GET - - pattern: $_POST - - pattern: $_COOKIE - - pattern: $_REQUEST - - pattern: file_get_contents('php://input') pattern-sinks: - patterns: - pattern: $CALLABLE @@ -16636,49 +14235,49 @@ rules: - pattern-inside: xml_set_element_handler($PARSER, $CALLABLE, $CALLABLE) - pattern-inside: xml_set_notation_decl_handler($PARSER, $CALLABLE) - pattern-inside: Yar_Concurrent_Client::loop($CALLABLE, ...) + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + - pattern: file_get_contents('php://input') + severity: WARNING - id: php.lang.security.injection.tainted-exec.tainted-exec languages: - php - severity: WARNING message: User input is passed to a function that executes a shell command. This can lead to remote code execution. metadata: - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' category: security - technology: - - php + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection - subcategory: - - vuln - impact: HIGH - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec - shortlink: https://sg.run/kxEEz semgrep.dev: rule: + origin: community r_id: 146572 - rv_id: 1263286 rule_id: 10UOGG5 - version_id: ExTExyR + rv_id: 1263286 url: https://semgrep.dev/playground/r/ExTExyR/php.lang.security.injection.tainted-exec.tainted-exec - origin: community + version_id: ExTExyR + shortlink: https://sg.run/kxEEz + source: https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec + subcategory: + - vuln + technology: + - php + vulnerability_class: + - Command Injection mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: $_GET - - pattern: $_POST - - pattern: $_COOKIE - - pattern: $_REQUEST - - pattern: file_get_contents('php://input') pattern-sanitizers: - patterns: - pattern-either: @@ -16696,54 +14295,52 @@ rules: - pattern: popen(...) - pattern: expect_popen(...) - pattern: shell_exec(...) - - pattern: '`...` - - ' -- id: php.lang.security.injection.tainted-filename.tainted-filename + - pattern: "`...`\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + - pattern: file_get_contents('php://input') severity: WARNING +- id: php.lang.security.injection.tainted-filename.tainted-filename + languages: + - php message: File name based on user input risks server-side request forgery. metadata: - technology: - - php category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29 - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename - shortlink: https://sg.run/Ayqp semgrep.dev: rule: + origin: community r_id: 16250 - rv_id: 1263287 rule_id: 5rUpro - version_id: 7ZTE3J1 + rv_id: 1263287 url: https://semgrep.dev/playground/r/7ZTE3J1/php.lang.security.injection.tainted-filename.tainted-filename - origin: community - languages: - - php + version_id: 7ZTE3J1 + shortlink: https://sg.run/Ayqp + source: https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename + subcategory: + - vuln + technology: + - php + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: $_GET - - pattern: $_POST - - pattern: $_COOKIE - - pattern: $_REQUEST - - pattern: $_SERVER pattern-sanitizers: - patterns: - pattern-either: @@ -16887,42 +14484,56 @@ rules: - pattern-inside: sha1_file($FILENAME, ...) - pattern-inside: simplexml_load_file($FILENAME, ...) - pattern: $FILENAME + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + - pattern: $_SERVER + severity: WARNING - id: php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation languages: - php - severity: WARNING - message: <- A new object is created where the class name is based on user input. This could lead to remote code execution, - as it allows to instantiate any class in the application. + message: <- A new object is created where the class name is based on user input. This could lead to remote code + execution, as it allows to instantiate any class in the application. metadata: - cwe: - - 'CWE-470: Use of Externally-Controlled Input to Select Classes or Code (''Unsafe Reflection'')' category: security - technology: - - php + confidence: MEDIUM + cwe: + - "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation - shortlink: https://sg.run/7ndw semgrep.dev: rule: + origin: community r_id: 16438 - rv_id: 1263288 rule_id: v8U4DA + rv_id: 1263288 + url: + https://semgrep.dev/playground/r/LjTkgLy/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation version_id: LjTkgLy - url: https://semgrep.dev/playground/r/LjTkgLy/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation - origin: community + shortlink: https://sg.run/7ndw + source: https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation + subcategory: + - vuln + technology: + - php + vulnerability_class: + - Improper Authorization mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: new $SINK(...) + - pattern: $SINK pattern-sources: - patterns: - pattern-either: @@ -16931,57 +14542,45 @@ rules: - pattern: $_COOKIE - pattern: $_REQUEST - pattern: $_SERVER - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: new $SINK(...) - - pattern: $SINK -- id: php.lang.security.injection.tainted-session.tainted-session severity: WARNING - message: Session key based on user input risks session poisoning. The user can determine the key used for the session, and - thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating - the session can result in access control issues. +- id: php.lang.security.injection.tainted-session.tainted-session + languages: + - php + message: Session key based on user input risks session poisoning. The user can determine the key used for the session, + and thus write any session variable. Session variables are typically trusted to be set only by the application, and + manipulating the session can result in access control issues. metadata: - technology: - - php category: security + confidence: MEDIUM cwe: - 'CWE-284: Improper Access Control' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://en.wikipedia.org/wiki/Session_poisoning - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session - shortlink: https://sg.run/bxNp semgrep.dev: rule: + origin: community r_id: 73470 - rv_id: 1263289 rule_id: 4bUdoP - version_id: 8KT5rPE + rv_id: 1263289 url: https://semgrep.dev/playground/r/8KT5rPE/php.lang.security.injection.tainted-session.tainted-session - origin: community - languages: - - php + version_id: 8KT5rPE + shortlink: https://sg.run/bxNp + source: https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session + subcategory: + - vuln + technology: + - php + vulnerability_class: + - Improper Authorization mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: $_GET - - pattern: $_POST - - pattern: $_COOKIE - - pattern: $_REQUEST pattern-sanitizers: - patterns: - pattern-either: @@ -17022,171 +14621,163 @@ rules: - patterns: - pattern-inside: $_SESSION[$KEY] = $VAL; - pattern: $KEY + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + severity: WARNING - id: php.lang.security.injection.tainted-sql-string.tainted-sql-string languages: - php - severity: ERROR - message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using - prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of - SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements - (`$mysqli->prepare("INSERT INTO test(id, label) VALUES (?, ?)");`) or a safe library. + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings + using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible + indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use + prepared statements (`$mysqli->prepare("INSERT INTO test(id, label) VALUES (?, ?)");`) or a safe library. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/www-community/attacks/SQL_Injection - category: security - technology: - - php - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/lZYG semgrep.dev: rule: + origin: community r_id: 14757 - rv_id: 1263290 rule_id: qNUXdL - version_id: gETB7vY + rv_id: 1263290 url: https://semgrep.dev/playground/r/gETB7vY/php.lang.security.injection.tainted-sql-string.tainted-sql-string - origin: community + version_id: gETB7vY + shortlink: https://sg.run/lZYG + source: https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - php + vulnerability_class: + - SQL Injection mode: taint pattern-sanitizers: - pattern-either: - pattern: mysqli_real_escape_string(...) - pattern: real_escape_string(...) - pattern: $MYSQLI->real_escape_string(...) - pattern-sources: - - patterns: - - pattern-either: - - pattern: $_GET - - pattern: $_POST - - pattern: $_COOKIE - - pattern: $_REQUEST pattern-sinks: - pattern-either: - patterns: - - pattern: 'sprintf($SQLSTR, ...) - - ' + - pattern: "sprintf($SQLSTR, ...)\n" - metavariable-regex: metavariable: $SQLSTR regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.* - patterns: - - pattern: '"...$EXPR..." - - ' + - pattern: "\"...$EXPR...\"\n" - metavariable-regex: metavariable: $EXPR regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.* - patterns: - - pattern: '"$SQLSTR".$EXPR - - ' + - pattern: "\"$SQLSTR\".$EXPR\n" - metavariable-regex: metavariable: $SQLSTR regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.* + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + severity: ERROR - id: php.lang.security.injection.tainted-url-host.tainted-url-host languages: - php - severity: WARNING - message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data - to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. - They could also probe internal servers or other resources that the server running this code can access. (This is called - server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, - or hardcode the correct host. + message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send + data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with + this request. They could also probe internal servers or other resources that the server running this code can + access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an + allowlist for approved hosts, or hardcode the correct host. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html - category: security - technology: - - php - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host - shortlink: https://sg.run/Y8no semgrep.dev: rule: + origin: community r_id: 14758 - rv_id: 1263291 rule_id: lBU8K1 - version_id: QkTGqRd + rv_id: 1263291 url: https://semgrep.dev/playground/r/QkTGqRd/php.lang.security.injection.tainted-url-host.tainted-url-host - origin: community + version_id: QkTGqRd + shortlink: https://sg.run/Y8no + source: https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host + subcategory: + - vuln + technology: + - php + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: $_GET - - pattern: $_POST - - pattern: $_COOKIE - - pattern: $_REQUEST pattern-sinks: - pattern-either: - patterns: - - pattern: 'sprintf($URLSTR, ...) - - ' + - pattern: "sprintf($URLSTR, ...)\n" - metavariable-pattern: - metavariable: $URLSTR language: generic + metavariable: $URLSTR pattern: $SCHEME://%s - patterns: - - pattern: '"...{$EXPR}..." - - ' - - pattern-regex: '.*://\{.* - - ' + - pattern: "\"...{$EXPR}...\"\n" + - pattern-regex: ".*://\\{.*\n" - patterns: - - pattern: '"...$EXPR..." - - ' - - pattern-regex: '.*://\$.* - - ' + - pattern: "\"...$EXPR...\"\n" + - pattern-regex: ".*://\\$.*\n" - patterns: - - pattern: '"...".$EXPR - - ' - - pattern-regex: '.*://["''].* - - ' -- id: php.lang.security.md5-used-as-password.md5-used-as-password + - pattern: "\"...\".$EXPR\n" + - pattern-regex: ".*://[\"'].*\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST severity: WARNING - message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked - by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, - PASSWORD_BCRYPT, $OPTIONS);`. +- id: php.lang.security.md5-used-as-password.md5-used-as-password languages: - php + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be + cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can + use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -17197,324 +14788,302 @@ rules: - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords - https://github.com/returntocorp/semgrep-rules/issues/1609 - https://www.php.net/password_hash - category: security - technology: - - md5 - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password - shortlink: https://sg.run/66YL semgrep.dev: rule: + origin: community r_id: 14759 - rv_id: 1263294 rule_id: YGUD1O - version_id: PkTR37j + rv_id: 1263294 url: https://semgrep.dev/playground/r/PkTR37j/php.lang.security.md5-used-as-password.md5-used-as-password - origin: community + version_id: PkTR37j + shortlink: https://sg.run/66YL + source: https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password + subcategory: + - vuln + technology: + - md5 + vulnerability_class: + - Cryptographic Issues mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: md5(...) - - pattern: hash('md5', ...) pattern-sinks: - patterns: - pattern: $FUNCTION(...) - metavariable-regex: metavariable: $FUNCTION regex: (?i)(.*password.*) + pattern-sources: + - patterns: + - pattern-either: + - pattern: md5(...) + - pattern: hash('md5', ...) + severity: WARNING - id: php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv - patterns: - - pattern-either: - - pattern: openssl_encrypt($D, $M, $K, $FLAGS, "...",...); - - pattern: openssl_decrypt($D, $M, $K, $FLAGS, "...",...); - - metavariable-comparison: - metavariable: $M - comparison: re.match(".*-CBC",$M) - message: Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data. languages: - php - severity: ERROR + message: Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data. metadata: + category: security + confidence: HIGH cwe: - 'CWE-329: Generation of Predictable IV with CBC Mode' - references: - - https://csrc.nist.gov/publications/detail/sp/800-38a/final + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - technology: - - php - - openssl - category: security - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv - shortlink: https://sg.run/LgWJ + references: + - https://csrc.nist.gov/publications/detail/sp/800-38a/final semgrep.dev: rule: + origin: community r_id: 19039 - rv_id: 1263295 rule_id: DbUGbE - version_id: JdTzxOD + rv_id: 1263295 url: https://semgrep.dev/playground/r/JdTzxOD/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv - origin: community + version_id: JdTzxOD + shortlink: https://sg.run/LgWJ + source: https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv + subcategory: + - vuln + technology: + - php + - openssl + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern-either: + - pattern: openssl_encrypt($D, $M, $K, $FLAGS, "...",...); + - pattern: openssl_decrypt($D, $M, $K, $FLAGS, "...",...); + - metavariable-comparison: + comparison: re.match(".*-CBC",$M) + metavariable: $M + severity: ERROR - id: php.lang.security.phpinfo-use.phpinfo-use - pattern: phpinfo(...); + languages: + - php message: The 'phpinfo' function may reveal sensitive information about your environment. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control references: - https://www.php.net/manual/en/function.phpinfo - https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php - category: security - technology: - - php - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use - shortlink: https://sg.run/W82E semgrep.dev: rule: + origin: community r_id: 9397 - rv_id: 1263298 rule_id: ReUglY - version_id: RGT0LN0 + rv_id: 1263298 url: https://semgrep.dev/playground/r/RGT0LN0/php.lang.security.phpinfo-use.phpinfo-use - origin: community - languages: - - php + version_id: RGT0LN0 + shortlink: https://sg.run/W82E + source: https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use + subcategory: + - vuln + technology: + - php + vulnerability_class: + - Mishandled Sensitive Information + pattern: phpinfo(...); severity: ERROR - id: php.lang.security.redirect-to-request-uri.redirect-to-request-uri - patterns: - - pattern-either: - - pattern: 'header(''$LOCATION'' . $_SERVER[''REQUEST_URI'']); - - ' - - pattern: 'header(''$LOCATION'' . $_SERVER[''REQUEST_URI''] . $MORE); - - ' - - metavariable-regex: - metavariable: $LOCATION - regex: ^(?i)location:\s*$ - message: Redirecting to the current request URL may redirect to another domain, if the current path starts with two slashes. E.g. - in https://www.example.com//attacker.com, the value of REQUEST_URI is //attacker.com, and redirecting to it will redirect - to that domain. + languages: + - php + message: Redirecting to the current request URL may redirect to another domain, if the current path starts with two + slashes. E.g. in https://www.example.com//attacker.com, the value of REQUEST_URI is //attacker.com, and redirecting + to it will redirect to that domain. metadata: - references: - - https://www.php.net/manual/en/reserved.variables.server.php - - https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html category: security - technology: - - php + confidence: MEDIUM + cwe: + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' - likelihood: MEDIUM - impact: LOW - confidence: MEDIUM - subcategory: - - vuln - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/php.lang.security.redirect-to-request-uri.redirect-to-request-uri - shortlink: https://sg.run/RWl2 + references: + - https://www.php.net/manual/en/reserved.variables.server.php + - https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html semgrep.dev: rule: + origin: community r_id: 35493 - rv_id: 1263299 rule_id: 3qUb4n - version_id: A8Tgdvq + rv_id: 1263299 url: https://semgrep.dev/playground/r/A8Tgdvq/php.lang.security.redirect-to-request-uri.redirect-to-request-uri - origin: community - languages: - - php + version_id: A8Tgdvq + shortlink: https://sg.run/RWl2 + source: https://semgrep.dev/r/php.lang.security.redirect-to-request-uri.redirect-to-request-uri + subcategory: + - vuln + technology: + - php + vulnerability_class: + - Open Redirect + patterns: + - pattern-either: + - pattern: "header('$LOCATION' . $_SERVER['REQUEST_URI']);\n" + - pattern: "header('$LOCATION' . $_SERVER['REQUEST_URI'] . $MORE);\n" + - metavariable-regex: + metavariable: $LOCATION + regex: ^(?i)location:\s*$ severity: WARNING - id: php.lang.security.tainted-exec.tainted-exec - mode: taint - pattern-sources: - - pattern: $_REQUEST - - pattern: $_GET - - pattern: $_POST - - pattern: $_COOKIE - pattern-sinks: - - pattern: exec(...) - - pattern: system(...) - - pattern: popen(...) - - pattern: passthru(...) - - pattern: shell_exec(...) - - pattern: pcntl_exec(...) - - pattern: proc_open(...) - pattern-sanitizers: - - pattern: escapeshellarg(...) - message: Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using - command. + languages: + - php + message: Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when + using command. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A03:2021 - Injection + - A05:2025 - Injection references: - https://www.stackhawk.com/blog/php-command-injection/ - https://brightsec.com/blog/code-injection-php/ - https://www.acunetix.com/websitesecurity/php-security-2/ - category: security - technology: - - php - owasp: - - A03:2021 - Injection - - A05:2025 - Injection - cwe2022-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec - shortlink: https://sg.run/JAkP semgrep.dev: rule: + origin: community r_id: 73146 - rv_id: 1263300 rule_id: 9AUw06 - version_id: BjTkZ4y + rv_id: 1263300 url: https://semgrep.dev/playground/r/BjTkZ4y/php.lang.security.tainted-exec.tainted-exec - origin: community - languages: - - php - severity: ERROR -- id: php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection + version_id: BjTkZ4y + shortlink: https://sg.run/JAkP + source: https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec + subcategory: + - vuln + technology: + - php + vulnerability_class: + - Code Injection mode: taint - pattern-sources: - - patterns: - - focus-metavariable: $ARG - - pattern-inside: 'Route::$METHOD($ROUTE_NAME, function(...,$ARG,...){...}) - - ' pattern-sanitizers: - - patterns: - - pattern: 'DB::raw("...",[...]) - - ' + - pattern: escapeshellarg(...) pattern-sinks: - - patterns: - - pattern: 'DB::raw(...) - - ' - message: HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe - interpolation. + - pattern: exec(...) + - pattern: system(...) + - pattern: popen(...) + - pattern: passthru(...) + - pattern: shell_exec(...) + - pattern: pcntl_exec(...) + - pattern: proc_open(...) + pattern-sources: + - pattern: $_REQUEST + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + severity: ERROR +- id: php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection languages: - php - severity: WARNING + message: HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or + unsafe interpolation. metadata: category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md - technology: - - php - - laravel - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection - shortlink: https://sg.run/x94g semgrep.dev: rule: + origin: community r_id: 21674 - rv_id: 1263305 rule_id: zdUln0 + rv_id: 1263305 + url: + https://semgrep.dev/playground/r/qkTR7A9/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection version_id: qkTR7A9 - url: https://semgrep.dev/playground/r/qkTR7A9/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection - origin: community + shortlink: https://sg.run/x94g + source: https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection + subcategory: + - vuln + technology: + - php + - laravel + vulnerability_class: + - SQL Injection + mode: taint + pattern-sanitizers: + - patterns: + - pattern: "DB::raw(\"...\",[...])\n" + pattern-sinks: + - patterns: + - pattern: "DB::raw(...)\n" + pattern-sources: + - patterns: + - focus-metavariable: $ARG + - pattern-inside: "Route::$METHOD($ROUTE_NAME, function(...,$ARG,...){...})\n" + severity: WARNING - id: php.laravel.security.laravel-sql-injection.laravel-sql-injection + languages: + - php + message: Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in + sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - category: security - technology: - - laravel references: - https://laravel.com/docs/8.x/queries - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection - shortlink: https://sg.run/x40p semgrep.dev: rule: + origin: community r_id: 16830 - rv_id: 1263313 rule_id: j2UQdp - version_id: BjTkZ45 + rv_id: 1263313 url: https://semgrep.dev/playground/r/BjTkZ45/php.laravel.security.laravel-sql-injection.laravel-sql-injection - origin: community - severity: WARNING - message: Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive - data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements. - languages: - - php + version_id: BjTkZ45 + shortlink: https://sg.run/x40p + source: https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection + subcategory: + - vuln + technology: + - laravel + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: $_GET - - pattern: $_POST - - pattern: $_COOKIE - - pattern: $_REQUEST - - pattern: $_SERVER pattern-sinks: - patterns: - pattern-either: @@ -17611,22 +15180,67 @@ rules: - patterns: - pattern: $QUERY - pattern-inside: DB::unprepared($QUERY) + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET + - pattern: $_POST + - pattern: $_COOKIE + - pattern: $_REQUEST + - pattern: $_SERVER + severity: WARNING - id: php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator + languages: + - php + message: Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL + injection. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://laravel.com/docs/9.x/validation#rule-unique + semgrep.dev: + rule: + origin: community + r_id: 21677 + rule_id: X5ULgE + rv_id: 1263314 + url: + https://semgrep.dev/playground/r/DkTRbBl/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator + version_id: DkTRbBl + shortlink: https://sg.run/vkeb + source: https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator + subcategory: + - vuln + technology: + - php + - laravel + vulnerability_class: + - SQL Injection mode: taint + pattern-sinks: + - patterns: + - pattern: "Illuminate\\Validation\\Rule::unique(...)->ignore(...,$IGNORE,...)\n" + - focus-metavariable: $IGNORE pattern-sources: - patterns: - - pattern: 'public function $F(...,Request $R,...){...} - - ' + - pattern: "public function $F(...,Request $R,...){...}\n" - focus-metavariable: $R - patterns: - pattern-either: - - pattern: '$this->$PROPERTY - - ' - - pattern: '$this->$PROPERTY->$GET - - ' + - pattern: "$this->$PROPERTY\n" + - pattern: "$this->$PROPERTY->$GET\n" - metavariable-pattern: metavariable: $PROPERTY patterns: @@ -17644,70 +15258,45 @@ rules: - pattern: post - pattern: json - pattern-either: - - pattern-inside: 'class $CL extends Illuminate\Http\Request {...} - - ' - - pattern-inside: 'class $CL extends Illuminate\Foundation\Http\FormRequest {...} - - ' - pattern-sinks: - - patterns: - - pattern: 'Illuminate\Validation\Rule::unique(...)->ignore(...,$IGNORE,...) - - ' - - focus-metavariable: $IGNORE - message: Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection. + - pattern-inside: "class $CL extends Illuminate\\Http\\Request {...}\n" + - pattern-inside: "class $CL extends Illuminate\\Foundation\\Http\\FormRequest {...}\n" + severity: ERROR +- id: php.wordpress-plugins.security.audit.wp-ssrf-audit.wp-ssrf-audit languages: - php - severity: ERROR + message: Detected usage of vulnerable functions with user input, which could lead to SSRF vulnerabilities. metadata: category: security - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - technology: - - php - - laravel - references: - - https://laravel.com/docs/9.x/validation#rule-unique - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM confidence: MEDIUM + cwe: 'CWE-918: Server-Side Request Forgery (SSRF)' + impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator - shortlink: https://sg.run/vkeb + likelihood: MEDIUM + owasp: A10:2021 - Server-Side Request Forgery (SSRF) + references: + - https://developer.wordpress.org/reference/functions/wp_safe_remote_get/ + - https://developer.wordpress.org/reference/functions/wp_remote_get/ + - https://patchstack.com/articles/exploring-the-unpatched-wordpress-ssrf/ semgrep.dev: rule: - r_id: 21677 - rv_id: 1263314 - rule_id: X5ULgE - version_id: DkTRbBl - url: https://semgrep.dev/playground/r/DkTRbBl/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator origin: community -- id: php.wordpress-plugins.security.audit.wp-ssrf-audit.wp-ssrf-audit - languages: - - php - severity: WARNING - message: Detected usage of vulnerable functions with user input, which could lead to SSRF vulnerabilities. + r_id: 191611 + rule_id: 6JUZyKX + rv_id: 1039233 + url: https://semgrep.dev/playground/r/JdTp6rq/php.wordpress-plugins.security.audit.wp-ssrf-audit.wp-ssrf-audit + version_id: JdTp6rq + shortlink: https://sg.run/K3y06 + source: https://semgrep.dev/r/php.wordpress-plugins.security.audit.wp-ssrf-audit.wp-ssrf-audit + subcategory: + - audit + technology: + - Wordpress Plugins + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: $_GET[...] - - pattern: $_POST[...] - - pattern: $_REQUEST[...] - - pattern: get_option(...) - - pattern: get_user_meta(...) - - pattern: get_query_var(...) + paths: + include: + - '**/wp-content/plugins/**/*.php' pattern-sinks: - patterns: - focus-metavariable: $URL @@ -17719,92 +15308,106 @@ rules: - pattern: wp_oembed_get($URL, ...) - pattern: vip_safe_wp_remote_get($URL, ...) - pattern: wp_safe_remote_post($URL, ...) - paths: - include: - - '**/wp-content/plugins/**/*.php' + pattern-sources: + - patterns: + - pattern-either: + - pattern: $_GET[...] + - pattern: $_POST[...] + - pattern: $_REQUEST[...] + - pattern: get_option(...) + - pattern: get_user_meta(...) + - pattern: get_query_var(...) + severity: WARNING +- fix-regex: + count: 1 + regex: '[Hh][Tt][Tt][Pp]://' + replacement: https:// + id: problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request + languages: + - java + message: Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent over an + insecure channel. Instead, it is recommended to send requests over HTTPS. metadata: - cwe: 'CWE-918: Server-Side Request Forgery (SSRF)' - owasp: A10:2021 - Server-Side Request Forgery (SSRF) category: security confidence: MEDIUM - likelihood: MEDIUM - impact: HIGH - subcategory: - - audit - technology: - - Wordpress Plugins - references: - - https://developer.wordpress.org/reference/functions/wp_safe_remote_get/ - - https://developer.wordpress.org/reference/functions/wp_remote_get/ - - https://patchstack.com/articles/exploring-the-unpatched-wordpress-ssrf/ - vulnerability_class: - - Server-Side Request Forgery (SSRF) + cwe: 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/php.wordpress-plugins.security.audit.wp-ssrf-audit.wp-ssrf-audit - shortlink: https://sg.run/K3y06 - semgrep.dev: - rule: - r_id: 191611 - rv_id: 1039233 - rule_id: 6JUZyKX - version_id: JdTp6rq - url: https://semgrep.dev/playground/r/JdTp6rq/php.wordpress-plugins.security.audit.wp-ssrf-audit.wp-ssrf-audit - origin: community -- id: problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request - message: Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent over an insecure - channel. Instead, it is recommended to send requests over HTTPS. - severity: WARNING - metadata: likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - category: security - cwe: 'CWE-319: Cleartext Transmission of Sensitive Information' owasp: A03:2017 - Sensitive Data Exposure references: - https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html - https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection() + semgrep.dev: + rule: + origin: community + r_id: 48942 + rule_id: 6JUOJ2 + rv_id: 946061 + url: + https://semgrep.dev/playground/r/WrTEo9G/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request + version_id: WrTEo9G + shortlink: https://sg.run/QE2q + source: + https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request subcategory: - vuln technology: - java vulnerability: Insecure Transport - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information - source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request - shortlink: https://sg.run/QE2q + patterns: + - pattern: "\"=~/[Hh][Tt][Tt][Pp]://.*/\"\n" + - pattern-inside: "$R = new HttpGet(\"=~/[Hh][Tt][Tt][Pp]://.*/\");\n...\n$CLIENT. ... .execute($R, ...);\n" + severity: WARNING +- id: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + languages: + - python + message: Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be + controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it + is not controllable by an external resource. You may consider using 'shlex.escape()'. + metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec + - https://docs.python.org/3/library/shlex.html semgrep.dev: rule: - r_id: 48942 - rv_id: 946061 - rule_id: 6JUOJ2 - version_id: WrTEo9G - url: https://semgrep.dev/playground/r/WrTEo9G/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request origin: community - languages: - - java - fix-regex: - regex: '[Hh][Tt][Tt][Pp]://' - replacement: https:// - count: 1 - patterns: - - pattern: '"=~/[Hh][Tt][Tt][Pp]://.*/" - - ' - - pattern-inside: '$R = new HttpGet("=~/[Hh][Tt][Tt][Pp]://.*/"); - - ... - - $CLIENT. ... .execute($R, ...); - - ' -- id: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + r_id: 18260 + rule_id: EwUrX8 + rv_id: 1263331 + url: + https://semgrep.dev/playground/r/rxTAKgo/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + version_id: rxTAKgo + shortlink: https://sg.run/oyv0 + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" pattern-sinks: - patterns: - focus-metavariable: $CMD @@ -17816,57 +15419,61 @@ rules: - pattern: asyncio.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) - pattern: asyncio.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) - pattern: asyncio.subprocess.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) - - pattern: asyncio.subprocess.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) - message: Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled - by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable - by an external resource. You may consider using 'shlex.escape()'. + - pattern: asyncio.subprocess.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], + ...) + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR +- id: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + languages: + - python + message: Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data + can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to + ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' - references: - - https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec - - https://docs.python.org/3/library/shlex.html category: security - technology: - - python - cwe2022-top25: true + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec - shortlink: https://sg.run/oyv0 + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec + - https://docs.python.org/3/library/shlex.html semgrep.dev: rule: - r_id: 18260 - rv_id: 1263331 - rule_id: EwUrX8 - version_id: rxTAKgo - url: https://semgrep.dev/playground/r/rxTAKgo/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec origin: community - languages: - - python - severity: ERROR -- id: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + r_id: 18261 + rule_id: 7KUxXg + rv_id: 1263332 + url: + https://semgrep.dev/playground/r/bZT53Ww/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + version_id: bZT53Ww + shortlink: https://sg.run/z14d + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + subcategory: + - vuln + technology: + - python + - aws-lambda + vulnerability_class: + - Command Injection mode: taint - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" pattern-sinks: - patterns: - focus-metavariable: $CMD @@ -17875,57 +15482,59 @@ rules: - pattern: $LOOP.subprocess_exec($PROTOCOL, [$CMD, ...], ...) - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) - message: Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can - be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it - is not controllable by an external resource. You may consider using 'shlex.escape()'. + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR +- id: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell + languages: + - python + message: Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled + by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not + controllable by an external resource. You may consider using 'shlex.escape()'. metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' references: - - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec + - https://docs.python.org/3/library/asyncio-subprocess.html - https://docs.python.org/3/library/shlex.html - category: security + semgrep.dev: + rule: + origin: community + r_id: 18262 + rule_id: L1UEl7 + rv_id: 1263333 + url: + https://semgrep.dev/playground/r/NdTzyWA/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell + version_id: NdTzyWA + shortlink: https://sg.run/p9vZ + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell + subcategory: + - vuln technology: - python - aws-lambda - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection - source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec - shortlink: https://sg.run/z14d - semgrep.dev: - rule: - r_id: 18261 - rv_id: 1263332 - rule_id: 7KUxXg - version_id: bZT53Ww - url: https://semgrep.dev/playground/r/bZT53Ww/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec - origin: community - languages: - - python - severity: ERROR -- id: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell mode: taint - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" pattern-sinks: - patterns: - focus-metavariable: $CMD @@ -17933,101 +15542,58 @@ rules: - pattern: $LOOP.subprocess_shell($PROTOCOL, $CMD) - pattern: asyncio.subprocess.create_subprocess_shell($CMD, ...) - pattern: asyncio.create_subprocess_shell($CMD, ...) - message: Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by - a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable - by an external resource. You may consider using 'shlex.escape()'. + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR +- id: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process + languages: + - python + message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach + this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' - references: - - https://docs.python.org/3/library/asyncio-subprocess.html - - https://docs.python.org/3/library/shlex.html category: security - technology: - - python - - aws-lambda - cwe2022-top25: true + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell - shortlink: https://sg.run/p9vZ - semgrep.dev: - rule: - r_id: 18262 - rv_id: 1263333 - rule_id: L1UEl7 - version_id: NdTzyWA - url: https://semgrep.dev/playground/r/NdTzyWA/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell - origin: community - languages: - - python - severity: ERROR -- id: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process - mode: taint - message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this - function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. - metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' - category: security - technology: - - python - - aws-lambda references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process - shortlink: https://sg.run/2AjL semgrep.dev: rule: + origin: community r_id: 18263 - rv_id: 1263334 rule_id: 8GUGBq + rv_id: 1263334 + url: + https://semgrep.dev/playground/r/kbTzGv8/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process version_id: kbTzGv8 - url: https://semgrep.dev/playground/r/kbTzGv8/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process - origin: community - languages: - - python - severity: ERROR - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" + shortlink: https://sg.run/2AjL + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + subcategory: + - vuln + technology: + - python + - aws-lambda + vulnerability_class: + - Command Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $CMD @@ -18036,7 +15602,8 @@ rules: - pattern: os.$METHOD($MODE, $CMD, ...) - metavariable-regex: metavariable: $METHOD - regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) + regex: + (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) - patterns: - pattern-inside: os.$METHOD($MODE, $BASH, ["-c", $CMD,...],...) - metavariable-regex: @@ -18053,116 +15620,120 @@ rules: - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR - id: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use - mode: taint - message: Detected subprocess function with argument tainted by an `event` object. If this data can be controlled by a malicious - actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. - Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the - command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for - this purpose. + languages: + - python + message: Detected subprocess function with argument tainted by an `event` object. If this data can be controlled by a + malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is + secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means + you have to split the command string into an array of strings for the command and its arguments. You may consider + using 'shlex.split()' for this purpose. metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' - references: - - https://docs.python.org/3/library/subprocess.html - - https://docs.python.org/3/library/shlex.html category: security - technology: - - python - - aws-lambda - cwe2022-top25: true + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use - shortlink: https://sg.run/XZ7B + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.python.org/3/library/subprocess.html + - https://docs.python.org/3/library/shlex.html semgrep.dev: rule: + origin: community r_id: 18264 - rv_id: 1263335 rule_id: gxUyn1 + rv_id: 1263335 + url: + https://semgrep.dev/playground/r/w8TRogj/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use version_id: w8TRogj - url: https://semgrep.dev/playground/r/w8TRogj/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use - origin: community - languages: - - python - severity: ERROR - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" - pattern-sinks: - - patterns: - - pattern: subprocess.$FUNC(..., shell=True, ...) + shortlink: https://sg.run/XZ7B + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use + subcategory: + - vuln + technology: + - python + - aws-lambda + vulnerability_class: + - Command Injection + mode: taint pattern-sanitizers: - pattern: shlex.split(...) - pattern: pipes.quote(...) - pattern: shlex.quote(...) + pattern-sinks: + - patterns: + - pattern: subprocess.$FUNC(..., shell=True, ...) + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR - id: python.aws-lambda.security.dangerous-system-call.dangerous-system-call - mode: taint - message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this - function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier - to use without accidentally exposing a command injection vulnerability. + languages: + - python + message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach + this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, + which is easier to use without accidentally exposing a command injection vulnerability. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.2.4 Dyanmic Code Execution Features - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' category: security - technology: - - python - references: - - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call - shortlink: https://sg.run/jDvN + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection semgrep.dev: rule: + origin: community r_id: 18265 - rv_id: 1263336 rule_id: QrUkg6 + rv_id: 1263336 + url: + https://semgrep.dev/playground/r/xyTjzbG/python.aws-lambda.security.dangerous-system-call.dangerous-system-call version_id: xyTjzbG - url: https://semgrep.dev/playground/r/xyTjzbG/python.aws-lambda.security.dangerous-system-call.dangerous-system-call - origin: community - languages: - - python - severity: ERROR - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" + shortlink: https://sg.run/jDvN + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $CMD @@ -18172,51 +15743,53 @@ rules: - pattern: os.popen2($CMD,...) - pattern: os.popen3($CMD,...) - pattern: os.popen4($CMD,...) + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR - id: python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection - mode: taint + languages: + - python + message: Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the + variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from + `$EVENT` directly to DynamoDB client. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-943: Improper Neutralization of Special Elements in Data Query Logic' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - category: security - technology: - - python - - boto3 - - aws-lambda - - dynamodb references: - https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection - shortlink: https://sg.run/jjrl semgrep.dev: rule: + origin: community r_id: 21321 - rv_id: 946088 rule_id: KxUJ2B + rv_id: 946088 + url: + https://semgrep.dev/playground/r/9lTy1rQ/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection version_id: 9lTy1rQ - url: https://semgrep.dev/playground/r/9lTy1rQ/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection - origin: community - message: Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable - is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly - to DynamoDB client. - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" + shortlink: https://sg.run/jjrl + source: https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection + subcategory: + - vuln + technology: + - python + - boto3 + - aws-lambda + - dynamodb + vulnerability_class: + - Improper Validation + mode: taint pattern-sanitizers: - patterns: - - pattern: '{...} - - ' + - pattern: "{...}\n" pattern-sinks: - patterns: - focus-metavariable: $SINK @@ -18225,65 +15798,55 @@ rules: - pattern: $TABLE.query(..., QueryFilter = $SINK, ...) - pattern-either: - patterns: - - pattern-inside: '$TABLE = $DB.Table(...) - - ... - - ' - - pattern-inside: '$DB = boto3.resource(''dynamodb'', ...) - - ... - - ' - - pattern-inside: '$TABLE = boto3.client(''dynamodb'', ...) - - ... - - ' + - pattern-inside: "$TABLE = $DB.Table(...)\n...\n" + - pattern-inside: "$DB = boto3.resource('dynamodb', ...)\n...\n" + - pattern-inside: "$TABLE = boto3.client('dynamodb', ...)\n...\n" + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" severity: ERROR - languages: - - python - id: python.aws-lambda.security.mysql-sqli.mysql-sqli languages: - python - message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + message: "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', (''active''))`' - mode: taint + instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`" metadata: - references: - - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html - - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - mysql - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli - shortlink: https://sg.run/1RjG + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html + - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html semgrep.dev: rule: + origin: community r_id: 18266 - rv_id: 1263337 rule_id: 3qU3eE - version_id: O9TpxLJ + rv_id: 1263337 url: https://semgrep.dev/playground/r/O9TpxLJ/python.aws-lambda.security.mysql-sqli.mysql-sqli - origin: community + version_id: O9TpxLJ + shortlink: https://sg.run/1RjG + source: https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli + subcategory: + - vuln + technology: + - aws-lambda + - mysql + vulnerability_class: + - SQL Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $QUERY @@ -18291,16 +15854,8 @@ rules: - pattern: $CURSOR.execute($QUERY,...) - pattern: $CURSOR.executemany($QUERY,...) - pattern-either: - - pattern-inside: 'import mysql - - ... - - ' - - pattern-inside: 'import mysql.cursors - - ... - - ' + - pattern-inside: "import mysql\n...\n" + - pattern-inside: "import mysql.cursors\n...\n" pattern-sources: - patterns: - pattern: event @@ -18309,46 +15864,46 @@ rules: - id: python.aws-lambda.security.psycopg-sqli.psycopg-sqli languages: - python - message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + message: "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', ''active'')`' - mode: taint + instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`" metadata: - references: - - https://www.psycopg.org/docs/cursor.html#cursor.execute - - https://www.psycopg.org/docs/cursor.html#cursor.executemany - - https://www.psycopg.org/docs/cursor.html#cursor.mogrify category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://www.psycopg.org/docs/cursor.html#cursor.execute + - https://www.psycopg.org/docs/cursor.html#cursor.executemany + - https://www.psycopg.org/docs/cursor.html#cursor.mogrify + semgrep.dev: + rule: + origin: community + r_id: 18267 + rule_id: 4bUQG1 + rv_id: 1263338 + url: https://semgrep.dev/playground/r/e1TyjPZ/python.aws-lambda.security.psycopg-sqli.psycopg-sqli + version_id: e1TyjPZ + shortlink: https://sg.run/9L8r + source: https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli + subcategory: + - vuln technology: - aws-lambda - psycopg - psycopg2 - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection - source: https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli - shortlink: https://sg.run/9L8r - semgrep.dev: - rule: - r_id: 18267 - rv_id: 1263338 - rule_id: 4bUQG1 - version_id: e1TyjPZ - url: https://semgrep.dev/playground/r/e1TyjPZ/python.aws-lambda.security.psycopg-sqli.psycopg-sqli - origin: community + mode: taint pattern-sinks: - patterns: - focus-metavariable: $QUERY @@ -18356,11 +15911,7 @@ rules: - pattern: $CURSOR.execute($QUERY,...) - pattern: $CURSOR.executemany($QUERY,...) - pattern: $CURSOR.mogrify($QUERY,...) - - pattern-inside: 'import psycopg2 - - ... - - ' + - pattern-inside: "import psycopg2\n...\n" pattern-sources: - patterns: - pattern: event @@ -18369,52 +15920,48 @@ rules: - id: python.aws-lambda.security.pymssql-sqli.pymssql-sqli languages: - python - message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + message: "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', ''active'')`' - mode: taint + instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`" metadata: - references: - - https://pypi.org/project/pymssql/ category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - pymssql - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli - shortlink: https://sg.run/yXvP + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://pypi.org/project/pymssql/ semgrep.dev: rule: + origin: community r_id: 18268 - rv_id: 1263339 rule_id: PeUxO0 - version_id: vdT06bG + rv_id: 1263339 url: https://semgrep.dev/playground/r/vdT06bG/python.aws-lambda.security.pymssql-sqli.pymssql-sqli - origin: community + version_id: vdT06bG + shortlink: https://sg.run/yXvP + source: https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli + subcategory: + - vuln + technology: + - aws-lambda + - pymssql + vulnerability_class: + - SQL Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern: $CURSOR.execute($QUERY,...) - - pattern-inside: 'import pymssql - - ... - - ' + - pattern-inside: "import pymssql\n...\n" pattern-sources: - patterns: - pattern: event @@ -18423,58 +15970,50 @@ rules: - id: python.aws-lambda.security.pymysql-sqli.pymysql-sqli languages: - python - message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + message: "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', (''active''))`' - mode: taint + instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`" metadata: - references: - - https://pypi.org/project/PyMySQL/#id4 category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - pymysql - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli - shortlink: https://sg.run/reve + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://pypi.org/project/PyMySQL/#id4 semgrep.dev: rule: + origin: community r_id: 18269 - rv_id: 1263340 rule_id: JDUlel - version_id: d6TyxNA + rv_id: 1263340 url: https://semgrep.dev/playground/r/d6TyxNA/python.aws-lambda.security.pymysql-sqli.pymysql-sqli - origin: community + version_id: d6TyxNA + shortlink: https://sg.run/reve + source: https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli + subcategory: + - vuln + technology: + - aws-lambda + - pymysql + vulnerability_class: + - SQL Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern: $CURSOR.execute($QUERY,...) - pattern-either: - - pattern-inside: 'import pymysql - - ... - - ' - - pattern-inside: 'import pymysql.cursors - - ... - - ' + - pattern-inside: "import pymysql\n...\n" + - pattern-inside: "import pymysql.cursors\n...\n" pattern-sources: - patterns: - pattern: event @@ -18483,203 +16022,194 @@ rules: - id: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli languages: - python - message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + message: "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = ?'', ''active'')`' - mode: taint + instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`" metadata: - references: - - https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - sqlalchemy - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli - shortlink: https://sg.run/b48W + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute semgrep.dev: rule: + origin: community r_id: 18270 - rv_id: 1263341 rule_id: 5rUy3N - version_id: ZRTKARp + rv_id: 1263341 url: https://semgrep.dev/playground/r/ZRTKARp/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli - origin: community + version_id: ZRTKARp + shortlink: https://sg.run/b48W + source: https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli + subcategory: + - vuln + technology: + - aws-lambda + - sqlalchemy + vulnerability_class: + - SQL Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern: $CURSOR.execute($QUERY,...) - - pattern-inside: 'import sqlalchemy - - ... - - ' + - pattern-inside: "import sqlalchemy\n...\n" pattern-sources: - patterns: - pattern: event - pattern-inside: "def $HANDLER(event, context):\n ...\n" severity: WARNING - id: python.aws-lambda.security.tainted-code-exec.tainted-code-exec - mode: taint - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" - pattern-sinks: - - patterns: - - pattern-either: - - pattern: eval($CODE, ...) - - pattern: exec($CODE, ...) - message: Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can - be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable - by external sources. + languages: + - python + message: Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content + can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not + definable by external sources. metadata: - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' - owasp: - - A03:2021 - Injection - - A05:2025 - Injection asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.2.4 Dyanmic Code Execution Features - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' category: security - technology: - - python - references: - - https://owasp.org/Top10/A03_2021-Injection - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM confidence: MEDIUM + cwe: + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec - shortlink: https://sg.run/Ng7y + likelihood: MEDIUM + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection semgrep.dev: rule: + origin: community r_id: 18271 - rv_id: 1263342 rule_id: GdUDJP - version_id: nWT2LD2 + rv_id: 1263342 url: https://semgrep.dev/playground/r/nWT2LD2/python.aws-lambda.security.tainted-code-exec.tainted-code-exec - origin: community - languages: - - python - severity: WARNING -- id: python.aws-lambda.security.tainted-html-response.tainted-html-response + version_id: nWT2LD2 + shortlink: https://sg.run/Ng7y + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: eval($CODE, ...) + - pattern: exec($CODE, ...) pattern-sources: - patterns: - pattern: event - pattern-inside: "def $HANDLER(event, context):\n ...\n" - pattern-sinks: - - patterns: - - pattern: $BODY - - pattern-inside: '{..., "headers": {..., "Content-Type": "text/html", ...}, "body": $BODY, ... } - - ' - message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering - HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers - steal sensitive user data. + severity: WARNING +- id: python.aws-lambda.security.tainted-html-response.tainted-html-response + languages: + - python + message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of + rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - aws-lambda references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response - shortlink: https://sg.run/k9vP semgrep.dev: rule: + origin: community r_id: 18272 - rv_id: 1263343 rule_id: ReUKrk + rv_id: 1263343 + url: + https://semgrep.dev/playground/r/ExTEx5o/python.aws-lambda.security.tainted-html-response.tainted-html-response version_id: ExTEx5o - url: https://semgrep.dev/playground/r/ExTEx5o/python.aws-lambda.security.tainted-html-response.tainted-html-response - origin: community - languages: - - python + shortlink: https://sg.run/k9vP + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - Cross-Site-Scripting (XSS) + mode: taint + pattern-sinks: + - patterns: + - pattern: $BODY + - pattern-inside: "{..., \"headers\": {..., \"Content-Type\": \"text/html\", ...}, \"body\": $BODY, ... }\n" + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" severity: WARNING - id: python.aws-lambda.security.tainted-html-string.tainted-html-string languages: - python - severity: WARNING - message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods - of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could - let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use - templates which will safely render HTML instead. + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure + methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, + which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered + safely. Otherwise, use templates which will safely render HTML instead. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - aws-lambda references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string - shortlink: https://sg.run/8zNy semgrep.dev: rule: + origin: community r_id: 18484 - rv_id: 1263344 rule_id: JDUlwy - version_id: 7ZTE36K + rv_id: 1263344 url: https://semgrep.dev/playground/r/7ZTE36K/python.aws-lambda.security.tainted-html-string.tainted-html-string - origin: community + version_id: 7ZTE36K + shortlink: https://sg.run/8zNy + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" pattern-sinks: - patterns: - pattern-either: @@ -18690,193 +16220,180 @@ rules: - pattern: '"$HTMLSTR" + ...' - pattern: f"$HTMLSTR{...}..." - patterns: - - pattern-inside: '$HTML = "$HTMLSTR" - - ... - - ' + - pattern-inside: "$HTML = \"$HTMLSTR\"\n...\n" - pattern-either: - pattern: $HTML % ... - pattern: $HTML.format(...) - pattern: $HTML + ... - metavariable-pattern: - metavariable: $HTMLSTR language: generic + metavariable: $HTMLSTR pattern: <$TAG ... - - pattern-not-inside: 'print(...) - - ' -- id: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization - mode: taint + - pattern-not-inside: "print(...)\n" pattern-sources: - patterns: - pattern: event - pattern-inside: "def $HANDLER(event, context):\n ...\n" - pattern-sinks: - - patterns: - - focus-metavariable: $SINK - - pattern-either: - - pattern: pickle.load($SINK,...) - - pattern: pickle.loads($SINK,...) - - pattern: _pickle.load($SINK,...) - - pattern: _pickle.loads($SINK,...) - - pattern: cPickle.load($SINK,...) - - pattern: cPickle.loads($SINK,...) - - pattern: dill.load($SINK,...) - - pattern: dill.loads($SINK,...) - - pattern: shelve.open($SINK,...) - message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized - data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar - text-based serialization format. + severity: WARNING +- id: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization + languages: + - python + message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the + serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON + or a similar text-based serialization format. metadata: - owasp: - - A08:2017 - Insecure Deserialization - - A08:2021 - Software and Data Integrity Failures - - A08:2025 - Software or Data Integrity Failures + category: security + confidence: MEDIUM cwe: - 'CWE-502: Deserialization of Untrusted Data' - references: - - https://docs.python.org/3/library/pickle.html - - https://davidhamann.de/2020/04/05/exploiting-python-pickle/ - category: security - technology: - - python - - aws-lambda - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization - shortlink: https://sg.run/JbjW + likelihood: MEDIUM + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + references: + - https://docs.python.org/3/library/pickle.html + - https://davidhamann.de/2020/04/05/exploiting-python-pickle/ semgrep.dev: rule: + origin: community r_id: 21602 - rv_id: 1263345 rule_id: JDUDQg + rv_id: 1263345 + url: + https://semgrep.dev/playground/r/LjTkgd9/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization version_id: LjTkgd9 - url: https://semgrep.dev/playground/r/LjTkgd9/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization - origin: community - languages: - - python + shortlink: https://sg.run/JbjW + source: + https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization + subcategory: + - vuln + technology: + - python + - aws-lambda + vulnerability_class: + - 'Insecure Deserialization ' + mode: taint + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern-either: + - pattern: pickle.load($SINK,...) + - pattern: pickle.loads($SINK,...) + - pattern: _pickle.load($SINK,...) + - pattern: _pickle.loads($SINK,...) + - pattern: cPickle.load($SINK,...) + - pattern: cPickle.loads($SINK,...) + - pattern: dill.load($SINK,...) + - pattern: dill.loads($SINK,...) + - pattern: shelve.open($SINK,...) + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" severity: WARNING - id: python.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - python - message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction - could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the - database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider - using an object-relational mapper (ORM) such as Sequelize which will protect your queries. + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual + construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify + contents of the database. Instead, use a parameterized query which is available by default in most database engines. + Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. metadata: - references: - - https://owasp.org/www-community/attacks/SQL_Injection category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/wXvA + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/SQL_Injection semgrep.dev: rule: + origin: community r_id: 18273 - rv_id: 1263346 rule_id: AbU3LX - version_id: 8KT5ron + rv_id: 1263346 url: https://semgrep.dev/playground/r/8KT5ron/python.aws-lambda.security.tainted-sql-string.tainted-sql-string - origin: community + version_id: 8KT5ron + shortlink: https://sg.run/wXvA + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - SQL Injection mode: taint pattern-sinks: - patterns: - pattern-either: - - pattern: '"$SQLSTR" + ... - - ' - - pattern: '"$SQLSTR" % ... - - ' - - pattern: '"$SQLSTR".format(...) - - ' - - pattern: 'f"$SQLSTR{...}..." - - ' + - pattern: "\"$SQLSTR\" + ...\n" + - pattern: "\"$SQLSTR\" % ...\n" + - pattern: "\"$SQLSTR\".format(...)\n" + - pattern: "f\"$SQLSTR{...}...\"\n" - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*= - - pattern-not-inside: 'print(...) - - ' + - pattern-not-inside: "print(...)\n" pattern-sources: - patterns: - pattern: event - pattern-inside: "def $HANDLER(event, context):\n ...\n" severity: ERROR - id: python.boto3.security.hardcoded-token.hardcoded-token - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + languages: + - python + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-798: Use of Hard-coded Credentials' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - https://bento.dev/checks/boto3/hardcoded-access-token/ - https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/ - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - category: security - technology: - - boto3 - - secrets - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token - shortlink: https://sg.run/LwQ6 semgrep.dev: rule: + origin: community r_id: 9439 - rv_id: 1263347 rule_id: 5rUOwK - version_id: gETB78n + rv_id: 1263347 url: https://semgrep.dev/playground/r/gETB78n/python.boto3.security.hardcoded-token.hardcoded-token - origin: community - languages: - - python - severity: WARNING + version_id: gETB78n + shortlink: https://sg.run/LwQ6 + source: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token + subcategory: + - vuln + technology: + - boto3 + - secrets + vulnerability_class: + - Hard-coded Secrets mode: taint - pattern-sources: - - pattern: '"..." - - ' pattern-sinks: - patterns: - pattern-either: @@ -18893,92 +16410,100 @@ rules: - pattern-regex: ^AKI - pattern-regex: ^[A-Za-z0-9/+=]+$ - metavariable-analysis: - metavariable: $VALUE analyzer: entropy + metavariable: $VALUE + pattern-sources: + - pattern: "\"...\"\n" + severity: WARNING - id: python.cryptography.security.empty-aes-key.empty-aes-key - message: Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may - allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption. - patterns: - - pattern: AES.new("",...) languages: - python - severity: WARNING + message: Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and + may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES + encryption. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - 'CWE-310: Cryptographic Issues' + functional-categories: + - crypto::search::key-length::pycrypto + - crypto::search::key-length::pycryptodome + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: A6:2017 misconfiguration references: - https://cwe.mitre.org/data/definitions/327.html - https://cwe.mitre.org/data/definitions/310.html - category: security + semgrep.dev: + rule: + origin: community + r_id: 44817 + rule_id: OrUADK + rv_id: 946105 + url: https://semgrep.dev/playground/r/8KTKjRg/python.cryptography.security.empty-aes-key.empty-aes-key + version_id: 8KTKjRg + shortlink: https://sg.run/zQ9G + source: https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key subcategory: - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - owasp: A6:2017 misconfiguration - functional-categories: - - crypto::search::key-length::pycrypto - - crypto::search::key-length::pycryptodome technology: - python - pycrypto - pycryptodome - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key - shortlink: https://sg.run/zQ9G - semgrep.dev: - rule: - r_id: 44817 - rv_id: 946105 - rule_id: OrUADK - version_id: 8KTKjRg - url: https://semgrep.dev/playground/r/8KTKjRg/python.cryptography.security.empty-aes-key.empty-aes-key - origin: community -- id: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 - message: ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output. Its use is strongly - discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` - package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, - keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. + patterns: + - pattern: AES.new("",...) + severity: WARNING +- fix: AES + id: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 + languages: + - python + message: ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output. Its use is + strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With + the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode + with a 128-bit key. Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES + algorithm instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + bandit-code: B304 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers - category: security - technology: - - cryptography - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::symmetric-algorithm::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 - shortlink: https://sg.run/xoZL semgrep.dev: rule: + origin: community r_id: 33630 - rv_id: 1263348 rule_id: KxU8gK + rv_id: 1263348 + url: + https://semgrep.dev/playground/r/QkTGq3Q/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 version_id: QkTGq3Q - url: https://semgrep.dev/playground/r/QkTGq3Q/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/xoZL + source: + https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$ARC4($KEY) - pattern-inside: cryptography.hazmat.primitives.ciphers.Cipher(...) @@ -18986,467 +16511,465 @@ rules: metavariable: $ARC4 regex: ^(ARC4)$ - focus-metavariable: $ARC4 - fix: AES -- id: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish - message: Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak - keys. The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` - package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, - keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. + severity: WARNING +- fix: AES + id: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish + languages: + - python + message: Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using + weak keys. The author has recommended that users of Blowfish move to newer algorithms such as AES. With the + `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a + 128-bit key. Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm + instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + bandit-code: B304 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers - https://tools.ietf.org/html/rfc5469 - category: security - technology: - - cryptography - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::symmetric-algorithm::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish - shortlink: https://sg.run/OdzL semgrep.dev: rule: + origin: community r_id: 33631 - rv_id: 1263349 rule_id: qNULvO + rv_id: 1263349 + url: + https://semgrep.dev/playground/r/3ZT4XK7/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish version_id: 3ZT4XK7 - url: https://semgrep.dev/playground/r/3ZT4XK7/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/OdzL + source: + https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$BLOWFISH($KEY) - metavariable-regex: metavariable: $BLOWFISH regex: ^(Blowfish)$ - focus-metavariable: $BLOWFISH - fix: AES -- id: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea - message: IDEA (International Data Encryption Algorithm) is a block cipher created in 1991. It is an optional component - of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys. It is recommended that you do not - use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package - it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, - keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. + severity: WARNING +- fix: AES + id: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea + languages: + - python + message: IDEA (International Data Encryption Algorithm) is a block cipher created in 1991. It is an optional + component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys. It is recommended + that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the + `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a + 128-bit key. Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm + instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + bandit-code: B304 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://tools.ietf.org/html/rfc5469 - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA - category: security - technology: - - cryptography - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::symmetric-algorithm::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea - shortlink: https://sg.run/3xyK semgrep.dev: rule: + origin: community r_id: 9443 - rv_id: 1263350 rule_id: BYUNPg + rv_id: 1263350 + url: + https://semgrep.dev/playground/r/44TEjNJ/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea version_id: 44TEjNJ - url: https://semgrep.dev/playground/r/44TEjNJ/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/3xyK + source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$IDEA($KEY) - metavariable-regex: metavariable: $IDEA regex: ^(IDEA)$ - focus-metavariable: $IDEA - fix: AES -- id: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb - message: ECB (Electronic Code Book) is the simplest mode of operation for block ciphers. Each block of data is encrypted - in the same way. This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave - significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM. + severity: WARNING +- fix: cryptography.hazmat.primitives.ciphers.modes.GCM($IV) + id: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb + languages: + - python + message: ECB (Electronic Code Book) is the simplest mode of operation for block ciphers. Each block of data is + encrypted in the same way. This means identical plaintext blocks will always result in identical ciphertext blocks, + which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as + GCM. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L101 + bandit-code: B305 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::mode::cryptography + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B305 references: - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes - https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption - category: security - technology: - - cryptography - subcategory: - - audit - likelihood: LOW - impact: LOW - confidence: MEDIUM - functional-categories: - - crypto::search::mode::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb - shortlink: https://sg.run/4xr5 semgrep.dev: rule: + origin: community r_id: 9444 - rv_id: 1263351 rule_id: DbUp5g + rv_id: 1263351 + url: + https://semgrep.dev/playground/r/PkTR3w7/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb version_id: PkTR3w7 - url: https://semgrep.dev/playground/r/PkTR3w7/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb - origin: community + shortlink: https://sg.run/4xr5 + source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L101 + subcategory: + - audit + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues + pattern: cryptography.hazmat.primitives.ciphers.modes.ECB($IV) severity: WARNING +- fix: SHA256 + id: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 languages: - python - pattern: cryptography.hazmat.primitives.ciphers.modes.ECB($IV) - fix: cryptography.hazmat.primitives.ciphers.modes.GCM($IV) -- id: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 - message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use SHA256 or SHA3 instead. + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + bandit-code: B303 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B303 references: - https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5 - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - cryptography - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::symmetric-algorithm::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 - shortlink: https://sg.run/eY88 semgrep.dev: rule: + origin: community r_id: 33632 - rv_id: 1263352 rule_id: lBUopp + rv_id: 1263352 + url: + https://semgrep.dev/playground/r/JdTzxww/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 version_id: JdTzxww - url: https://semgrep.dev/playground/r/JdTzxww/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/eY88 + source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - pattern: cryptography.hazmat.primitives.hashes.$MD5() - metavariable-regex: metavariable: $MD5 regex: ^(MD5)$ - focus-metavariable: $MD5 - fix: SHA256 -- id: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 - patterns: - - pattern: cryptography.hazmat.primitives.hashes.$SHA(...) - - metavariable-pattern: - metavariable: $SHA - pattern: 'SHA1 - - ' - - focus-metavariable: $SHA - fix: 'SHA256 - - ' - message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not - suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + severity: WARNING +- fix: "SHA256\n" + id: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + languages: + - python + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore + not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + bandit-code: B303 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B303 references: - https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1 - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - cryptography - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::symmetric-algorithm::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 - shortlink: https://sg.run/J9Qy semgrep.dev: rule: + origin: community r_id: 9446 - rv_id: 1263353 rule_id: 0oU5dN + rv_id: 1263353 + url: + https://semgrep.dev/playground/r/5PTo1l0/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 version_id: 5PTo1l0 - url: https://semgrep.dev/playground/r/5PTo1l0/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 - origin: community + shortlink: https://sg.run/J9Qy + source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: cryptography.hazmat.primitives.hashes.$SHA(...) + - metavariable-pattern: + metavariable: $SHA + pattern: "SHA1\n" + - focus-metavariable: $SHA severity: WARNING +- fix: "2048\n" + id: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size languages: - python -- id: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size - patterns: - - pattern-either: - - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(..., key_size=$SIZE, ...) - - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key($SIZE, ...) - - metavariable-comparison: - metavariable: $SIZE - comparison: $SIZE < 2048 - - focus-metavariable: $SIZE - fix: '2048 - - ' message: Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::key-length::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/ - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf - category: security - technology: - - cryptography - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::key-length::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size - shortlink: https://sg.run/5Qb0 semgrep.dev: rule: + origin: community r_id: 9447 - rv_id: 1263354 rule_id: KxUb0x + rv_id: 1263354 + url: + https://semgrep.dev/playground/r/GxTkeOK/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size version_id: GxTkeOK - url: https://semgrep.dev/playground/r/GxTkeOK/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size - origin: community - languages: - - python - severity: WARNING -- id: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size + shortlink: https://sg.run/5Qb0 + source: https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...) - - pattern: cryptography.hazmat.primitives.asymmetric.ec.$SIZE - - metavariable-pattern: + - pattern-either: + - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(..., key_size=$SIZE, ...) + - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key($SIZE, ...) + - metavariable-comparison: + comparison: $SIZE < 2048 metavariable: $SIZE - pattern-either: - - pattern: SECP192R1 - - pattern: SECT163K1 - - pattern: SECT163R2 - focus-metavariable: $SIZE - fix: 'SECP256R1 - - ' - message: Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'. + severity: WARNING +- fix: "SECP256R1\n" + id: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size + languages: + - python + message: Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use + 'ec.SECP256R1'. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::key-length::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves - category: security - technology: - - cryptography - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::key-length::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size - shortlink: https://sg.run/GeQq semgrep.dev: rule: + origin: community r_id: 9448 - rv_id: 1263355 rule_id: qNUjZ3 + rv_id: 1263355 + url: + https://semgrep.dev/playground/r/RGT0LW6/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size version_id: RGT0LW6 - url: https://semgrep.dev/playground/r/RGT0LW6/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size - origin: community - languages: - - python - severity: WARNING -- id: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size + shortlink: https://sg.run/GeQq + source: https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + subcategory: + - audit + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-either: - - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(..., key_size=$SIZE, ...) - - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key($EXP, $SIZE, ...) - - metavariable-comparison: + - pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...) + - pattern: cryptography.hazmat.primitives.asymmetric.ec.$SIZE + - metavariable-pattern: metavariable: $SIZE - comparison: $SIZE < 2048 + pattern-either: + - pattern: SECP192R1 + - pattern: SECT163K1 + - pattern: SECT163R2 - focus-metavariable: $SIZE - fix: '2048 - - ' + severity: WARNING +- fix: "2048\n" + id: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size + languages: + - python message: Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::key-length::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/ - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf - category: security - technology: - - cryptography - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::key-length::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size - shortlink: https://sg.run/RoQq semgrep.dev: rule: + origin: community r_id: 9449 - rv_id: 1263356 rule_id: lBU9jn + rv_id: 1263356 + url: + https://semgrep.dev/playground/r/A8TgdPK/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size version_id: A8TgdPK - url: https://semgrep.dev/playground/r/A8TgdPK/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size - origin: community - languages: - - python + shortlink: https://sg.run/RoQq + source: https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + subcategory: + - audit + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern-either: + - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(..., key_size=$SIZE, ...) + - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key($EXP, $SIZE, ...) + - metavariable-comparison: + comparison: $SIZE < 2048 + metavariable: $SIZE + - focus-metavariable: $SIZE severity: WARNING - id: python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication - message: 'An encryption mode of operation is being used without proper message authentication. This can potentially result - in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ' languages: - python - severity: ERROR + message: 'An encryption mode of operation is being used without proper message authentication. This can potentially result + in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ' metadata: category: security - technology: - - cryptography + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication - shortlink: https://sg.run/N9JL semgrep.dev: rule: + origin: community r_id: 31871 - rv_id: 1263357 rule_id: lBUpNZ + rv_id: 1263357 + url: + https://semgrep.dev/playground/r/BjTkZj5/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication version_id: BjTkZj5 - url: https://semgrep.dev/playground/r/BjTkZj5/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication - origin: community + shortlink: https://sg.run/N9JL + source: + https://semgrep.dev/r/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication + subcategory: + - audit + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - patterns: - - pattern: 'Cipher(..., $HAZMAT_MODE(...),...) - - ' - - pattern-not-inside: 'Cipher(..., $HAZMAT_MODE(...),...) - - ... - - HMAC(...) - - ' - - pattern-not-inside: 'Cipher(..., $HAZMAT_MODE(...),...) - - ... - - hmac.HMAC(...) - - ' + - pattern: "Cipher(..., $HAZMAT_MODE(...),...)\n" + - pattern-not-inside: "Cipher(..., $HAZMAT_MODE(...),...)\n...\nHMAC(...)\n" + - pattern-not-inside: "Cipher(..., $HAZMAT_MODE(...),...)\n...\nhmac.HMAC(...)\n" - metavariable-pattern: metavariable: $HAZMAT_MODE patterns: @@ -19455,118 +16978,98 @@ rules: - pattern: modes.CBC - pattern: modes.CFB - pattern: modes.OFB -- id: python.distributed.security.require-encryption - patterns: - - pattern: 'distributed.security.Security(..., require_encryption=$VAL, ...) - - ' - - metavariable-pattern: - metavariable: $VAL - pattern: 'False - - ' - - focus-metavariable: $VAL - fix: 'True - - ' - message: Initializing a security context for Dask (`distributed`) without "require_encryption" keyword argument may silently - fail to provide security. - severity: WARNING + severity: ERROR +- fix: "True\n" + id: python.distributed.security.require-encryption + languages: + - python + message: Initializing a security context for Dask (`distributed`) without "require_encryption" keyword argument may + silently fail to provide security. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters - category: security - technology: - - distributed - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.distributed.security.require-encryption - shortlink: https://sg.run/AvQ2 semgrep.dev: rule: + origin: community r_id: 9450 - rv_id: 1263358 rule_id: YGURy0 - version_id: DkTRbol + rv_id: 1263358 url: https://semgrep.dev/playground/r/DkTRbol/python.distributed.security.require-encryption - origin: community + version_id: DkTRbol + shortlink: https://sg.run/AvQ2 + source: https://semgrep.dev/r/python.distributed.security.require-encryption + subcategory: + - vuln + technology: + - distributed + vulnerability_class: + - Mishandled Sensitive Information + patterns: + - pattern: "distributed.security.Security(..., require_encryption=$VAL, ...)\n" + - metavariable-pattern: + metavariable: $VAL + pattern: "False\n" + - focus-metavariable: $VAL + severity: WARNING +- id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization languages: - python -- id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization + message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or + `yaml`, which are known to lead to remote code execution vulnerabilities. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - cwe: - - 'CWE-502: Deserialization of Untrusted Data' references: - https://docs.python.org/3/library/pickle.html - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization - shortlink: https://sg.run/9oyr semgrep.dev: rule: + origin: community r_id: 9467 - rv_id: 1409400 rule_id: OrU3e6 + rv_id: 1409400 + url: + https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization version_id: GxTlb9e - url: https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization - origin: community - message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, - which are known to lead to remote code execution vulnerabilities. - languages: - - python - severity: ERROR + shortlink: https://sg.run/9oyr + source: + https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization + subcategory: + - vuln + technology: + - django + vulnerability_class: + - 'Insecure Deserialization ' mode: taint - pattern-sources: - - pattern-either: - - patterns: - - pattern-inside: "def $INSIDE(..., $PARAM, ...):\n ...\n" - - pattern-either: - - pattern: request.$REQFUNC(...) - - pattern: request.$REQFUNC.get(...) - - pattern: request.$REQFUNC[...] pattern-sinks: - pattern-either: - patterns: - pattern-either: - - pattern: 'pickle.$PICKLEFUNC(...) - - ' - - pattern: '_pickle.$PICKLEFUNC(...) - - ' - - pattern: 'cPickle.$PICKLEFUNC(...) - - ' - - pattern: 'shelve.$PICKLEFUNC(...) - - ' + - pattern: "pickle.$PICKLEFUNC(...)\n" + - pattern: "_pickle.$PICKLEFUNC(...)\n" + - pattern: "cPickle.$PICKLEFUNC(...)\n" + - pattern: "shelve.$PICKLEFUNC(...)\n" - metavariable-regex: metavariable: $PICKLEFUNC regex: dumps|dump|load|loads @@ -19584,519 +17087,227 @@ rules: - metavariable-regex: metavariable: $YAMLFUNC regex: dump|dump_all|load|load_all + pattern-sources: + - pattern-either: + - patterns: + - pattern-inside: "def $INSIDE(..., $PARAM, ...):\n ...\n" + - pattern-either: + - pattern: request.$REQFUNC(...) + - pattern: request.$REQFUNC.get(...) + - pattern: request.$REQFUNC[...] + severity: ERROR - id: python.django.security.hashids-with-django-secret.hashids-with-django-secret languages: - python - message: The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, - the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through - the HashIDs. + message: The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient + HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by + attackers, through the HashIDs. metadata: category: security - subcategory: - - vuln + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A02:2021 – Cryptographic Failures references: - https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY - http://carnage.github.io/2015/08/cryptanalysis-of-hashids - technology: - - django - likelihood: LOW - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret - shortlink: https://sg.run/bxeZ semgrep.dev: rule: + origin: community r_id: 72426 - rv_id: 946163 rule_id: 0oUXqy + rv_id: 946163 + url: + https://semgrep.dev/playground/r/0bT15nn/python.django.security.hashids-with-django-secret.hashids-with-django-secret version_id: 0bT15nn - url: https://semgrep.dev/playground/r/0bT15nn/python.django.security.hashids-with-django-secret.hashids-with-django-secret - origin: community + shortlink: https://sg.run/bxeZ + source: https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: hashids.Hashids(..., salt=django.conf.settings.SECRET_KEY, ...) - pattern: hashids.Hashids(django.conf.settings.SECRET_KEY, ...) severity: ERROR - id: python.django.security.injection.code.user-eval-format-string.user-eval-format-string - message: Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote - code. See https://owasp.org/www-community/attacks/Code_Injection for more information. + languages: + - python + message: Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute + remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html - category: security - technology: - - django - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string - shortlink: https://sg.run/4x2z semgrep.dev: rule: + origin: community r_id: 9500 - rv_id: 1263383 rule_id: BYUNw9 + rv_id: 1263383 + url: + https://semgrep.dev/playground/r/vdT06xG/python.django.security.injection.code.user-eval-format-string.user-eval-format-string version_id: vdT06xG - url: https://semgrep.dev/playground/r/vdT06xG/python.django.security.injection.code.user-eval-format-string.user-eval-format-string - origin: community + shortlink: https://sg.run/4x2z + source: https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Code Injection patterns: - pattern-inside: "def $F(...):\n ...\n" - pattern-either: - pattern: eval(..., $STR % request.$W.get(...), ...) - - pattern: '$V = request.$W.get(...) - - ... - - eval(..., $STR % $V, ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - $S = $STR % $V - - ... - - eval(..., $S, ...) - - ' + - pattern: "$V = request.$W.get(...)\n...\neval(..., $STR % $V, ...)\n" + - pattern: "$V = request.$W.get(...)\n...\n$S = $STR % $V\n...\neval(..., $S, ...)\n" - pattern: eval(..., "..." % request.$W(...), ...) - - pattern: '$V = request.$W(...) - - ... - - eval(..., $STR % $V, ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - $S = $STR % $V - - ... - - eval(..., $S, ...) - - ' + - pattern: "$V = request.$W(...)\n...\neval(..., $STR % $V, ...)\n" + - pattern: "$V = request.$W(...)\n...\n$S = $STR % $V\n...\neval(..., $S, ...)\n" - pattern: eval(..., $STR % request.$W[...], ...) - - pattern: '$V = request.$W[...] - - ... - - eval(..., $STR % $V, ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - $S = $STR % $V - - ... - - eval(..., $S, ...) - - ' + - pattern: "$V = request.$W[...]\n...\neval(..., $STR % $V, ...)\n" + - pattern: "$V = request.$W[...]\n...\n$S = $STR % $V\n...\neval(..., $S, ...)\n" - pattern: eval(..., $STR.format(..., request.$W.get(...), ...), ...) - - pattern: '$V = request.$W.get(...) - - ... - - eval(..., $STR.format(..., $V, ...), ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - $S = $STR.format(..., $V, ...) - - ... - - eval(..., $S, ...) - - ' + - pattern: "$V = request.$W.get(...)\n...\neval(..., $STR.format(..., $V, ...), ...)\n" + - pattern: "$V = request.$W.get(...)\n...\n$S = $STR.format(..., $V, ...)\n...\neval(..., $S, ...)\n" - pattern: eval(..., $STR.format(..., request.$W(...), ...), ...) - - pattern: '$V = request.$W(...) - - ... - - eval(..., $STR.format(..., $V, ...), ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - $S = $STR.format(..., $V, ...) - - ... - - eval(..., $S, ...) - - ' + - pattern: "$V = request.$W(...)\n...\neval(..., $STR.format(..., $V, ...), ...)\n" + - pattern: "$V = request.$W(...)\n...\n$S = $STR.format(..., $V, ...)\n...\neval(..., $S, ...)\n" - pattern: eval(..., $STR.format(..., request.$W[...], ...), ...) - - pattern: '$V = request.$W[...] - - ... - - eval(..., $STR.format(..., $V, ...), ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - $S = $STR.format(..., $V, ...) - - ... - - eval(..., $S, ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - eval(..., f"...{$V}...", ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - $S = f"...{$V}..." - - ... - - eval(..., $S, ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - eval(..., f"...{$V}...", ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - $S = f"...{$V}..." - - ... - - eval(..., $S, ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - eval(..., f"...{$V}...", ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - $S = f"...{$V}..." - - ... - - eval(..., $S, ...) - - ' - languages: - - python + - pattern: "$V = request.$W[...]\n...\neval(..., $STR.format(..., $V, ...), ...)\n" + - pattern: "$V = request.$W[...]\n...\n$S = $STR.format(..., $V, ...)\n...\neval(..., $S, ...)\n" + - pattern: "$V = request.$W.get(...)\n...\neval(..., f\"...{$V}...\", ...)\n" + - pattern: "$V = request.$W.get(...)\n...\n$S = f\"...{$V}...\"\n...\neval(..., $S, ...)\n" + - pattern: "$V = request.$W(...)\n...\neval(..., f\"...{$V}...\", ...)\n" + - pattern: "$V = request.$W(...)\n...\n$S = f\"...{$V}...\"\n...\neval(..., $S, ...)\n" + - pattern: "$V = request.$W[...]\n...\neval(..., f\"...{$V}...\", ...)\n" + - pattern: "$V = request.$W[...]\n...\n$S = f\"...{$V}...\"\n...\neval(..., $S, ...)\n" severity: WARNING - id: python.django.security.injection.code.user-eval.user-eval - message: Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary - remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific - functionality you need. + languages: + - python + message: Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute + arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library + for the specific functionality you need. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html - https://owasp.org/www-community/attacks/Code_Injection - category: security - technology: - - django - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval - shortlink: https://sg.run/PJDW semgrep.dev: rule: + origin: community r_id: 9501 - rv_id: 1263384 rule_id: DbUpDQ - version_id: d6Tyx2A + rv_id: 1263384 url: https://semgrep.dev/playground/r/d6Tyx2A/python.django.security.injection.code.user-eval.user-eval - origin: community + version_id: d6Tyx2A + shortlink: https://sg.run/PJDW + source: https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Code Injection patterns: - pattern-inside: "def $F(...):\n ...\n" - pattern-either: - pattern: eval(..., request.$W.get(...), ...) - - pattern: '$V = request.$W.get(...) - - ... - - eval(..., $V, ...) - - ' + - pattern: "$V = request.$W.get(...)\n...\neval(..., $V, ...)\n" - pattern: eval(..., request.$W(...), ...) - - pattern: '$V = request.$W(...) - - ... - - eval(..., $V, ...) - - ' + - pattern: "$V = request.$W(...)\n...\neval(..., $V, ...)\n" - pattern: eval(..., request.$W[...], ...) - - pattern: '$V = request.$W[...] - - ... - - eval(..., $V, ...) - - ' - languages: - - python + - pattern: "$V = request.$W[...]\n...\neval(..., $V, ...)\n" severity: WARNING - id: python.django.security.injection.code.user-exec-format-string.user-exec-format-string - message: Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary - remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific - functionality you need. + languages: + - python + message: Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute + arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library + for the specific functionality you need. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - django references: - https://owasp.org/www-community/attacks/Code_Injection - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string - shortlink: https://sg.run/J9JW semgrep.dev: rule: + origin: community r_id: 9502 - rv_id: 1263385 rule_id: WAUovx + rv_id: 1263385 + url: + https://semgrep.dev/playground/r/ZRTKA1p/python.django.security.injection.code.user-exec-format-string.user-exec-format-string version_id: ZRTKA1p - url: https://semgrep.dev/playground/r/ZRTKA1p/python.django.security.injection.code.user-exec-format-string.user-exec-format-string - origin: community + shortlink: https://sg.run/J9JW + source: https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Code Injection patterns: - pattern-inside: "def $F(...):\n ...\n" - pattern-either: - pattern: exec(..., $STR % request.$W.get(...), ...) - - pattern: '$V = request.$W.get(...) - - ... - - exec(..., $STR % $V, ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - $S = $STR % $V - - ... - - exec(..., $S, ...) - - ' + - pattern: "$V = request.$W.get(...)\n...\nexec(..., $STR % $V, ...)\n" + - pattern: "$V = request.$W.get(...)\n...\n$S = $STR % $V\n...\nexec(..., $S, ...)\n" - pattern: exec(..., "..." % request.$W(...), ...) - - pattern: '$V = request.$W(...) - - ... - - exec(..., $STR % $V, ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - $S = $STR % $V - - ... - - exec(..., $S, ...) - - ' + - pattern: "$V = request.$W(...)\n...\nexec(..., $STR % $V, ...)\n" + - pattern: "$V = request.$W(...)\n...\n$S = $STR % $V\n...\nexec(..., $S, ...)\n" - pattern: exec(..., $STR % request.$W[...], ...) - - pattern: '$V = request.$W[...] - - ... - - exec(..., $STR % $V, ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - $S = $STR % $V - - ... - - exec(..., $S, ...) - - ' + - pattern: "$V = request.$W[...]\n...\nexec(..., $STR % $V, ...)\n" + - pattern: "$V = request.$W[...]\n...\n$S = $STR % $V\n...\nexec(..., $S, ...)\n" - pattern: exec(..., $STR.format(..., request.$W.get(...), ...), ...) - - pattern: '$V = request.$W.get(...) - - ... - - exec(..., $STR.format(..., $V, ...), ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - $S = $STR.format(..., $V, ...) - - ... - - exec(..., $S, ...) - - ' + - pattern: "$V = request.$W.get(...)\n...\nexec(..., $STR.format(..., $V, ...), ...)\n" + - pattern: "$V = request.$W.get(...)\n...\n$S = $STR.format(..., $V, ...)\n...\nexec(..., $S, ...)\n" - pattern: exec(..., $STR.format(..., request.$W(...), ...), ...) - - pattern: '$V = request.$W(...) - - ... - - exec(..., $STR.format(..., $V, ...), ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - $S = $STR.format(..., $V, ...) - - ... - - exec(..., $S, ...) - - ' + - pattern: "$V = request.$W(...)\n...\nexec(..., $STR.format(..., $V, ...), ...)\n" + - pattern: "$V = request.$W(...)\n...\n$S = $STR.format(..., $V, ...)\n...\nexec(..., $S, ...)\n" - pattern: exec(..., $STR.format(..., request.$W[...], ...), ...) - - pattern: '$V = request.$W[...] - - ... - - exec(..., $STR.format(..., $V, ...), ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - $S = $STR.format(..., $V, ...) - - ... - - exec(..., $S, ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - exec(..., f"...{$V}...", ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - $S = f"...{$V}..." - - ... - - exec(..., $S, ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - exec(..., f"...{$V}...", ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - $S = f"...{$V}..." - - ... - - exec(..., $S, ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - exec(..., f"...{$V}...", ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - $S = f"...{$V}..." - - ... - - exec(..., $S, ...) - - ' + - pattern: "$V = request.$W[...]\n...\nexec(..., $STR.format(..., $V, ...), ...)\n" + - pattern: "$V = request.$W[...]\n...\n$S = $STR.format(..., $V, ...)\n...\nexec(..., $S, ...)\n" + - pattern: "$V = request.$W.get(...)\n...\nexec(..., f\"...{$V}...\", ...)\n" + - pattern: "$V = request.$W.get(...)\n...\n$S = f\"...{$V}...\"\n...\nexec(..., $S, ...)\n" + - pattern: "$V = request.$W(...)\n...\nexec(..., f\"...{$V}...\", ...)\n" + - pattern: "$V = request.$W(...)\n...\n$S = f\"...{$V}...\"\n...\nexec(..., $S, ...)\n" + - pattern: "$V = request.$W[...]\n...\nexec(..., f\"...{$V}...\", ...)\n" + - pattern: "$V = request.$W[...]\n...\n$S = f\"...{$V}...\"\n...\nexec(..., $S, ...)\n" - pattern: exec(..., base64.decodestring($S.format(..., request.$W.get(...), ...), ...), ...) - pattern: exec(..., base64.decodestring($S % request.$W.get(...), ...), ...) - pattern: exec(..., base64.decodestring(f"...{request.$W.get(...)}...", ...), ...) @@ -20105,291 +17316,117 @@ rules: - pattern: exec(..., base64.decodestring(bytes($S % request.$W.get(...), ...), ...), ...) - pattern: exec(..., base64.decodestring(bytes(f"...{request.$W.get(...)}...", ...), ...), ...) - pattern: exec(..., base64.decodestring(bytes(request.$W.get(...), ...), ...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - exec(..., base64.decodestring($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = base64.decodestring($DATA, ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = base64.decodestring(bytes($DATA, ...), ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - exec(..., base64.decodestring($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = base64.decodestring($DATA, ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = base64.decodestring(bytes($DATA, ...), ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - exec(..., base64.decodestring($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = base64.decodestring($DATA, ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = base64.decodestring(bytes($DATA, ...), ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - exec(..., base64.decodestring($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = base64.decodestring($DATA, ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = base64.decodestring(bytes($DATA, ...), ...) - - ... - - exec(..., $INTERM, ...) - - ' - languages: - - python + - pattern: "$DATA = request.$W.get(...)\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, ...)\n" severity: WARNING - id: python.django.security.injection.code.user-exec.user-exec - message: Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary - remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific - functionality you need. + languages: + - python + message: Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute + arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library + for the specific functionality you need. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - django references: - https://owasp.org/www-community/attacks/Code_Injection - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec - shortlink: https://sg.run/5Q3X semgrep.dev: rule: + origin: community r_id: 9503 - rv_id: 1263386 rule_id: 0oU5AW - version_id: nWT2LA2 + rv_id: 1263386 url: https://semgrep.dev/playground/r/nWT2LA2/python.django.security.injection.code.user-exec.user-exec - origin: community + version_id: nWT2LA2 + shortlink: https://sg.run/5Q3X + source: https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Code Injection patterns: - pattern-inside: "def $F(...):\n ...\n" - pattern-either: - pattern: exec(..., request.$W.get(...), ...) - - pattern: '$V = request.$W.get(...) - - ... - - exec(..., $V, ...) - - ' + - pattern: "$V = request.$W.get(...)\n...\nexec(..., $V, ...)\n" - pattern: exec(..., request.$W(...), ...) - - pattern: '$V = request.$W(...) - - ... - - exec(..., $V, ...) - - ' + - pattern: "$V = request.$W(...)\n...\nexec(..., $V, ...)\n" - pattern: exec(..., request.$W[...], ...) - - pattern: '$V = request.$W[...] - - ... - - exec(..., $V, ...) - - ' - - pattern: 'loop = asyncio.get_running_loop() - - ... - - await loop.run_in_executor(None, exec, request.$W[...]) - - ' - - pattern: '$V = request.$W[...] - - ... - - loop = asyncio.get_running_loop() - - ... - - await loop.run_in_executor(None, exec, $V) - - ' - - pattern: 'loop = asyncio.get_running_loop() - - ... - - await loop.run_in_executor(None, exec, request.$W.get(...)) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - loop = asyncio.get_running_loop() - - ... - - await loop.run_in_executor(None, exec, $V) - - ' - languages: - - python + - pattern: "$V = request.$W[...]\n...\nexec(..., $V, ...)\n" + - pattern: "loop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, request.$W[...])\n" + - pattern: "$V = request.$W[...]\n...\nloop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, + $V)\n" + - pattern: "loop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, request.$W.get(...))\n" + - pattern: "$V = request.$W.get(...)\n...\nloop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, + $V)\n" severity: WARNING - id: python.django.security.injection.command.command-injection-os-system.command-injection-os-system - message: Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this - must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection - for more information. + languages: + - python + message: Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If + this must be done, use the 'subprocess' module instead and pass the arguments as a list. See + https://owasp.org/www-community/attacks/Command_Injection for more information. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/www-community/attacks/Command_Injection - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system - shortlink: https://sg.run/Gen2 semgrep.dev: rule: + origin: community r_id: 9504 - rv_id: 1263387 rule_id: KxUbp2 + rv_id: 1263387 + url: + https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system version_id: ExTExPo - url: https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system - origin: community - languages: - - python - severity: ERROR + shortlink: https://sg.run/Gen2 + source: + https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Command Injection patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -20397,96 +17434,16 @@ rules: - pattern: os.system(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: os.system(..., $S % request.$W.get(...), ...) - pattern: os.system(..., f"...{request.$W.get(...)}...", ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - os.system(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - os.system(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - os.system(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - os.system(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - os.system(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - os.system(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nos.system(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nos.system(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nos.system(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nos.system(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n" - pattern: $A = os.system(..., request.$W.get(...), ...) - pattern: $A = os.system(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: $A = os.system(..., $S % request.$W.get(...), ...) @@ -20499,96 +17456,16 @@ rules: - pattern: os.system(..., $S.format(..., request.$W(...), ...), ...) - pattern: os.system(..., $S % request.$W(...), ...) - pattern: os.system(..., f"...{request.$W(...)}...", ...) - - pattern: '$DATA = request.$W(...) - - ... - - os.system(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - os.system(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - os.system(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - os.system(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - os.system(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - os.system(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nos.system(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nos.system(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nos.system(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nos.system(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n" - pattern: $A = os.system(..., request.$W(...), ...) - pattern: $A = os.system(..., $S.format(..., request.$W(...), ...), ...) - pattern: $A = os.system(..., $S % request.$W(...), ...) @@ -20601,96 +17478,16 @@ rules: - pattern: os.system(..., $S.format(..., request.$W[...], ...), ...) - pattern: os.system(..., $S % request.$W[...], ...) - pattern: os.system(..., f"...{request.$W[...]}...", ...) - - pattern: '$DATA = request.$W[...] - - ... - - os.system(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - os.system(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - os.system(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - os.system(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - os.system(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - os.system(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nos.system(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nos.system(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nos.system(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nos.system(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n" - pattern: $A = os.system(..., request.$W[...], ...) - pattern: $A = os.system(..., $S.format(..., request.$W[...], ...), ...) - pattern: $A = os.system(..., $S % request.$W[...], ...) @@ -20703,96 +17500,16 @@ rules: - pattern: os.system(..., $S.format(..., request.$W, ...), ...) - pattern: os.system(..., $S % request.$W, ...) - pattern: os.system(..., f"...{request.$W}...", ...) - - pattern: '$DATA = request.$W - - ... - - os.system(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - os.system(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - os.system(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - os.system(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - os.system(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - os.system(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nos.system(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nos.system(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nos.system(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nos.system(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n" - pattern: $A = os.system(..., request.$W, ...) - pattern: $A = os.system(..., $S.format(..., request.$W, ...), ...) - pattern: $A = os.system(..., $S % request.$W, ...) @@ -20801,21 +17518,55 @@ rules: - pattern: return os.system(..., $S.format(..., request.$W, ...), ...) - pattern: return os.system(..., $S % request.$W, ...) - pattern: return os.system(..., f"...{request.$W}...", ...) + severity: ERROR - id: python.django.security.injection.command.subprocess-injection.subprocess-injection languages: - python + message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection + vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them + to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the + command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a + dictionary to allowlist a set of commands. + metadata: + category: security + confidence: HIGH + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 31144 + rule_id: EwUepx + rv_id: 1263388 + url: + https://semgrep.dev/playground/r/7ZTE3qK/python.django.security.injection.command.subprocess-injection.subprocess-injection + version_id: 7ZTE3qK + shortlink: https://sg.run/49BE + source: https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true - pattern-sources: + pattern-sanitizers: - patterns: - - pattern-inside: "def $FUNC(..., $REQUEST, ...):\n ...\n" - - focus-metavariable: $REQUEST - - metavariable-pattern: - metavariable: $REQUEST - patterns: - - pattern: request - - pattern-not-inside: request.build_absolute_uri + - pattern: $DICT[$KEY] + - focus-metavariable: $KEY pattern-sinks: - patterns: - pattern-either: @@ -20823,13 +17574,7 @@ rules: - pattern: subprocess.$FUNC(...) - pattern-not: subprocess.$FUNC("...", ...) - pattern-not: subprocess.$FUNC(["...", ...], ...) - - pattern-not-inside: '$CMD = ["...", ...] - - ... - - subprocess.$FUNC($CMD, ...) - - ' + - pattern-not-inside: "$CMD = [\"...\", ...]\n...\nsubprocess.$FUNC($CMD, ...)\n" - patterns: - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...) - metavariable-regex: @@ -20840,101 +17585,62 @@ rules: - metavariable-regex: metavariable: $INTERPRETER regex: ^(python|python\d)$ - pattern-sanitizers: + pattern-sources: - patterns: - - pattern: $DICT[$KEY] - - focus-metavariable: $KEY + - pattern-inside: "def $FUNC(..., $REQUEST, ...):\n ...\n" + - focus-metavariable: $REQUEST + - metavariable-pattern: + metavariable: $REQUEST + patterns: + - pattern: request + - pattern-not-inside: request.build_absolute_uri severity: ERROR - message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. - An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, - scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, - prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set - of commands. - metadata: - category: security - technology: - - flask - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection - shortlink: https://sg.run/49BE - semgrep.dev: - rule: - r_id: 31144 - rv_id: 1263388 - rule_id: EwUepx - version_id: 7ZTE3qK - url: https://semgrep.dev/playground/r/7ZTE3qK/python.django.security.injection.command.subprocess-injection.subprocess-injection - origin: community - id: python.django.security.injection.csv-writer-injection.csv-writer-injection languages: - python - message: Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate - the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet - application that runs an attacker script, which could steal data from the importing user or, at worst, install malware - on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula - injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs. + message: Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to + generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into + a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, + install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to + mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs. metadata: category: security confidence: MEDIUM cwe: - 'CWE-1236: Improper Neutralization of Formula Elements in a CSV File' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://github.com/raphaelm/defusedcsv - - https://owasp.org/www-community/attacks/CSV_Injection - - https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities - technology: - - django - - python - subcategory: - - vuln impact: MEDIUM - likelihood: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/python.django.security.injection.csv-writer-injection.csv-writer-injection - shortlink: https://sg.run/Pw9q + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://github.com/raphaelm/defusedcsv + - https://owasp.org/www-community/attacks/CSV_Injection + - https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities semgrep.dev: rule: + origin: community r_id: 31145 - rv_id: 1263389 rule_id: 7KUK1y + rv_id: 1263389 + url: + https://semgrep.dev/playground/r/LjTkgD9/python.django.security.injection.csv-writer-injection.csv-writer-injection version_id: LjTkgD9 - url: https://semgrep.dev/playground/r/LjTkgD9/python.django.security.injection.csv-writer-injection.csv-writer-injection - origin: community + shortlink: https://sg.run/Pw9q + source: https://semgrep.dev/r/python.django.security.injection.csv-writer-injection.csv-writer-injection + subcategory: + - vuln + technology: + - django + - python + vulnerability_class: + - Improper Validation mode: taint pattern-sinks: - patterns: - - pattern-inside: '$WRITER = csv.writer(...) - - - ... - - - $WRITER.$WRITE(...) - - ' + - pattern-inside: "$WRITER = csv.writer(...)\n\n...\n\n$WRITER.$WRITE(...)\n" - pattern: $WRITER.$WRITE(...) - metavariable-regex: metavariable: $WRITE @@ -20950,790 +17656,245 @@ rules: - pattern-not-inside: request.build_absolute_uri severity: ERROR - id: python.django.security.injection.email.xss-html-email-body.xss-html-email-body - message: Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible - to XSS. An attacker could inject data into this HTML email, causing XSS. + languages: + - python + message: Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are + susceptible to XSS. An attacker could inject data into this HTML email, causing XSS. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (''Injection'')' + - "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://www.damonkohler.com/2008/12/email-injection.html - category: security - technology: - - django - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body - shortlink: https://sg.run/RoBe semgrep.dev: rule: + origin: community r_id: 9505 - rv_id: 1263390 rule_id: qNUj02 + rv_id: 1263390 + url: + https://semgrep.dev/playground/r/8KT5rOn/python.django.security.injection.email.xss-html-email-body.xss-html-email-body version_id: 8KT5rOn - url: https://semgrep.dev/playground/r/8KT5rOn/python.django.security.injection.email.xss-html-email-body.xss-html-email-body - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/RoBe + source: https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Other patterns: - pattern-inside: "def $FUNC(...):\n ...\n $EMAIL.content_subtype = \"html\"\n ...\n" - pattern-either: - pattern: django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.EmailMessage($SUBJ, $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, + $INTERM, ...)\n" - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...) - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...) - pattern: django.core.mail.EmailMessage($SUBJ, request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.EmailMessage($SUBJ, $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, + $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, + ...)\n" - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W(...), ...) - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W(...), ...) - pattern: django.core.mail.EmailMessage($SUBJ, request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.EmailMessage($SUBJ, $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, + $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, + ...)\n" - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W[...], ...) - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W[...], ...) - pattern: django.core.mail.EmailMessage($SUBJ, request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - django.core.mail.EmailMessage($SUBJ, $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, + ...)\n" - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W, ...) - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W, ...) + severity: WARNING - id: python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message - message: Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible - to XSS. An attacker could inject data into this HTML email, causing XSS. + languages: + - python + message: Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are + susceptible to XSS. An attacker could inject data into this HTML email, causing XSS. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (''Injection'')' + - "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://www.damonkohler.com/2008/12/email-injection.html - category: security - technology: - - django - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message - shortlink: https://sg.run/Avx8 semgrep.dev: rule: + origin: community r_id: 9506 - rv_id: 1263391 rule_id: lBU9Ll + rv_id: 1263391 + url: + https://semgrep.dev/playground/r/gETB7Gn/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message version_id: gETB7Gn - url: https://semgrep.dev/playground/r/gETB7Gn/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/Avx8 + source: + https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Other patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: - pattern: django.core.mail.send_mail(..., html_message=request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.send_mail(..., html_message=$DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., + html_message=$INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W.get(...), ...) - pattern: return django.core.mail.send_mail(..., html_message=request.$W.get(...), ...) - pattern: django.core.mail.send_mail(..., html_message=request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.send_mail(..., html_message=$DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., + html_message=$INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W(...), ...) - pattern: return django.core.mail.send_mail(..., html_message=request.$W(...), ...) - pattern: django.core.mail.send_mail(..., html_message=request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.send_mail(..., html_message=$DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., + html_message=$INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W[...], ...) - pattern: return django.core.mail.send_mail(..., html_message=request.$W[...], ...) - pattern: django.core.mail.send_mail(..., html_message=request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - django.core.mail.send_mail(..., html_message=$DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W, ...) - pattern: return django.core.mail.send_mail(..., html_message=request.$W, ...) + severity: WARNING - id: python.django.security.injection.open-redirect.open-redirect - message: Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you - are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html - for more information. + languages: + - python + message: Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure + you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See + https://cwe.mitre.org/data/definitions/601.html for more information. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/ - https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231 - category: security - technology: - - django - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect - shortlink: https://sg.run/Ave2 semgrep.dev: rule: + origin: community r_id: 9494 - rv_id: 1263393 rule_id: PeUZgr - version_id: 3ZT4XD7 + rv_id: 1263393 url: https://semgrep.dev/playground/r/3ZT4XD7/python.django.security.injection.open-redirect.open-redirect - origin: community - languages: - - python - severity: WARNING + version_id: 3ZT4XD7 + shortlink: https://sg.run/Ave2 + source: https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Open Redirect patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-not-inside: "def $FUNC(...):\n ...\n django.utils.http.is_safe_url(...)\n ...\n" @@ -21746,96 +17907,18 @@ rules: - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: django.shortcuts.redirect(..., $S % request.$W.get(...), ...) - pattern: django.shortcuts.redirect(..., f"...{request.$W.get(...)}...", ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.shortcuts.redirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.shortcuts.redirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.shortcuts.redirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.shortcuts.redirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" - pattern: $A = django.shortcuts.redirect(..., request.$W.get(...), ...) - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: $A = django.shortcuts.redirect(..., $S % request.$W.get(...), ...) @@ -21848,96 +17931,17 @@ rules: - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.shortcuts.redirect(..., $S % request.$W(...), ...) - pattern: django.shortcuts.redirect(..., f"...{request.$W(...)}...", ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.shortcuts.redirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.shortcuts.redirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.shortcuts.redirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.shortcuts.redirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" - pattern: $A = django.shortcuts.redirect(..., request.$W(...), ...) - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...) - pattern: $A = django.shortcuts.redirect(..., $S % request.$W(...), ...) @@ -21950,96 +17954,17 @@ rules: - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.shortcuts.redirect(..., $S % request.$W[...], ...) - pattern: django.shortcuts.redirect(..., f"...{request.$W[...]}...", ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.shortcuts.redirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.shortcuts.redirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.shortcuts.redirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.shortcuts.redirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" - pattern: $A = django.shortcuts.redirect(..., request.$W[...], ...) - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...) - pattern: $A = django.shortcuts.redirect(..., $S % request.$W[...], ...) @@ -22052,96 +17977,17 @@ rules: - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...) - pattern: django.shortcuts.redirect(..., $S % request.$W, ...) - pattern: django.shortcuts.redirect(..., f"...{request.$W}...", ...) - - pattern: '$DATA = request.$W - - ... - - django.shortcuts.redirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.shortcuts.redirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.shortcuts.redirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.shortcuts.redirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" - pattern: $A = django.shortcuts.redirect(..., request.$W, ...) - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...) - pattern: $A = django.shortcuts.redirect(..., $S % request.$W, ...) @@ -22154,96 +18000,20 @@ rules: - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...) - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W.get(...)}...", ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseRedirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseRedirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseRedirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" - pattern: $A = django.http.HttpResponseRedirect(..., request.$W.get(...), ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...) @@ -22256,96 +18026,20 @@ rules: - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.http.HttpResponseRedirect(..., $S % request.$W(...), ...) - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W(...)}...", ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseRedirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseRedirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseRedirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" - pattern: $A = django.http.HttpResponseRedirect(..., request.$W(...), ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W(...), ...) @@ -22358,96 +18052,20 @@ rules: - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.http.HttpResponseRedirect(..., $S % request.$W[...], ...) - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W[...]}...", ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseRedirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseRedirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseRedirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" - pattern: $A = django.http.HttpResponseRedirect(..., request.$W[...], ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W[...], ...) @@ -22460,96 +18078,18 @@ rules: - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...) - pattern: django.http.HttpResponseRedirect(..., $S % request.$W, ...) - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W}...", ...) - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseRedirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseRedirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseRedirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n" - pattern: $A = django.http.HttpResponseRedirect(..., request.$W, ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W, ...) @@ -22561,45 +18101,47 @@ rules: - metavariable-regex: metavariable: $W regex: (?!get_full_path) + severity: WARNING - id: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open - message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result - in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath - or the pathlib library. + languages: + - python + message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could + result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using + os.path.abspath or os.path.realpath or the pathlib library. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Path_Traversal - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open - shortlink: https://sg.run/W8qg semgrep.dev: rule: + origin: community r_id: 9509 - rv_id: 1263396 rule_id: oqUe7z + rv_id: 1263396 + url: + https://semgrep.dev/playground/r/JdTzxAw/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open version_id: JdTzxAw - url: https://semgrep.dev/playground/r/JdTzxAw/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/W8qg + source: + https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Path Traversal patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -22607,102 +18149,22 @@ rules: - pattern: open(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: open(..., $S % request.$W.get(...), ...) - pattern: open(..., f"...{request.$W.get(...)}...", ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - open(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W.get(...) - - ... - - open(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - open(..., $INTERM, ...) - - ' - - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...)\ - \ as $FD:\n ...\n" - - pattern: '$DATA = request.$W.get(...) - - ... - - open(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) + as $FD:\n ...\n" + - pattern: "$DATA = request.$W.get(...)\n...\nopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W.get(...) - - ... - - open(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n\ \ ...\n" - - pattern: '$DATA = request.$W.get(...) - - ... - - open(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - pattern: $A = open(..., request.$W.get(...), ...) - pattern: $A = open(..., $S.format(..., request.$W.get(...), ...), ...) @@ -22717,101 +18179,21 @@ rules: - pattern: open(..., $S.format(..., request.$W(...), ...), ...) - pattern: open(..., $S % request.$W(...), ...) - pattern: open(..., f"...{request.$W(...)}...", ...) - - pattern: '$DATA = request.$W(...) - - ... - - open(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W(...) - - ... - - open(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - open(..., $INTERM, ...) - - ' - - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as\ - \ $FD:\n ...\n" - - pattern: '$DATA = request.$W(...) - - ... - - open(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as + $FD:\n ...\n" + - pattern: "$DATA = request.$W(...)\n...\nopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W(...) - - ... - - open(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W(...) - - ... - - open(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - pattern: $A = open(..., request.$W(...), ...) - pattern: $A = open(..., $S.format(..., request.$W(...), ...), ...) @@ -22826,101 +18208,21 @@ rules: - pattern: open(..., $S.format(..., request.$W[...], ...), ...) - pattern: open(..., $S % request.$W[...], ...) - pattern: open(..., f"...{request.$W[...]}...", ...) - - pattern: '$DATA = request.$W[...] - - ... - - open(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W[...] - - ... - - open(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - open(..., $INTERM, ...) - - ' - - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as\ - \ $FD:\n ...\n" - - pattern: '$DATA = request.$W[...] - - ... - - open(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as + $FD:\n ...\n" + - pattern: "$DATA = request.$W[...]\n...\nopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W[...] - - ... - - open(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W[...] - - ... - - open(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - pattern: $A = open(..., request.$W[...], ...) - pattern: $A = open(..., $S.format(..., request.$W[...], ...), ...) @@ -22935,101 +18237,21 @@ rules: - pattern: open(..., $S.format(..., request.$W, ...), ...) - pattern: open(..., $S % request.$W, ...) - pattern: open(..., f"...{request.$W}...", ...) - - pattern: '$DATA = request.$W - - ... - - open(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W - - ... - - open(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as $FD:\n\ \ ...\n" - - pattern: '$DATA = request.$W - - ... - - open(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W - - ... - - open(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W - - ... - - open(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - pattern: $A = open(..., request.$W, ...) - pattern: $A = open(..., $S.format(..., request.$W, ...), ...) @@ -23040,54 +18262,50 @@ rules: - pattern: return open(..., $S % request.$W, ...) - pattern: return open(..., f"...{request.$W}...", ...) - pattern: "$DATA = request.$W\n...\nwith open(..., $DATA, ...) as $FD:\n ...\n" + severity: WARNING - id: python.django.security.injection.raw-html-format.raw-html-format languages: - python - severity: WARNING - message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods - of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could - let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use - templates (`django.shortcuts.render`) which will safely render HTML instead. + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure + methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, + which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered + safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - django references: - https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render - https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format - shortlink: https://sg.run/oYj1 semgrep.dev: rule: + origin: community r_id: 14360 - rv_id: 1263397 rule_id: 2ZUPER - version_id: 5PTo100 + rv_id: 1263397 url: https://semgrep.dev/playground/r/5PTo100/python.django.security.injection.raw-html-format.raw-html-format - origin: community + version_id: 5PTo100 + shortlink: https://sg.run/oYj1 + source: https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint pattern-sanitizers: - pattern: django.utils.html.escape(...) - pattern-sources: - - patterns: - - pattern: request.$ANYTHING - - pattern-not: request.build_absolute_uri pattern-sinks: - patterns: - pattern-either: @@ -23098,57 +18316,60 @@ rules: - pattern: '"$HTMLSTR" + ...' - pattern: f"$HTMLSTR{...}..." - patterns: - - pattern-inside: '$HTML = "$HTMLSTR" - - ... - - ' + - pattern-inside: "$HTML = \"$HTMLSTR\"\n...\n" - pattern-either: - pattern: $HTML % ... - pattern: $HTML.format(...) - pattern: $HTML + ... - metavariable-pattern: - metavariable: $HTMLSTR language: generic + metavariable: $HTMLSTR pattern: <$TAG ... + pattern-sources: + - patterns: + - pattern: request.$ANYTHING + - pattern-not: request.build_absolute_uri + severity: WARNING - id: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse - message: Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers - gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed. + languages: + - python + message: Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to + attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped + or sanitzed. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse - shortlink: https://sg.run/BkvA semgrep.dev: rule: + origin: community r_id: 9495 - rv_id: 1263398 rule_id: JDUydR + rv_id: 1263398 + url: + https://semgrep.dev/playground/r/GxTke5K/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse version_id: GxTke5K - url: https://semgrep.dev/playground/r/GxTke5K/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/BkvA + source: + https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Cross-Site-Scripting (XSS) patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -23156,436 +18377,113 @@ rules: - pattern: django.http.HttpResponse(..., $S % request.$W.get(...), ...) - pattern: django.http.HttpResponse(..., f"...{request.$W.get(...)}...", ...) - pattern: django.http.HttpResponse(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponse(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponse(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponse(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponse(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" - pattern: $A = django.http.HttpResponse(..., request.$W.get(...), ...) - pattern: return django.http.HttpResponse(..., request.$W.get(...), ...) - pattern: django.http.HttpResponse(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.http.HttpResponse(..., $S % request.$W(...), ...) - pattern: django.http.HttpResponse(..., f"...{request.$W(...)}...", ...) - pattern: django.http.HttpResponse(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponse(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponse(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponse(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponse(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" - pattern: $A = django.http.HttpResponse(..., request.$W(...), ...) - pattern: return django.http.HttpResponse(..., request.$W(...), ...) - pattern: django.http.HttpResponse(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.http.HttpResponse(..., $S % request.$W[...], ...) - pattern: django.http.HttpResponse(..., f"...{request.$W[...]}...", ...) - pattern: django.http.HttpResponse(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponse(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponse(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponse(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponse(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" - pattern: $A = django.http.HttpResponse(..., request.$W[...], ...) - pattern: return django.http.HttpResponse(..., request.$W[...], ...) - pattern: django.http.HttpResponse(..., $S.format(..., request.$W, ...), ...) - pattern: django.http.HttpResponse(..., $S % request.$W, ...) - pattern: django.http.HttpResponse(..., f"...{request.$W}...", ...) - pattern: django.http.HttpResponse(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponse(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponse(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponse(..., f"...{$DATA}...", ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n" - pattern: $A = django.http.HttpResponse(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - $A = django.http.HttpResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$A = django.http.HttpResponse(..., $INTERM, ...)\n" - pattern: return django.http.HttpResponse(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponse(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + severity: WARNING - id: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest - message: Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading - to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped - or sanitzed. + languages: + - python + message: Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, + leading to attackers gaining access to user cookies and protected information. Ensure that the request data is + properly escaped or sanitzed. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest - shortlink: https://sg.run/DoZP semgrep.dev: rule: + origin: community r_id: 9496 - rv_id: 1263399 rule_id: 5rUOX1 + rv_id: 1263399 + url: + https://semgrep.dev/playground/r/RGT0LY6/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest version_id: RGT0LY6 - url: https://semgrep.dev/playground/r/RGT0LY6/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/DoZP + source: + https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Cross-Site-Scripting (XSS) patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -23593,888 +18491,269 @@ rules: - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W.get(...), ...) - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W.get(...)}...", ...) - pattern: django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseBadRequest(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) - pattern: return django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W(...), ...) - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W(...)}...", ...) - pattern: django.http.HttpResponseBadRequest(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseBadRequest(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W(...), ...) - pattern: return django.http.HttpResponseBadRequest(..., request.$W(...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W[...], ...) - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W[...]}...", ...) - pattern: django.http.HttpResponseBadRequest(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseBadRequest(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W[...], ...) - pattern: return django.http.HttpResponseBadRequest(..., request.$W[...], ...) - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W, ...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W, ...) - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W}...", ...) - pattern: django.http.HttpResponseBadRequest(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseBadRequest(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n" - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W, ...) - pattern: return django.http.HttpResponseBadRequest(..., request.$W, ...) + severity: WARNING - id: python.django.security.injection.request-data-fileresponse.request-data-fileresponse - message: Found user-controlled request data being passed into a file open, which is them passed as an argument into the - FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking - important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse. + languages: + - python + message: Found user-controlled request data being passed into a file open, which is them passed as an argument into + the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result + in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before + using it in FileResponse. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse - shortlink: https://sg.run/W862 semgrep.dev: rule: + origin: community r_id: 9497 - rv_id: 1263400 rule_id: GdU7QR + rv_id: 1263400 + url: + https://semgrep.dev/playground/r/A8Tgd1K/python.django.security.injection.request-data-fileresponse.request-data-fileresponse version_id: A8Tgd1K - url: https://semgrep.dev/playground/r/A8Tgd1K/python.django.security.injection.request-data-fileresponse.request-data-fileresponse - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/W862 + source: https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Path Traversal patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: - pattern: django.http.FileResponse(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.FileResponse(..., open($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = open($DATA, ...) - - ... - - django.http.FileResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, + ...)\n" - pattern: $A = django.http.FileResponse(..., request.$W.get(...), ...) - pattern: return django.http.FileResponse(..., request.$W.get(...), ...) - pattern: django.http.FileResponse(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.http.FileResponse(..., open($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = open($DATA, ...) - - ... - - django.http.FileResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n" - pattern: $A = django.http.FileResponse(..., request.$W(...), ...) - pattern: return django.http.FileResponse(..., request.$W(...), ...) - pattern: django.http.FileResponse(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.http.FileResponse(..., open($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = open($DATA, ...) - - ... - - django.http.FileResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n" - pattern: $A = django.http.FileResponse(..., request.$W[...], ...) - pattern: return django.http.FileResponse(..., request.$W[...], ...) - pattern: django.http.FileResponse(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - django.http.FileResponse(..., open($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = open($DATA, ...) - - ... - - django.http.FileResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n" - pattern: $A = django.http.FileResponse(..., request.$W, ...) - pattern: return django.http.FileResponse(..., request.$W, ...) + severity: WARNING - id: python.django.security.injection.request-data-write.request-data-write - message: Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able - to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause - a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized. + languages: + - python + message: Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is + able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, + or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped + or sanitized. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-93: Improper Neutralization of CRLF Sequences (''CRLF Injection'')' + - "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - django references: - https://owasp.org/Top10/A03_2021-Injection - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write - shortlink: https://sg.run/0Q6j semgrep.dev: rule: + origin: community r_id: 9498 - rv_id: 1263401 rule_id: ReUg5z + rv_id: 1263401 + url: + https://semgrep.dev/playground/r/BjTkZO5/python.django.security.injection.request-data-write.request-data-write version_id: BjTkZO5 - url: https://semgrep.dev/playground/r/BjTkZO5/python.django.security.injection.request-data-write.request-data-write - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/0Q6j + source: https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Improper Validation pattern-either: - pattern: $F.write(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $F.write(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $F.write(..., $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $F.write(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $F.write(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $F.write(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\n$F.write(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$F.write(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n" - pattern: $A = $F.write(..., request.$W.get(...), ...) - pattern: return $F.write(..., request.$W.get(...), ...) - pattern: $F.write(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - $F.write(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $F.write(..., $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $F.write(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $F.write(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $F.write(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\n$F.write(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$F.write(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n" - pattern: $A = $F.write(..., request.$W(...), ...) - pattern: return $F.write(..., request.$W(...), ...) - pattern: $F.write(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - $F.write(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $F.write(..., $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $F.write(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $F.write(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $F.write(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\n$F.write(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$F.write(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n" - pattern: $A = $F.write(..., request.$W[...], ...) - pattern: return $F.write(..., request.$W[...], ...) - pattern: $F.write(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - $F.write(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $F.write(..., $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $F.write(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $F.write(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $F.write(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\n$F.write(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$F.write(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n" - pattern: $A = $F.write(..., request.$W, ...) - pattern: return $F.write(..., request.$W, ...) + severity: WARNING - id: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where - message: User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected - information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and - not using quote placeholders in the SQL string. + languages: + - python + message: User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore + protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by + using `params` and not using quote placeholders in the SQL string. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where - shortlink: https://sg.run/0Ql5 semgrep.dev: rule: + origin: community r_id: 9510 - rv_id: 1263402 rule_id: zdUkx1 + rv_id: 1263402 + url: + https://semgrep.dev/playground/r/DkTRb4l/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where version_id: DkTRb4l - url: https://semgrep.dev/playground/r/DkTRb4l/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/0Ql5 + source: + https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where + subcategory: + - vuln + technology: + - django + vulnerability_class: + - SQL Injection patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -24482,497 +18761,136 @@ rules: - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W.get(...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W.get(...)}...", ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) - pattern: return $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W(...), ...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W(...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W(...)}...", ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) - pattern: return $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W[...], ...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W[...], ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W[...]}...", ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) - pattern: return $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W, ...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W, ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W}...", ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], + ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], + ...)\n" - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) - pattern: return $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + severity: WARNING - id: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql - message: User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected - information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and - not using quote placeholders in the SQL string. + languages: + - python + message: User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore + protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by + using `params` and not using quote placeholders in the SQL string. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql - shortlink: https://sg.run/Kl4X semgrep.dev: rule: + origin: community r_id: 9511 - rv_id: 1263403 rule_id: pKUOBp + rv_id: 1263403 + url: + https://semgrep.dev/playground/r/WrTqK2L/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql version_id: WrTqK2L - url: https://semgrep.dev/playground/r/WrTqK2L/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/Kl4X + source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql + subcategory: + - vuln + technology: + - django + vulnerability_class: + - SQL Injection patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -24980,497 +18898,135 @@ rules: - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W.get(...), ...) - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W.get(...)}...", ...) - pattern: django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.db.models.expressions.RawSQL(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) - pattern: return django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W(...), ...) - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W(...)}...", ...) - pattern: django.db.models.expressions.RawSQL(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.db.models.expressions.RawSQL(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W(...), ...) - pattern: return django.db.models.expressions.RawSQL(..., request.$W(...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W[...], ...) - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W[...]}...", ...) - pattern: django.db.models.expressions.RawSQL(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.db.models.expressions.RawSQL(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W[...], ...) - pattern: return django.db.models.expressions.RawSQL(..., request.$W[...], ...) - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W, ...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W, ...) - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W}...", ...) - pattern: django.db.models.expressions.RawSQL(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - django.db.models.expressions.RawSQL(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n" - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W, ...) - pattern: return django.db.models.expressions.RawSQL(..., request.$W, ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL($INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL($INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL($INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL($INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, + ...)\n" + severity: WARNING - id: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute - message: User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore - protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and - therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`. + languages: + - python + message: User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and + therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query + parameterization and therefore not vulnerable to sql injection. For example, you could use + `Entry.objects.filter(date=2006)`. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute - shortlink: https://sg.run/qx7y semgrep.dev: rule: + origin: community r_id: 9512 - rv_id: 1263404 rule_id: 2ZUbDL + rv_id: 1263404 + url: + https://semgrep.dev/playground/r/0bTKzRj/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute version_id: 0bTKzRj - url: https://semgrep.dev/playground/r/0bTKzRj/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/qx7y + source: + https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute + subcategory: + - vuln + technology: + - django + vulnerability_class: + - SQL Injection patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -25478,495 +19034,116 @@ rules: - pattern: $CURSOR.execute(..., $S % request.$W.get(...), ...) - pattern: $CURSOR.execute(..., f"...{request.$W.get(...)}...", ...) - pattern: $CURSOR.execute(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $CURSOR.execute(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $CURSOR.execute(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $CURSOR.execute(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $CURSOR.execute(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" - pattern: $A = $CURSOR.execute(..., request.$W.get(...), ...) - pattern: return $CURSOR.execute(..., request.$W.get(...), ...) - pattern: $CURSOR.execute(..., $S.format(..., request.$W(...), ...), ...) - pattern: $CURSOR.execute(..., $S % request.$W(...), ...) - pattern: $CURSOR.execute(..., f"...{request.$W(...)}...", ...) - pattern: $CURSOR.execute(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - $CURSOR.execute(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $CURSOR.execute(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $CURSOR.execute(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $CURSOR.execute(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" - pattern: $A = $CURSOR.execute(..., request.$W(...), ...) - pattern: return $CURSOR.execute(..., request.$W(...), ...) - pattern: $CURSOR.execute(..., $S.format(..., request.$W[...], ...), ...) - pattern: $CURSOR.execute(..., $S % request.$W[...], ...) - pattern: $CURSOR.execute(..., f"...{request.$W[...]}...", ...) - pattern: $CURSOR.execute(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - $CURSOR.execute(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $CURSOR.execute(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $CURSOR.execute(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $CURSOR.execute(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" - pattern: $A = $CURSOR.execute(..., request.$W[...], ...) - pattern: return $CURSOR.execute(..., request.$W[...], ...) - pattern: $CURSOR.execute(..., $S.format(..., request.$W, ...), ...) - pattern: $CURSOR.execute(..., $S % request.$W, ...) - pattern: $CURSOR.execute(..., f"...{request.$W}...", ...) - pattern: $CURSOR.execute(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - $CURSOR.execute(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $CURSOR.execute(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $CURSOR.execute(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $CURSOR.execute(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\n$CURSOR.execute(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" - pattern: $A = $CURSOR.execute(..., request.$W, ...) - pattern: return $CURSOR.execute(..., request.$W, ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $CURSOR.execute($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $CURSOR.execute($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $CURSOR.execute($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $CURSOR.execute($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $CURSOR.execute($INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $CURSOR.execute($INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $CURSOR.execute($INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $CURSOR.execute($INTERM, ...)' + - pattern: "$DATA = request.$W.get(...)\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)" + severity: WARNING - id: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw - message: Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection - and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization - and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`. + languages: + - python + message: Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL + injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built + with query parameterization and therefore not vulnerable to sql injection. For example, you could use + `Entry.objects.filter(date=2006)`. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - references: - - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw - shortlink: https://sg.run/l2v9 + references: + - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection semgrep.dev: rule: + origin: community r_id: 9513 - rv_id: 1263405 rule_id: X5U8v5 + rv_id: 1263405 + url: + https://semgrep.dev/playground/r/K3TKkBW/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw version_id: K3TKkBW - url: https://semgrep.dev/playground/r/K3TKkBW/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/l2v9 + source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw + subcategory: + - vuln + technology: + - django + vulnerability_class: + - SQL Injection patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -25974,497 +19151,117 @@ rules: - pattern: $MODEL.objects.raw(..., $S % request.$W.get(...), ...) - pattern: $MODEL.objects.raw(..., f"...{request.$W.get(...)}...", ...) - pattern: $MODEL.objects.raw(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.raw(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.raw(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.raw(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.raw(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" - pattern: $A = $MODEL.objects.raw(..., request.$W.get(...), ...) - pattern: return $MODEL.objects.raw(..., request.$W.get(...), ...) - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W(...), ...), ...) - pattern: $MODEL.objects.raw(..., $S % request.$W(...), ...) - pattern: $MODEL.objects.raw(..., f"...{request.$W(...)}...", ...) - pattern: $MODEL.objects.raw(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.raw(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.raw(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.raw(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.raw(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" - pattern: $A = $MODEL.objects.raw(..., request.$W(...), ...) - pattern: return $MODEL.objects.raw(..., request.$W(...), ...) - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W[...], ...), ...) - pattern: $MODEL.objects.raw(..., $S % request.$W[...], ...) - pattern: $MODEL.objects.raw(..., f"...{request.$W[...]}...", ...) - pattern: $MODEL.objects.raw(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.raw(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.raw(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.raw(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.raw(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" - pattern: $A = $MODEL.objects.raw(..., request.$W[...], ...) - pattern: return $MODEL.objects.raw(..., request.$W[...], ...) - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W, ...), ...) - pattern: $MODEL.objects.raw(..., $S % request.$W, ...) - pattern: $MODEL.objects.raw(..., f"...{request.$W}...", ...) - pattern: $MODEL.objects.raw(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.raw(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.raw(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.raw(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.raw(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.raw(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" - pattern: $A = $MODEL.objects.raw(..., request.$W, ...) - pattern: return $MODEL.objects.raw(..., request.$W, ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.raw($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.raw($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.raw($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.raw($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.raw($INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.raw($INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.raw($INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.raw($INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n" + severity: WARNING - id: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests - message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery - (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to - the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery - to learn more about SSRF vulnerabilities. + languages: + - python + message: Data from request object is passed to a new server-side request. This could lead to a server-side request + forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the + response to the user, and ensure proper authentication and transport-layer security in the proxied request. See + https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests - shortlink: https://sg.run/YvY4 semgrep.dev: rule: + origin: community r_id: 9514 - rv_id: 1263406 rule_id: j2UvEw + rv_id: 1263406 + url: + https://semgrep.dev/playground/r/qkTR7zn/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests version_id: qkTR7zn - url: https://semgrep.dev/playground/r/qkTR7zn/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests - origin: community - languages: - - python - severity: ERROR + shortlink: https://sg.run/YvY4 + source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Server-Side Request Forgery (SSRF) patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -26472,425 +19269,109 @@ rules: - pattern: requests.$METHOD(..., $S % request.$W.get(...), ...) - pattern: requests.$METHOD(..., f"...{request.$W.get(...)}...", ...) - pattern: requests.$METHOD(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - requests.$METHOD(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - requests.$METHOD(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - requests.$METHOD(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - requests.$METHOD(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" - pattern: $A = requests.$METHOD(..., request.$W.get(...), ...) - pattern: return requests.$METHOD(..., request.$W.get(...), ...) - pattern: requests.$METHOD(..., $S.format(..., request.$W(...), ...), ...) - pattern: requests.$METHOD(..., $S % request.$W(...), ...) - pattern: requests.$METHOD(..., f"...{request.$W(...)}...", ...) - pattern: requests.$METHOD(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - requests.$METHOD(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - requests.$METHOD(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - requests.$METHOD(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - requests.$METHOD(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" - pattern: $A = requests.$METHOD(..., request.$W(...), ...) - pattern: return requests.$METHOD(..., request.$W(...), ...) - pattern: requests.$METHOD(..., $S.format(..., request.$W[...], ...), ...) - pattern: requests.$METHOD(..., $S % request.$W[...], ...) - pattern: requests.$METHOD(..., f"...{request.$W[...]}...", ...) - pattern: requests.$METHOD(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - requests.$METHOD(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - requests.$METHOD(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - requests.$METHOD(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - requests.$METHOD(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" - pattern: $A = requests.$METHOD(..., request.$W[...], ...) - pattern: return requests.$METHOD(..., request.$W[...], ...) - pattern: requests.$METHOD(..., $S.format(..., request.$W, ...), ...) - pattern: requests.$METHOD(..., $S % request.$W, ...) - pattern: requests.$METHOD(..., f"...{request.$W}...", ...) - pattern: requests.$METHOD(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - requests.$METHOD(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - requests.$METHOD(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - requests.$METHOD(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - requests.$METHOD(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nrequests.$METHOD(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" - pattern: $A = requests.$METHOD(..., request.$W, ...) - pattern: return requests.$METHOD(..., request.$W, ...) + severity: ERROR - id: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib - message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery - (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes - and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication - and transport-layer security in the proxied request. + languages: + - python + message: Data from request object is passed to a new server-side request. This could lead to a server-side request + forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure + that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure + proper authentication and transport-layer security in the proxied request. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib - shortlink: https://sg.run/6n2B semgrep.dev: rule: + origin: community r_id: 9515 - rv_id: 1263407 rule_id: 10UKDo + rv_id: 1263407 + url: + https://semgrep.dev/playground/r/l4TJRwD/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib version_id: l4TJRwD - url: https://semgrep.dev/playground/r/l4TJRwD/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib - origin: community - languages: - - python - severity: ERROR + shortlink: https://sg.run/6n2B + source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Server-Side Request Forgery (SSRF) patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -26898,709 +19379,359 @@ rules: - pattern: urllib.request.urlopen(..., $S % request.$W.get(...), ...) - pattern: urllib.request.urlopen(..., f"...{request.$W.get(...)}...", ...) - pattern: urllib.request.urlopen(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - urllib.request.urlopen(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - urllib.request.urlopen(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - urllib.request.urlopen(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - urllib.request.urlopen(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" - pattern: $A = urllib.request.urlopen(..., request.$W.get(...), ...) - pattern: return urllib.request.urlopen(..., request.$W.get(...), ...) - pattern: urllib.request.urlopen(..., $S.format(..., request.$W(...), ...), ...) - pattern: urllib.request.urlopen(..., $S % request.$W(...), ...) - pattern: urllib.request.urlopen(..., f"...{request.$W(...)}...", ...) - pattern: urllib.request.urlopen(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - urllib.request.urlopen(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - urllib.request.urlopen(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - urllib.request.urlopen(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - urllib.request.urlopen(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" - pattern: $A = urllib.request.urlopen(..., request.$W(...), ...) - pattern: return urllib.request.urlopen(..., request.$W(...), ...) - pattern: urllib.request.urlopen(..., $S.format(..., request.$W[...], ...), ...) - pattern: urllib.request.urlopen(..., $S % request.$W[...], ...) - pattern: urllib.request.urlopen(..., f"...{request.$W[...]}...", ...) - pattern: urllib.request.urlopen(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - urllib.request.urlopen(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - urllib.request.urlopen(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - urllib.request.urlopen(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - urllib.request.urlopen(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" - pattern: $A = urllib.request.urlopen(..., request.$W[...], ...) - pattern: return urllib.request.urlopen(..., request.$W[...], ...) - pattern: urllib.request.urlopen(..., $S.format(..., request.$W, ...), ...) - pattern: urllib.request.urlopen(..., $S % request.$W, ...) - pattern: urllib.request.urlopen(..., f"...{request.$W}...", ...) - pattern: urllib.request.urlopen(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - urllib.request.urlopen(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - urllib.request.urlopen(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - urllib.request.urlopen(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - urllib.request.urlopen(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nurllib.request.urlopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" - pattern: $A = urllib.request.urlopen(..., request.$W, ...) - pattern: return urllib.request.urlopen(..., request.$W, ...) + severity: ERROR - id: python.django.security.passwords.password-empty-string.password-empty-string - message: '''$VAR'' is the empty string and is being used to set the password on ''$MODEL''. If you meant to set an unusable - password, set the password to None or call ''set_unusable_password()''.' + languages: + - python + message: "'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable + password, set the password to None or call 'set_unusable_password()'." metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-521: Weak Password Requirements' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password - category: security - technology: - - django - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string - shortlink: https://sg.run/oxnR semgrep.dev: rule: + origin: community r_id: 9516 - rv_id: 1263411 rule_id: 9AU1jW + rv_id: 1263411 + url: + https://semgrep.dev/playground/r/GxTke5Q/python.django.security.passwords.password-empty-string.password-empty-string version_id: GxTke5Q - url: https://semgrep.dev/playground/r/GxTke5Q/python.django.security.passwords.password-empty-string.password-empty-string - origin: community + shortlink: https://sg.run/oxnR + source: https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Improper Authentication patterns: - pattern-either: - - pattern: '$MODEL.set_password($EMPTY) - - ... - - $MODEL.save() - - ' - - pattern: '$VAR = $EMPTY - - ... - - $MODEL.set_password($VAR) - - ... - - $MODEL.save() - - ' + - pattern: "$MODEL.set_password($EMPTY)\n...\n$MODEL.save()\n" + - pattern: "$VAR = $EMPTY\n...\n$MODEL.set_password($VAR)\n...\n$MODEL.save()\n" - metavariable-regex: metavariable: $EMPTY regex: (\'\'|\"\") + severity: ERROR +- fix: "None\n" + id: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default languages: - python - severity: ERROR -- id: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default - message: '''$VAR'' is using the empty string as its default and is being used to set the password on ''$MODEL''. If you - meant to set an unusable password, set the default value to ''None'' or call ''set_unusable_password()''.' + message: "'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant + to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'." metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-521: Weak Password Requirements' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password - category: security - technology: - - django - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default - shortlink: https://sg.run/zvBW semgrep.dev: rule: + origin: community r_id: 9517 - rv_id: 1263412 rule_id: yyUn6Z + rv_id: 1263412 + url: + https://semgrep.dev/playground/r/RGT0LYX/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default version_id: RGT0LYX - url: https://semgrep.dev/playground/r/RGT0LYX/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default - origin: community - languages: - - python - severity: ERROR + shortlink: https://sg.run/zvBW + source: + https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Improper Authentication patterns: - pattern-either: - - pattern: '$VAR = request.$W.get($X, $EMPTY) - - ... - - $MODEL.set_password($VAR) - - ... - - $MODEL.save(...) - - ' + - pattern: "$VAR = request.$W.get($X, $EMPTY)\n...\n$MODEL.set_password($VAR)\n...\n$MODEL.save(...)\n" - pattern: "def $F(..., $VAR=$EMPTY, ...):\n ...\n $MODEL.set_password($VAR)\n" - metavariable-pattern: metavariable: $EMPTY pattern: '""' - focus-metavariable: $EMPTY - fix: 'None - - ' + severity: ERROR - id: python.fastapi.security.wildcard-cors.wildcard-cors languages: - python message: CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided. - mode: taint - pattern-sources: - - pattern: '[..., "*", ...]' - pattern-sinks: - - patterns: - - pattern: "$APP.add_middleware(\n CORSMiddleware,\n allow_origins=$ORIGIN,\n ...);\n" - - focus-metavariable: $ORIGIN - severity: WARNING metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-942: Permissive Cross-domain Policy with Untrusted Domains' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - category: security - technology: - - python - - fastapi references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - https://cwe.mitre.org/data/definitions/942.html - likelihood: HIGH - impact: LOW - confidence: MEDIUM - vulnerability_class: - - Configuration - subcategory: - - vuln - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors - shortlink: https://sg.run/KxApY semgrep.dev: rule: + origin: community r_id: 112311 - rv_id: 1263413 rule_id: lBU4JQ3 - version_id: A8Tgd1R + rv_id: 1263413 url: https://semgrep.dev/playground/r/A8Tgd1R/python.fastapi.security.wildcard-cors.wildcard-cors - origin: community + version_id: A8Tgd1R + shortlink: https://sg.run/KxApY + source: https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors + subcategory: + - vuln + technology: + - python + - fastapi + vulnerability_class: + - Configuration + mode: taint + pattern-sinks: + - patterns: + - pattern: "$APP.add_middleware(\n CORSMiddleware,\n allow_origins=$ORIGIN,\n ...);\n" + - focus-metavariable: $ORIGIN + pattern-sources: + - pattern: '[..., "*", ...]' + severity: WARNING - id: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host + languages: + - python message: Running flask app with host 0.0.0.0 could expose the server publicly. metadata: + category: security + confidence: HIGH cwe: - 'CWE-668: Exposure of Resource to Wrong Sphere' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - flask references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host - shortlink: https://sg.run/eLby semgrep.dev: rule: + origin: community r_id: 9532 - rv_id: 1263414 rule_id: L1Uy1n + rv_id: 1263414 + url: + https://semgrep.dev/playground/r/BjTkZOY/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host version_id: BjTkZOY - url: https://semgrep.dev/playground/r/BjTkZOY/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/eLby + source: https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Other pattern-either: - pattern: app.run(..., host="0.0.0.0", ...) - pattern: app.run(..., "0.0.0.0", ...) + severity: WARNING - id: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly - patterns: - - pattern-not-inside: "if __name__ == '__main__':\n ...\n" - - pattern-not-inside: "def $X(...):\n ...\n" - - pattern: app.run(...) - message: top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function + languages: + - python + message: top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a + function metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-668: Exposure of Resource to Wrong Sphere' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - flask references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly - shortlink: https://sg.run/vz5b semgrep.dev: rule: + origin: community r_id: 9533 - rv_id: 1263415 rule_id: 8GUjdX + rv_id: 1263415 + url: + https://semgrep.dev/playground/r/DkTRb4z/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly version_id: DkTRb4z - url: https://semgrep.dev/playground/r/DkTRb4z/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly - origin: community - languages: - - python + shortlink: https://sg.run/vz5b + source: https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Other + patterns: + - pattern-not-inside: "if __name__ == '__main__':\n ...\n" + - pattern-not-inside: "def $X(...):\n ...\n" + - pattern: app.run(...) severity: WARNING - id: python.flask.security.audit.debug-enabled.debug-enabled - patterns: - - pattern-inside: 'import flask - - ... - - ' - - pattern: $APP.run(..., debug=True, ...) - message: Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive - information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables. + languages: + - python + message: Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak + sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system + environment variables. metadata: + category: security + confidence: HIGH cwe: - 'CWE-489: Active Debug Code' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: A06:2017 - Security Misconfiguration references: - https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/ - category: security - technology: - - flask - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Active Debug Code - source: https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled - shortlink: https://sg.run/dKrd semgrep.dev: rule: + origin: community r_id: 9534 - rv_id: 946206 rule_id: gxU1bd - version_id: 8KTKjwR + rv_id: 946206 url: https://semgrep.dev/playground/r/8KTKjwR/python.flask.security.audit.debug-enabled.debug-enabled - origin: community + version_id: 8KTKjwR + shortlink: https://sg.run/dKrd + source: https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Active Debug Code + patterns: + - pattern-inside: "import flask\n...\n" + - pattern: $APP.run(..., debug=True, ...) severity: WARNING +- id: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string languages: - python -- id: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string - message: Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input - can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'. + message: Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user + input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - flask references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string - shortlink: https://sg.run/Zv6o semgrep.dev: rule: + origin: community r_id: 9535 - rv_id: 1263416 rule_id: QrUz49 + rv_id: 1263416 + url: + https://semgrep.dev/playground/r/WrTqKAz/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string version_id: WrTqKAz - url: https://semgrep.dev/playground/r/WrTqKAz/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/Zv6o + source: + https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - pattern-either: - - patterns: - - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $PARAM, ...):\n ...\n" - - pattern: $PARAM - - pattern: 'request.$FUNC.get(...) - - ' - - pattern: 'request.$FUNC(...) - - ' - - pattern: request.$FUNC[...] pattern-sinks: - patterns: - pattern-not-inside: return "..." @@ -27613,122 +19744,105 @@ rules: - patterns: - pattern: return $X - pattern-either: - - pattern-inside: '$X = "...".format(...) - - ... - - ' - - pattern-inside: '$X = "..." % ... - - ... - - ' - - pattern-inside: '$X = "..." + ... - - ... - - ' - - pattern-inside: '$X = ... + "..." - - ... - - ' - - pattern-inside: '$X = f"...{...}..." - - ... - - ' - - pattern-not-inside: '$X = "..." - - ... - - ' + - pattern-inside: "$X = \"...\".format(...)\n...\n" + - pattern-inside: "$X = \"...\" % ...\n...\n" + - pattern-inside: "$X = \"...\" + ...\n...\n" + - pattern-inside: "$X = ... + \"...\"\n...\n" + - pattern-inside: "$X = f\"...{...}...\"\n...\n" + - pattern-not-inside: "$X = \"...\"\n...\n" + pattern-sources: + - pattern-either: + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $PARAM, ...):\n ...\n" + - pattern: $PARAM + - pattern: "request.$FUNC.get(...)\n" + - pattern: "request.$FUNC(...)\n" + - pattern: request.$FUNC[...] + severity: WARNING - id: python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true - message: Function `flask.url_for` with `_external=True` argument will generate URLs using the `Host` header of the HTTP - request, which may lead to security risks such as Host header injection + languages: + - python + message: Function `flask.url_for` with `_external=True` argument will generate URLs using the `Host` header of the + HTTP request, which may lead to security risks such as Host header injection metadata: + category: security + confidence: HIGH cwe: - 'CWE-673: External Influence of Sphere Definition' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - flask references: - https://flask.palletsprojects.com/en/latest/api/#flask.url_for - https://portswigger.net/kb/issues/00500300_host-header-injection - subcategory: - - audit - likelihood: MEDIUM - impact: LOW - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true - shortlink: https://sg.run/gEGeR semgrep.dev: rule: + origin: community r_id: 191541 - rv_id: 1263418 rule_id: JDU5oql + rv_id: 1263418 + url: + https://semgrep.dev/playground/r/K3TKk6n/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true version_id: K3TKk6n - url: https://semgrep.dev/playground/r/K3TKk6n/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/gEGeR + source: https://semgrep.dev/r/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true + subcategory: + - audit + technology: + - flask + vulnerability_class: + - Other patterns: - pattern-not: flask.url_for(..., _external=False, ...) - pattern-not: url_for(..., _external=False, ...) - pattern-either: - pattern: flask.url_for(..., _external=$VAR, ...) - pattern: url_for(..., _external=$VAR, ...) + severity: WARNING - id: python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret languages: - python - message: The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, - the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through - the HashIDs. + message: The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient + HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by + attackers, through the HashIDs. metadata: category: security - subcategory: - - vuln + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A02:2021 – Cryptographic Failures references: - https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY - http://carnage.github.io/2015/08/cryptanalysis-of-hashids - technology: - - flask - likelihood: LOW - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret - shortlink: https://sg.run/N0Rx semgrep.dev: rule: + origin: community r_id: 72427 - rv_id: 946220 rule_id: KxUX3z + rv_id: 946220 + url: + https://semgrep.dev/playground/r/0bT15Px/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret version_id: 0bT15Px - url: https://semgrep.dev/playground/r/0bT15Px/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret - origin: community + shortlink: https://sg.run/N0Rx + source: https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: hashids.Hashids(..., salt=flask.current_app.config['SECRET_KEY'], ...) - pattern: hashids.Hashids(flask.current_app.config['SECRET_KEY'], ...) - patterns: - - pattern-inside: '$APP = flask.Flask(...) - - ... - - ' + - pattern-inside: "$APP = flask.Flask(...)\n...\n" - pattern-either: - pattern: hashids.Hashids(..., salt=$APP.config['SECRET_KEY'], ...) - pattern: hashids.Hashids($APP.config['SECRET_KEY'], ...) @@ -27736,16 +19850,19 @@ rules: - id: python.flask.security.injection.csv-writer-injection.csv-writer-injection languages: - python - message: Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate - the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet - application that runs an attacker script, which could steal data from the importing user or, at worst, install malware - on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula - injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs. + message: Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to + generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into + a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, + install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to + mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs. metadata: category: security confidence: MEDIUM cwe: - 'CWE-1236: Improper Neutralization of Formula Elements in a CSV File' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -27754,38 +19871,28 @@ rules: - https://github.com/raphaelm/defusedcsv - https://owasp.org/www-community/attacks/CSV_Injection - https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities - technology: - - python - - flask - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/python.flask.security.injection.csv-writer-injection.csv-writer-injection - shortlink: https://sg.run/JzqQ semgrep.dev: rule: + origin: community r_id: 31146 - rv_id: 1263428 rule_id: L1UR2K + rv_id: 1263428 + url: + https://semgrep.dev/playground/r/jQTn50Y/python.flask.security.injection.csv-writer-injection.csv-writer-injection version_id: jQTn50Y - url: https://semgrep.dev/playground/r/jQTn50Y/python.flask.security.injection.csv-writer-injection.csv-writer-injection - origin: community + shortlink: https://sg.run/JzqQ + source: https://semgrep.dev/r/python.flask.security.injection.csv-writer-injection.csv-writer-injection + subcategory: + - vuln + technology: + - python + - flask + vulnerability_class: + - Improper Validation mode: taint pattern-sinks: - patterns: - - pattern-inside: '$WRITER = csv.writer(...) - - - ... - - - $WRITER.$WRITE(...) - - ' + - pattern-inside: "$WRITER = csv.writer(...)\n\n...\n\n$WRITER.$WRITE(...)\n" - pattern: $WRITER.$WRITE(...) - metavariable-regex: metavariable: $WRITE @@ -27820,47 +19927,47 @@ rules: - id: python.flask.security.injection.os-system-injection.os-system-injection languages: - python - severity: ERROR - message: User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this - must be done, use the 'subprocess' module instead and pass the arguments as a list. + message: User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If + this must be done, use the 'subprocess' module instead and pass the arguments as a list. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/www-community/attacks/Command_Injection - category: security - technology: - - flask - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection - shortlink: https://sg.run/4xzz semgrep.dev: rule: + origin: community r_id: 9544 - rv_id: 1263429 rule_id: BYUN99 + rv_id: 1263429 + url: + https://semgrep.dev/playground/r/1QTypw7/python.flask.security.injection.os-system-injection.os-system-injection version_id: 1QTypw7 - url: https://semgrep.dev/playground/r/1QTypw7/python.flask.security.injection.os-system-injection.os-system-injection - origin: community + shortlink: https://sg.run/4xzz + source: https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection + subcategory: + - audit + technology: + - flask + vulnerability_class: + - Command Injection pattern-either: - patterns: - pattern: os.system(...) - pattern-either: - - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n os.system(..., <... $ROUTEVAR\ - \ ...>, ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n os.system(..., <... $ROUTEVAR + ...>, ...)\n" - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ \ ...\n os.system(..., <... $INTERM ...>, ...)\n" - pattern: os.system(..., <... flask.request.$W.get(...) ...>, ...) @@ -27868,87 +19975,64 @@ rules: - pattern: os.system(..., <... flask.request.$W(...) ...>, ...) - pattern: os.system(..., <... flask.request.$W ...>, ...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> - - ... - - os.system(<... $INTERM ...>) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\nos.system(<... $INTERM ...>)\n" - pattern: os.system(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> - - ... - - os.system(<... $INTERM ...>) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W[...] ...>\n...\nos.system(<... $INTERM ...>)\n" - pattern: os.system(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> - - ... - - os.system(<... $INTERM ...>) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W(...) ...>\n...\nos.system(<... $INTERM ...>)\n" - pattern: os.system(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W ...> - - ... - - os.system(<... $INTERM ...>) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\nos.system(<... $INTERM ...>)\n" - pattern: os.system(...) + severity: ERROR - id: python.flask.security.injection.path-traversal-open.path-traversal-open languages: - python - severity: ERROR - message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result - in path traversal attacks. + message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could + result in path traversal attacks. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Path_Traversal - category: security - technology: - - flask - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open - shortlink: https://sg.run/PJRW semgrep.dev: rule: + origin: community r_id: 9545 - rv_id: 1263430 rule_id: DbUpOQ + rv_id: 1263430 + url: + https://semgrep.dev/playground/r/9lT4b94/python.flask.security.injection.path-traversal-open.path-traversal-open version_id: 9lT4b94 - url: https://semgrep.dev/playground/r/9lT4b94/python.flask.security.injection.path-traversal-open.path-traversal-open - origin: community + shortlink: https://sg.run/PJRW + source: https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open + subcategory: + - audit + technology: + - flask + vulnerability_class: + - Path Traversal pattern-either: - patterns: - pattern: open(...) - pattern-either: - - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n open(..., <... $ROUTEVAR ...>,\ - \ ...)\n" - - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n with open(..., <... $ROUTEVAR\ - \ ...>, ...) as $FD:\n ...\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n open(..., <... $ROUTEVAR ...>, + ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n with open(..., <... $ROUTEVAR + ...>, ...) as $FD:\n ...\n" - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ \ ...\n open(..., <... $INTERM ...>, ...)\n" - pattern: open(..., <... flask.request.$W.get(...) ...>, ...) @@ -27956,40 +20040,16 @@ rules: - pattern: open(..., <... flask.request.$W(...) ...>, ...) - pattern: open(..., <... flask.request.$W ...>, ...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> - - ... - - open(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\nopen(<... $INTERM ...>, ...)\n" - pattern: open(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> - - ... - - open(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W[...] ...>\n...\nopen(<... $INTERM ...>, ...)\n" - pattern: open(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> - - ... - - open(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W(...) ...>\n...\nopen(<... $INTERM ...>, ...)\n" - pattern: open(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W ...> - - ... - - open(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\nopen(<... $INTERM ...>, ...)\n" - pattern: open(...) - patterns: - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n ...\n" @@ -28003,46 +20063,46 @@ rules: - patterns: - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n ...\n" - pattern: open(...) + severity: ERROR - id: python.flask.security.injection.raw-html-concat.raw-html-format languages: - python - severity: WARNING - message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods - of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could - let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use - templates (`flask.render_template`) which will safely render HTML instead. + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure + methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, + which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered + safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - flask references: - https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format - shortlink: https://sg.run/Pb7e semgrep.dev: rule: + origin: community r_id: 14389 - rv_id: 1409401 rule_id: GdUrJv - version_id: RGTEN1l + rv_id: 1409401 url: https://semgrep.dev/playground/r/RGTEN1l/python.flask.security.injection.raw-html-concat.raw-html-format - origin: community + version_id: RGTEN1l + shortlink: https://sg.run/Pb7e + source: https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint pattern-sanitizers: - pattern: jinja2.escape(...) @@ -28052,13 +20112,6 @@ rules: - metavariable-regex: metavariable: $TPL regex: .*\.html - pattern-sources: - - patterns: - - pattern-either: - - pattern: flask.request.$ANYTHING - - patterns: - - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" - - pattern: $ROUTEVAR pattern-sinks: - patterns: - pattern-either: @@ -28069,65 +20122,68 @@ rules: - pattern: '"$HTMLSTR" + ...' - pattern: f"$HTMLSTR{...}..." - patterns: - - pattern-inside: '$HTML = "$HTMLSTR" - - ... - - ' + - pattern-inside: "$HTML = \"$HTMLSTR\"\n...\n" - pattern-either: - pattern: $HTML % ... - pattern: $HTML.format(...) - pattern: $HTML + ... - metavariable-pattern: - metavariable: $HTMLSTR language: generic + metavariable: $HTMLSTR pattern: <$TAG ... + pattern-sources: + - patterns: + - pattern-either: + - pattern: flask.request.$ANYTHING + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - pattern: $ROUTEVAR + severity: WARNING - id: python.flask.security.injection.ssrf-requests.ssrf-requests languages: - python - severity: ERROR - message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery - (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to - the user, and ensure proper authentication and transport-layer security in the proxied request. + message: Data from request object is passed to a new server-side request. This could lead to a server-side request + forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the + response to the user, and ensure proper authentication and transport-layer security in the proxied request. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery - category: security - technology: - - flask - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests - shortlink: https://sg.run/J9LW semgrep.dev: rule: + origin: community r_id: 9546 - rv_id: 1263432 rule_id: WAUoRx - version_id: rxTAKJn + rv_id: 1263432 url: https://semgrep.dev/playground/r/rxTAKJn/python.flask.security.injection.ssrf-requests.ssrf-requests - origin: community + version_id: rxTAKJn + shortlink: https://sg.run/J9LW + source: https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Server-Side Request Forgery (SSRF) pattern-either: - patterns: - pattern: requests.$FUNC(...) - pattern-either: - - pattern-inside: "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n ...\n requests.$FUNC(...,\ - \ <... $ROUTEVAR ...>, ...)\n" - - pattern-inside: "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <...\ - \ $ROUTEVAR ...>\n ...\n requests.$FUNC(..., <... $INTERM ...>, ...)\n" + - pattern-inside: "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n ...\n requests.$FUNC(..., + <... $ROUTEVAR ...>, ...)\n" + - pattern-inside: "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... + $ROUTEVAR ...>\n ...\n requests.$FUNC(..., <... $INTERM ...>, ...)\n" - metavariable-regex: metavariable: $ROUTE_METHOD regex: ^(route|get|post|put|delete|patch)$ @@ -28136,47 +20192,84 @@ rules: - pattern: requests.$FUNC(..., <... flask.request.$W(...) ...>, ...) - pattern: requests.$FUNC(..., <... flask.request.$W ...>, ...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> - - ... - - requests.$FUNC(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\nrequests.$FUNC(<... $INTERM ...>, ...)\n" - pattern: requests.$FUNC(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> - - ... - - requests.$FUNC(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W[...] ...>\n...\nrequests.$FUNC(<... $INTERM ...>, ...)\n" - pattern: requests.$FUNC(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> - - ... - - requests.$FUNC(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W(...) ...>\n...\nrequests.$FUNC(<... $INTERM ...>, ...)\n" - pattern: requests.$FUNC(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W ...> - - ... - - requests.$FUNC(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\nrequests.$FUNC(<... $INTERM ...>, ...)\n" - pattern: requests.$FUNC(...) + severity: ERROR - id: python.flask.security.injection.subprocess-injection.subprocess-injection languages: - python + message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection + vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them + to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the + command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a + dictionary to allowlist a set of commands. + metadata: + category: security + confidence: HIGH + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 31147 + rule_id: 8GU3qp + rv_id: 1263433 + url: + https://semgrep.dev/playground/r/bZT53gQ/python.flask.security.injection.subprocess-injection.subprocess-injection + version_id: bZT53gQ + shortlink: https://sg.run/5gW3 + source: https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sanitizers: + - patterns: + - pattern: $DICT[$KEY] + - focus-metavariable: $KEY + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: subprocess.$FUNC(...) + - pattern-not: subprocess.$FUNC("...", ...) + - pattern-not: subprocess.$FUNC(["...", ...], ...) + - pattern-not-inside: "$CMD = [\"...\", ...]\n...\nsubprocess.$FUNC($CMD, ...)\n" + - patterns: + - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...) + - metavariable-regex: + metavariable: $SHELL + regex: ^(sh|bash|ksh|csh|tcsh|zsh)$ + - patterns: + - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...) + - metavariable-regex: + metavariable: $INTERPRETER + regex: ^(python|python\d)$ pattern-sources: - pattern-either: - patterns: @@ -28202,80 +20295,22 @@ rules: - patterns: - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" - focus-metavariable: $ROUTEVAR - pattern-sinks: - - patterns: - - pattern-either: - - patterns: - - pattern: subprocess.$FUNC(...) - - pattern-not: subprocess.$FUNC("...", ...) - - pattern-not: subprocess.$FUNC(["...", ...], ...) - - pattern-not-inside: '$CMD = ["...", ...] - - ... - - subprocess.$FUNC($CMD, ...) - - ' - - patterns: - - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...) - - metavariable-regex: - metavariable: $SHELL - regex: ^(sh|bash|ksh|csh|tcsh|zsh)$ - - patterns: - - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...) - - metavariable-regex: - metavariable: $INTERPRETER - regex: ^(python|python\d)$ - pattern-sanitizers: - - patterns: - - pattern: $DICT[$KEY] - - focus-metavariable: $KEY severity: ERROR - message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. - An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, - scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, - prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set - of commands. +- id: python.flask.security.injection.tainted-sql-string.tainted-sql-string + languages: + - python + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual + construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify + contents of the database. Instead, use a parameterized query which is available by default in most database engines. + Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries. metadata: category: security - technology: - - flask - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + - 'CWE-704: Incorrect Type Conversion or Cast' impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection - shortlink: https://sg.run/5gW3 - semgrep.dev: - rule: - r_id: 31147 - rv_id: 1263433 - rule_id: 8GU3qp - version_id: bZT53gQ - url: https://semgrep.dev/playground/r/bZT53gQ/python.flask.security.injection.subprocess-injection.subprocess-injection - origin: community -- id: python.flask.security.injection.tainted-sql-string.tainted-sql-string - message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction - could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the - database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider - using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries. - metadata: - cwe: - - 'CWE-704: Incorrect Type Conversion or Cast' + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -28284,32 +20319,35 @@ rules: - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql - https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column - category: security - technology: - - sqlalchemy - - flask - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/JxZj semgrep.dev: rule: + origin: community r_id: 14702 - rv_id: 1409402 rule_id: YGUDKQ + rv_id: 1409402 + url: + https://semgrep.dev/playground/r/A8TEvb4/python.flask.security.injection.tainted-sql-string.tainted-sql-string version_id: A8TEvb4 - url: https://semgrep.dev/playground/r/A8TEvb4/python.flask.security.injection.tainted-sql-string.tainted-sql-string - origin: community - severity: ERROR - languages: - - python + shortlink: https://sg.run/JxZj + source: https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - sqlalchemy + - flask + vulnerability_class: + - Improper Validation mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "\"$SQLSTR\" + ...\n" + - pattern: "\"$SQLSTR\" % ...\n" + - pattern: "\"$SQLSTR\".format(...)\n" + - pattern: "f\"$SQLSTR{...}...\"\n" + - metavariable-regex: + metavariable: $SQLSTR + regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.* pattern-sources: - patterns: - pattern-either: @@ -28317,63 +20355,46 @@ rules: - patterns: - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" - pattern: $ROUTEVAR - pattern-sinks: - - patterns: - - pattern-either: - - pattern: '"$SQLSTR" + ... - - ' - - pattern: '"$SQLSTR" % ... - - ' - - pattern: '"$SQLSTR".format(...) - - ' - - pattern: 'f"$SQLSTR{...}..." - - ' - - metavariable-regex: - metavariable: $SQLSTR - regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.* + severity: ERROR - id: python.flask.security.injection.tainted-url-host.tainted-url-host languages: - python - message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data - to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. - They could also probe internal servers or other resources that the server running this code can access. (This is called - server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, - or hardcode the correct host. + message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send + data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with + this request. They could also probe internal servers or other resources that the server running this code can + access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an + allowlist for approved hosts, or hardcode the correct host. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html - category: security - technology: - - flask - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host - shortlink: https://sg.run/RXpK semgrep.dev: rule: + origin: community r_id: 14649 - rv_id: 1409403 rule_id: ReU3Wb - version_id: BjTy42w + rv_id: 1409403 url: https://semgrep.dev/playground/r/BjTy42w/python.flask.security.injection.tainted-url-host.tainted-url-host - origin: community + version_id: BjTy42w + shortlink: https://sg.run/RXpK + source: https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint pattern-sinks: - patterns: @@ -28381,8 +20402,8 @@ rules: - patterns: - pattern: '"$URLSTR" % ...' - metavariable-pattern: - metavariable: $URLSTR language: generic + metavariable: $URLSTR patterns: - pattern-either: - pattern: $SCHEME://%s @@ -28390,8 +20411,8 @@ rules: - patterns: - pattern: '"$URLSTR".format(...)' - metavariable-pattern: - metavariable: $URLSTR language: generic + metavariable: $URLSTR pattern: $SCHEME:// { ... } - patterns: - pattern: '"$URLSTR" + ...' @@ -28404,11 +20425,7 @@ rules: metavariable: $URLSTR regex: .*://$ - patterns: - - pattern-inside: '$URL = "$URLSTR" - - ... - - ' + - pattern-inside: "$URL = \"$URLSTR\"\n...\n" - pattern: $URL += ... - metavariable-regex: metavariable: $URLSTR @@ -28424,43 +20441,42 @@ rules: - id: python.flask.security.injection.user-eval.eval-injection languages: - python - severity: ERROR message: Detected user data flowing into eval. This is code injection and should be avoided. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html - category: security - technology: - - flask - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection - shortlink: https://sg.run/5QpX semgrep.dev: rule: + origin: community r_id: 9547 - rv_id: 1263436 rule_id: 0oU54W - version_id: w8TRoB0 + rv_id: 1263436 url: https://semgrep.dev/playground/r/w8TRoB0/python.flask.security.injection.user-eval.eval-injection - origin: community + version_id: w8TRoB0 + shortlink: https://sg.run/5QpX + source: https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Code Injection pattern-either: - patterns: - pattern: eval(...) - pattern-either: - - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n eval(..., <... $ROUTEVAR ...>,\ - \ ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n eval(..., <... $ROUTEVAR ...>, + ...)\n" - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ \ ...\n eval(..., <... $INTERM ...>, ...)\n" - pattern: eval(..., <... flask.request.$W.get(...) ...>, ...) @@ -28468,81 +20484,57 @@ rules: - pattern: eval(..., <... flask.request.$W(...) ...>, ...) - pattern: eval(..., <... flask.request.$W ...>, ...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> - - ... - - eval(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\neval(..., <... $INTERM ...>, ...)\n" - pattern: eval(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> - - ... - - eval(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W[...] ...>\n...\neval(..., <... $INTERM ...>, ...)\n" - pattern: eval(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> - - ... - - eval(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W(...) ...>\n...\neval(..., <... $INTERM ...>, ...)\n" - pattern: eval(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W ...> - - ... - - eval(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\neval(..., <... $INTERM ...>, ...)\n" - pattern: eval(...) + severity: ERROR - id: python.flask.security.injection.user-exec.exec-injection languages: - python - severity: ERROR message: Detected user data flowing into exec. This is code injection and should be avoided. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html - category: security - technology: - - flask - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection - shortlink: https://sg.run/Ge42 semgrep.dev: rule: + origin: community r_id: 9548 - rv_id: 1263437 rule_id: KxUbl2 - version_id: xyTjzD9 + rv_id: 1263437 url: https://semgrep.dev/playground/r/xyTjzD9/python.flask.security.injection.user-exec.exec-injection - origin: community + version_id: xyTjzD9 + shortlink: https://sg.run/Ge42 + source: https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Code Injection pattern-either: - patterns: - pattern: exec(...) - pattern-either: - - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n exec(..., <... $ROUTEVAR ...>,\ - \ ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n exec(..., <... $ROUTEVAR ...>, + ...)\n" - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ \ ...\n exec(..., <... $INTERM ...>, ...)\n" - pattern: exec(..., <... flask.request.$W.get(...) ...>, ...) @@ -28550,399 +20542,303 @@ rules: - pattern: exec(..., <... flask.request.$W(...) ...>, ...) - pattern: exec(..., <... flask.request.$W ...>, ...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> - - ... - - exec(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\nexec(..., <... $INTERM ...>, ...)\n" - pattern: exec(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> - - ... - - exec(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W[...] ...>\n...\nexec(..., <... $INTERM ...>, ...)\n" - pattern: exec(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> - - ... - - exec(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W(...) ...>\n...\nexec(..., <... $INTERM ...>, ...)\n" - pattern: exec(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W ...> - - ... - - exec(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\nexec(..., <... $INTERM ...>, ...)\n" - pattern: exec(...) -- id: python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled - patterns: - - pattern: jinja2.Environment(... , autoescape=$VAL, ...) - - pattern-not: jinja2.Environment(... , autoescape=True, ...) - - pattern-not: jinja2.Environment(... , autoescape=jinja2.select_autoescape(...), ...) - - focus-metavariable: $VAL - fix: 'True - - ' - message: Detected a Jinja2 environment with 'autoescaping' disabled. This is dangerous if you are rendering to a browser - because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable 'autoescaping' by setting - 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain - file extensions. + severity: ERROR +- fix: "True\n" + id: python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled + languages: + - python + message: Detected a Jinja2 environment with 'autoescaping' disabled. This is dangerous if you are rendering to a + browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable + 'autoescaping' by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable + automatic escaping for certain file extensions. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html + category: security + confidence: MEDIUM cwe: - 'CWE-116: Improper Encoding or Escaping of Output' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://jinja.palletsprojects.com/en/2.11.x/api/#basics - category: security - technology: - - jinja2 - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Encoding - source: https://semgrep.dev/r/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled - shortlink: https://sg.run/L2L7 semgrep.dev: rule: + origin: community r_id: 20039 - rv_id: 1263448 rule_id: QrU1Xg + rv_id: 1263448 + url: + https://semgrep.dev/playground/r/gETB7oN/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled version_id: gETB7oN - url: https://semgrep.dev/playground/r/gETB7oN/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled - origin: community - languages: - - python - severity: WARNING -- id: python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled + shortlink: https://sg.run/L2L7 + source: https://semgrep.dev/r/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html + subcategory: + - vuln + technology: + - jinja2 + vulnerability_class: + - Improper Encoding patterns: - - pattern-not: jinja2.Environment(..., autoescape=$VAL, ...) - - pattern: jinja2.Environment(...) - fix-regex: + - pattern: jinja2.Environment(... , autoescape=$VAL, ...) + - pattern-not: jinja2.Environment(... , autoescape=True, ...) + - pattern-not: jinja2.Environment(... , autoescape=jinja2.select_autoescape(...), ...) + - focus-metavariable: $VAL + severity: WARNING +- fix-regex: regex: (.*)\) replacement: \1, autoescape=True) - message: Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous if - you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, - enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable - automatic escaping for certain file extensions. + id: python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled + languages: + - python + message: Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous + if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web + context, enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' + to only enable automatic escaping for certain file extensions. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html + category: security + confidence: MEDIUM cwe: - 'CWE-116: Improper Encoding or Escaping of Output' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://jinja.palletsprojects.com/en/2.11.x/api/#basics - category: security - technology: - - jinja2 - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Encoding - source: https://semgrep.dev/r/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled - shortlink: https://sg.run/8kY4 semgrep.dev: rule: + origin: community r_id: 20040 - rv_id: 1263449 rule_id: 3qULRx + rv_id: 1263449 + url: + https://semgrep.dev/playground/r/QkTGqje/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled version_id: QkTGqje - url: https://semgrep.dev/playground/r/QkTGqje/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled - origin: community - languages: - - python + shortlink: https://sg.run/8kY4 + source: https://semgrep.dev/r/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html + subcategory: + - vuln + technology: + - jinja2 + vulnerability_class: + - Improper Encoding + patterns: + - pattern-not: jinja2.Environment(..., autoescape=$VAL, ...) + - pattern: jinja2.Environment(...) severity: WARNING - id: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret + languages: + - python message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' metadata: + category: security + confidence: HIGH cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design references: - https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - category: security - technology: - - jwt - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret - shortlink: https://sg.run/l2E9 semgrep.dev: rule: + origin: community r_id: 9557 - rv_id: 1263452 rule_id: X5U8P5 - version_id: PkTR3X3 + rv_id: 1263452 url: https://semgrep.dev/playground/r/PkTR3X3/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret - origin: community + version_id: PkTR3X3 + shortlink: https://sg.run/l2E9 + source: https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret + subcategory: + - vuln + technology: + - jwt + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: 'jwt.encode($_, "...", ...) - - ' - languages: - - python + - pattern: "jwt.encode($_, \"...\", ...)\n" severity: ERROR - id: python.jwt.security.jwt-none-alg.jwt-python-none-alg - message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has - already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do - not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + languages: + - python + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token + has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be + verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - category: security - technology: - - jwt references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg - shortlink: https://sg.run/Yvp4 semgrep.dev: rule: + origin: community r_id: 9558 - rv_id: 1263453 rule_id: j2UvKw - version_id: JdTzxYj + rv_id: 1263453 url: https://semgrep.dev/playground/r/JdTzxYj/python.jwt.security.jwt-none-alg.jwt-python-none-alg - origin: community - languages: - - python - severity: ERROR + version_id: JdTzxYj + shortlink: https://sg.run/Yvp4 + source: https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - vuln + technology: + - jwt + vulnerability_class: + - Cryptographic Issues pattern-either: - - pattern: 'jwt.encode(...,algorithm="none",...) - - ' + - pattern: "jwt.encode(...,algorithm=\"none\",...)\n" - pattern: jwt.decode(...,algorithms=[...,"none",...],...) -- id: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode - patterns: - - pattern-either: - - patterns: - - pattern: 'jwt.decode(..., options={..., "verify_signature": $BOOL, ...}, ...) - - ' - - metavariable-pattern: - metavariable: $BOOL - pattern: 'False - - ' - - focus-metavariable: $BOOL - - patterns: - - pattern: '$OPTS = {..., "verify_signature": $BOOL, ...} - - ... - - jwt.decode(..., options=$OPTS, ...) - - ' - - metavariable-pattern: - metavariable: $BOOL - pattern: 'False - - ' - - focus-metavariable: $BOOL - message: Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the - token could be tampered with by malicious actors. Ensure that the JWT token is verified. + severity: ERROR +- fix: "True\n" + id: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode + languages: + - python + message: Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means + the token could be tampered with by malicious actors. Ensure that the JWT token is verified. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-287: Improper Authentication' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - cwe: - - 'CWE-287: Improper Authentication' references: - https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96 - category: security - technology: - - jwt - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode - shortlink: https://sg.run/6nyB semgrep.dev: rule: + origin: community r_id: 9559 - rv_id: 1263454 rule_id: 10UKjo - version_id: 5PTo12w + rv_id: 1263454 url: https://semgrep.dev/playground/r/5PTo12w/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode - origin: community - fix: 'True - - ' - severity: ERROR - languages: - - python -- id: python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args - mode: taint - options: - symbolic_propagation: true - pattern-sources: - - patterns: - - pattern-either: - - patterns: - - pattern-either: - - pattern: os.environ - - pattern: os.environ.get('$FOO', ...) - - pattern: os.environb - - pattern: os.environb.get('$FOO', ...) - - pattern: os.getenv('$ANYTHING', ...) - - pattern: os.getenvb('$ANYTHING', ...) - - patterns: - - pattern-either: - - patterns: - - pattern-either: - - pattern: sys.argv - - pattern: sys.orig_argv - - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' - - pattern: <... $ARGS ...> - - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' - - pattern: <... $ARGS ...> - - patterns: - - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' - - pattern-either: - - patterns: - - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - - pattern: $A - - pattern: $ARGS - pattern-sinks: + version_id: 5PTo12w + shortlink: https://sg.run/6nyB + source: https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode + subcategory: + - audit + technology: + - jwt + vulnerability_class: + - Improper Authentication + patterns: - pattern-either: - patterns: - - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "...", ...) - - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["...",...], ...) - - pattern: $LOOP.subprocess_exec(...) - - patterns: - - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...) - - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c",...) + - pattern: "jwt.decode(..., options={..., \"verify_signature\": $BOOL, ...}, ...)\n" + - metavariable-pattern: + metavariable: $BOOL + pattern: "False\n" + - focus-metavariable: $BOOL - patterns: - - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...], ...) - - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", ...], ...) - message: Detected subprocess function '$LOOP.subprocess_exec' with user controlled data. You may consider using 'shlex.escape()'. + - pattern: "$OPTS = {..., \"verify_signature\": $BOOL, ...}\n...\njwt.decode(..., options=$OPTS, ...)\n" + - metavariable-pattern: + metavariable: $BOOL + pattern: "False\n" + - focus-metavariable: $BOOL + severity: ERROR +- id: python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args + languages: + - python + message: Detected subprocess function '$LOOP.subprocess_exec' with user controlled data. You may consider using + 'shlex.escape()'. metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' - references: - - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec - - https://docs.python.org/3/library/shlex.html - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ category: security - technology: - - python confidence: MEDIUM - cwe2022-top25: true + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args - shortlink: https://sg.run/Apjp + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ semgrep.dev: rule: + origin: community r_id: 27250 - rv_id: 1263460 rule_id: 7KUE1E + rv_id: 1263460 + url: + https://semgrep.dev/playground/r/WrTqKXz/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args version_id: WrTqKXz - url: https://semgrep.dev/playground/r/WrTqKXz/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args - origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + shortlink: https://sg.run/Apjp + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - pattern-either: + - patterns: + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "...", ...) + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["...",...], ...) + - pattern: $LOOP.subprocess_exec(...) + - patterns: + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c",...) + - patterns: + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...], ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", ...], ...) pattern-sources: - patterns: - pattern-either: @@ -28961,104 +20857,83 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: $LOOP.subprocess_shell($PROTOCOL, $CMD) - - pattern-inside: asyncio.subprocess.create_subprocess_shell($CMD, ...) - - pattern-inside: asyncio.create_subprocess_shell($CMD, ...) - - focus-metavariable: $CMD - - pattern-not-inside: '$CMD = "..." - - ... - - ' - - pattern-not: $LOOP.subprocess_shell($PROTOCOL, "...") - - pattern-not: asyncio.subprocess.create_subprocess_shell("...", ...) - - pattern-not: asyncio.create_subprocess_shell("...", ...) + severity: ERROR +- id: python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + languages: + - python message: Detected asyncio subprocess function with user controlled data. You may consider using 'shlex.escape()'. metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' - references: - - https://docs.python.org/3/library/asyncio-subprocess.html - - https://docs.python.org/3/library/shlex.html - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ category: security - technology: - - python confidence: MEDIUM - cwe2022-top25: true + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args - shortlink: https://sg.run/Dx8Y + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.python.org/3/library/asyncio-subprocess.html + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ semgrep.dev: rule: - r_id: 27252 - rv_id: 1263462 - rule_id: 8GU5q3 - version_id: K3TKkDn - url: https://semgrep.dev/playground/r/K3TKkDn/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args + r_id: 27252 + rule_id: 8GU5q3 + rv_id: 1263462 + url: + https://semgrep.dev/playground/r/K3TKkDn/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + version_id: K3TKkDn + shortlink: https://sg.run/Dx8Y + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: $LOOP.subprocess_shell($PROTOCOL, $CMD) + - pattern-inside: asyncio.subprocess.create_subprocess_shell($CMD, ...) + - pattern-inside: asyncio.create_subprocess_shell($CMD, ...) + - focus-metavariable: $CMD + - pattern-not-inside: "$CMD = \"...\"\n...\n" + - pattern-not: $LOOP.subprocess_shell($PROTOCOL, "...") + - pattern-not: asyncio.subprocess.create_subprocess_shell("...", ...) + - pattern-not: asyncio.create_subprocess_shell("...", ...) pattern-sources: - patterns: - pattern-either: @@ -29077,127 +20952,77 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '$X = code.InteractiveConsole(...) - - ... - - ' - - pattern-inside: '$X = code.InteractiveInterpreter(...) - - ... - - ' - - pattern-either: - - pattern-inside: '$X.push($PAYLOAD,...) - - ' - - pattern-inside: '$X.runsource($PAYLOAD,...) - - ' - - pattern-inside: '$X.runcode(code.compile_command($PAYLOAD),...) - - ' - - pattern-inside: '$PL = code.compile_command($PAYLOAD,...) - - ... - - $X.runcode($PL,...) - - ' - - pattern: $PAYLOAD - - pattern-not: '$X.push("...",...) - - ' - - pattern-not: '$X.runsource("...",...) - - ' - - pattern-not: '$X.runcode(code.compile_command("..."),...) - - ' - - pattern-not: '$PL = code.compile_command("...",...) - - ... - - $X.runcode($PL,...) - - ' - message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external - data can reach this function call because it allows a malicious actor to run arbitrary Python code. - metadata: - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + severity: ERROR +- id: python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args + languages: + - python + message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if + external data can reach this function call because it allows a malicious actor to run arbitrary Python code. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args - shortlink: https://sg.run/0Bgv semgrep.dev: rule: + origin: community r_id: 27254 - rv_id: 1263464 rule_id: QrUG72 + rv_id: 1263464 + url: + https://semgrep.dev/playground/r/l4TJRK9/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args version_id: l4TJRK9 - url: https://semgrep.dev/playground/r/l4TJRK9/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args - origin: community - severity: WARNING - languages: - - python -- id: python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + shortlink: https://sg.run/0Bgv + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "$X = code.InteractiveConsole(...)\n...\n" + - pattern-inside: "$X = code.InteractiveInterpreter(...)\n...\n" + - pattern-either: + - pattern-inside: "$X.push($PAYLOAD,...)\n" + - pattern-inside: "$X.runsource($PAYLOAD,...)\n" + - pattern-inside: "$X.runcode(code.compile_command($PAYLOAD),...)\n" + - pattern-inside: "$PL = code.compile_command($PAYLOAD,...)\n...\n$X.runcode($PL,...)\n" + - pattern: $PAYLOAD + - pattern-not: "$X.push(\"...\",...)\n" + - pattern-not: "$X.runsource(\"...\",...)\n" + - pattern-not: "$X.runcode(code.compile_command(\"...\"),...)\n" + - pattern-not: "$PL = code.compile_command(\"...\",...)\n...\n$X.runcode($PL,...)\n" pattern-sources: - patterns: - pattern-either: @@ -29216,42 +21041,71 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS + severity: WARNING +- id: python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + languages: + - python + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor + to execute commands. + metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 27256 + rule_id: 4bUEAY + rv_id: 1263466 + url: + https://semgrep.dev/playground/r/6xT29l6/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + version_id: 6xT29l6 + shortlink: https://sg.run/qL6z + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection + mode: taint + options: + symbolic_propagation: true pattern-sinks: - patterns: - pattern-either: @@ -29281,52 +21135,6 @@ rules: - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to - execute commands. - metadata: - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' - confidence: MEDIUM - category: security - technology: - - python - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args - shortlink: https://sg.run/qL6z - semgrep.dev: - rule: - r_id: 27256 - rv_id: 1263466 - rule_id: 4bUEAY - version_id: 6xT29l6 - url: https://semgrep.dev/playground/r/6xT29l6/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args - origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args - mode: taint - options: - symbolic_propagation: true pattern-sources: - patterns: - pattern-either: @@ -29345,42 +21153,72 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS + severity: ERROR +- id: python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args + languages: + - python + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor + to execute commands. + metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 27258 + rule_id: JDUz34 + rv_id: 1263468 + url: + https://semgrep.dev/playground/r/zyTb2wn/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args + version_id: zyTb2wn + shortlink: https://sg.run/Y3Ke + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection + mode: taint + options: + symbolic_propagation: true pattern-sinks: - patterns: - pattern-either: @@ -29390,7 +21228,8 @@ rules: - pattern: $CMD - metavariable-regex: metavariable: $METHOD - regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) + regex: + (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) - patterns: - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...) - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...) @@ -29411,53 +21250,6 @@ rules: - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to - execute commands. - metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' - category: security - technology: - - python - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args - shortlink: https://sg.run/Y3Ke - semgrep.dev: - rule: - r_id: 27258 - rv_id: 1263468 - rule_id: JDUz34 - version_id: zyTb2wn - url: https://semgrep.dev/playground/r/zyTb2wn/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args - origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args - mode: taint - options: - symbolic_propagation: true pattern-sources: - patterns: - pattern-either: @@ -29476,92 +21268,69 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS - pattern-sinks: - - patterns: - - pattern-inside: '_xxsubinterpreters.run_string($ID, $PAYLOAD, ...) - - ' - - pattern-not: '_xxsubinterpreters.run_string($ID, "...", ...) - - ' - - pattern: $PAYLOAD - message: Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary - Python code. + severity: ERROR +- id: + python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args + languages: + - python + message: Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run + arbitrary Python code. metadata: - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' - owasp: - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://bugs.python.org/issue43472 - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ category: security - technology: - - python confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM + cwe: + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args - shortlink: https://sg.run/oLl9 + likelihood: MEDIUM + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://bugs.python.org/issue43472 + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ semgrep.dev: rule: + origin: community r_id: 27260 - rv_id: 1409404 rule_id: GdUkxO + rv_id: 1409404 + url: + https://semgrep.dev/playground/r/DkTwBzO/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args version_id: DkTwBzO - url: https://semgrep.dev/playground/r/DkTwBzO/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args - origin: community - severity: WARNING - languages: - - python -- id: python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + shortlink: https://sg.run/oLl9 + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection mode: taint options: symbolic_propagation: true - pattern-sanitizers: - - pattern: shlex.quote(...) + pattern-sinks: + - patterns: + - pattern-inside: "_xxsubinterpreters.run_string($ID, $PAYLOAD, ...)\n" + - pattern-not: "_xxsubinterpreters.run_string($ID, \"...\", ...)\n" + - pattern: $PAYLOAD pattern-sources: - patterns: - pattern-either: @@ -29580,42 +21349,76 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS + severity: WARNING +- id: python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + languages: + - python + message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to + perform command injection. You may consider using 'shlex.quote()'. + metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess + - https://docs.python.org/3/library/subprocess.html + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 27262 + rule_id: AbUgrZ + rv_id: 1263472 + url: + https://semgrep.dev/playground/r/jQTn54Y/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + version_id: jQTn54Y + shortlink: https://sg.run/pLGg + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection + mode: taint + options: + symbolic_propagation: true + pattern-sanitizers: + - pattern: shlex.quote(...) pattern-sinks: - patterns: - pattern-either: @@ -29645,55 +21448,6 @@ rules: - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...) - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...) - focus-metavariable: $CMD - message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform - command injection. You may consider using 'shlex.quote()'. - metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' - references: - - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess - - https://docs.python.org/3/library/subprocess.html - - https://docs.python.org/3/library/shlex.html - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args - shortlink: https://sg.run/pLGg - semgrep.dev: - rule: - r_id: 27262 - rv_id: 1263472 - rule_id: AbUgrZ - version_id: jQTn54Y - url: https://semgrep.dev/playground/r/jQTn54Y/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args - origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args - mode: taint - options: - symbolic_propagation: true pattern-sources: - patterns: - pattern-either: @@ -29712,130 +21466,86 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS - pattern-sinks: - - patterns: - - pattern-not: os.$W("...", ...) - - pattern-either: - - pattern: os.system(...) - - pattern: '$X = __import__("os") - - ... - - $X.system(...) - - ' - - pattern: '$X = __import__("os") - - ... - - getattr($X, "system")(...) - - ' - - pattern: '$X = getattr(os, "system") - - ... - - $X(...) - - ' - - pattern: '$X = __import__("os") - - ... - - $Y = getattr($X, "system") - - ... - - $Y(...) - - ' - - pattern: os.popen(...) - - pattern: os.popen2(...) - - pattern: os.popen3(...) - - pattern: os.popen4(...) - message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the - 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. + severity: ERROR +- id: python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args + languages: + - python + message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use + the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection + vulnerability. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.2.4 Dyanmic Code Execution Features - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' category: security - technology: - - python confidence: MEDIUM - cwe2022-top25: true + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args - shortlink: https://sg.run/XR2K + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ semgrep.dev: rule: + origin: community r_id: 27264 - rv_id: 1263474 rule_id: DbUR9g + rv_id: 1263474 + url: + https://semgrep.dev/playground/r/9lT4bG4/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args version_id: 9lT4bG4 - url: https://semgrep.dev/playground/r/9lT4bG4/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args - origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args + shortlink: https://sg.run/XR2K + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-not: os.$W("...", ...) + - pattern-either: + - pattern: os.system(...) + - pattern: "$X = __import__(\"os\")\n...\n$X.system(...)\n" + - pattern: "$X = __import__(\"os\")\n...\ngetattr($X, \"system\")(...)\n" + - pattern: "$X = getattr(os, \"system\")\n...\n$X(...)\n" + - pattern: "$X = __import__(\"os\")\n...\n$Y = getattr($X, \"system\")\n...\n$Y(...)\n" + - pattern: os.popen(...) + - pattern: os.popen2(...) + - pattern: os.popen3(...) + - pattern: os.popen4(...) pattern-sources: - patterns: - pattern-either: @@ -29854,129 +21564,143 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '_testcapi.run_in_subinterp($PAYLOAD, ...) - - ' - - pattern-inside: 'test.support.run_in_subinterp($PAYLOAD, ...) - - ' - - pattern: $PAYLOAD - - pattern-not: '_testcapi.run_in_subinterp("...", ...) - - ' - - pattern-not: 'test.support.run_in_subinterp("...", ...) - - ' - message: Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run - arbitrary Python code. + severity: ERROR +- id: + python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args + languages: + - python + message: Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to + run arbitrary Python code. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args - shortlink: https://sg.run/1DLw semgrep.dev: rule: + origin: community r_id: 27266 - rv_id: 1263476 rule_id: 0oUK7N + rv_id: 1263476 + url: + https://semgrep.dev/playground/r/rxTAKpn/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args version_id: rxTAKpn - url: https://semgrep.dev/playground/r/rxTAKpn/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args - origin: community + shortlink: https://sg.run/1DLw + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection + mode: taint + options: + symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "_testcapi.run_in_subinterp($PAYLOAD, ...)\n" + - pattern-inside: "test.support.run_in_subinterp($PAYLOAD, ...)\n" + - pattern: $PAYLOAD + - pattern-not: "_testcapi.run_in_subinterp(\"...\", ...)\n" + - pattern-not: "test.support.run_in_subinterp(\"...\", ...)\n" + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS severity: WARNING - languages: - - python - id: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions languages: - python - severity: WARNING + message: These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good + default is `0o644` which gives read and write access to yourself and read access to everyone else. metadata: category: security + confidence: MEDIUM + cwe: + - 'CWE-276: Incorrect Default Permissions' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-276: Incorrect Default Permissions' - technology: - - python references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions - shortlink: https://sg.run/AXY4 semgrep.dev: rule: + origin: community r_id: 13594 - rv_id: 1263482 rule_id: zdUYqR + rv_id: 1263482 + url: + https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions version_id: O9Tpxqr - url: https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions - origin: community - message: These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default - is `0o644` which gives read and write access to yourself and read access to everyone else. + shortlink: https://sg.run/AXY4 + source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Improper Authorization patterns: - pattern-inside: os.$METHOD(...) - metavariable-pattern: @@ -29990,13 +21714,13 @@ rules: - patterns: - pattern: os.$METHOD($FILE, $BITS, ...) - metavariable-comparison: - metavariable: $BITS comparison: $BITS >= 0o650 and $BITS < 0o100000 + metavariable: $BITS - patterns: - pattern: os.$METHOD($FILE, $BITS) - metavariable-comparison: - metavariable: $BITS comparison: $BITS >= 0o100650 + metavariable: $BITS - patterns: - pattern: os.$METHOD($FILE, $BITS, ...) - metavariable-pattern: @@ -30012,199 +21736,193 @@ rules: - patterns: - pattern: os.$METHOD($FILE, $EXPR | $MOD, ...) - metavariable-comparison: - metavariable: $MOD comparison: $MOD == 0o111 -- id: python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + metavariable: $MOD + severity: WARNING +- fix-regex: + count: 1 + regex: '[Hh][Tt][Tt][Pp]://' + replacement: https:// + id: + python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + languages: + - python + message: Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead. + metadata: + asvs: + control_id: 9.2.1 Weak TLS + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements + section: V9 Communications Verification Requirements + version: '4' + category: security + confidence: MEDIUM + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + semgrep.dev: + rule: + origin: community + r_id: 9651 + rule_id: lBU9BZ + rv_id: 1263484 + url: + https://semgrep.dev/playground/r/vdT06wb/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + version_id: vdT06wb + shortlink: https://sg.run/Bk5W + source: + https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + subcategory: + - audit + technology: + - requests + vulnerability_class: + - Mishandled Sensitive Information + mode: taint options: symbolic_propagation: true - mode: taint + pattern-sinks: + - patterns: + - pattern-inside: "with requests.Session(...) as $SESSION:\n ...\n" + - pattern-either: + - pattern: $SESSION.$W($SINK, ...) + - pattern: $SESSION.request($METHOD, $SINK, ...) + - focus-metavariable: $SINK pattern-sources: - patterns: - - pattern: '"$URL" - - ' + - pattern: "\"$URL\"\n" - metavariable-pattern: - metavariable: $URL language: regex + metavariable: $URL patterns: - pattern-regex: http:// - pattern-not-regex: .*://localhost - pattern-not-regex: .*://127\.0\.0\.1 - pattern-sinks: - - patterns: - - pattern-inside: "with requests.Session(...) as $SESSION:\n ...\n" - - pattern-either: - - pattern: $SESSION.$W($SINK, ...) - - pattern: $SESSION.request($METHOD, $SINK, ...) - - focus-metavariable: $SINK - fix-regex: + severity: INFO +- fix-regex: + count: 1 regex: '[Hh][Tt][Tt][Pp]://' replacement: https:// - count: 1 + id: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http + languages: + - python message: Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead. metadata: - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-319: Cleartext Transmission of Sensitive Information' asvs: + control_id: 9.1.1 Weak TLS + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements section: V9 Communications Verification Requirements - control_id: 9.2.1 Weak TLS - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements version: '4' category: security - technology: - - requests + confidence: MEDIUM + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + semgrep.dev: + rule: + origin: community + r_id: 9652 + rule_id: YGURXw + rv_id: 1263485 + url: + https://semgrep.dev/playground/r/d6Tyx02/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http + version_id: d6Tyx02 + shortlink: https://sg.run/DoBY + source: + https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http subcategory: - audit - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - requests vulnerability_class: - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context - shortlink: https://sg.run/Bk5W - semgrep.dev: - rule: - r_id: 9651 - rv_id: 1263484 - rule_id: lBU9BZ - version_id: vdT06wb - url: https://semgrep.dev/playground/r/vdT06wb/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context - origin: community - languages: - - python - severity: INFO -- id: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http + mode: taint options: symbolic_propagation: true - mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: requests.Session(...).$W($SINK, ...) + - pattern: requests.Session(...).request($METHOD, $SINK, ...) + - focus-metavariable: $SINK pattern-sources: - patterns: - - pattern: '"$URL" - - ' + - pattern: "\"$URL\"\n" - metavariable-pattern: - metavariable: $URL language: regex + metavariable: $URL patterns: - pattern-regex: http:// - pattern-not-regex: .*://localhost - pattern-not-regex: .*://127\.0\.0\.1 - pattern-sinks: - - patterns: - - pattern-either: - - pattern: requests.Session(...).$W($SINK, ...) - - pattern: requests.Session(...).request($METHOD, $SINK, ...) - - focus-metavariable: $SINK - fix-regex: + severity: INFO +- fix-regex: + count: 1 regex: '[Hh][Tt][Tt][Pp]://' replacement: https:// - count: 1 - message: Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead. + id: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http languages: - python - severity: INFO + message: Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic + on the network and be able to obtain sensitive information. Use 'https://' instead. metadata: - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-319: Cleartext Transmission of Sensitive Information' asvs: - section: V9 Communications Verification Requirements control_id: 9.1.1 Weak TLS - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements + section: V9 Communications Verification Requirements version: '4' category: security - technology: - - requests - references: - - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - audit - likelihood: LOW - impact: LOW confidence: MEDIUM + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http - shortlink: https://sg.run/DoBY - semgrep.dev: - rule: - r_id: 9652 - rv_id: 1263485 - rule_id: YGURXw - version_id: d6Tyx02 - url: https://semgrep.dev/playground/r/d6Tyx02/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http - origin: community -- id: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http - fix-regex: - regex: '[Hh][Tt][Tt][Pp]://' - replacement: https:// - count: 1 - message: Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on - the network and be able to obtain sensitive information. Use 'https://' instead. - metadata: + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-319: Cleartext Transmission of Sensitive Information' - asvs: - section: V9 Communications Verification Requirements - control_id: 9.1.1 Weak TLS - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements - version: '4' - category: security - technology: - - requests references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - audit - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http - shortlink: https://sg.run/W8J4 semgrep.dev: rule: + origin: community r_id: 9653 - rv_id: 1263486 rule_id: 6JUjpG + rv_id: 1263486 + url: + https://semgrep.dev/playground/r/ZRTKA9v/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http version_id: ZRTKA9v - url: https://semgrep.dev/playground/r/ZRTKA9v/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http - origin: community - languages: - - python - severity: INFO + shortlink: https://sg.run/W8J4 + source: + https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http + subcategory: + - audit + technology: + - requests + vulnerability_class: + - Mishandled Sensitive Information + mode: taint options: symbolic_propagation: true - mode: taint - pattern-sources: - - patterns: - - pattern: '"$URL" - - ' - - metavariable-pattern: - metavariable: $URL - language: regex - patterns: - - pattern-regex: http:// - - pattern-not-regex: .*://localhost - - pattern-not-regex: .*://127\.0\.0\.1 pattern-sinks: - patterns: - pattern-either: @@ -30212,63 +21930,79 @@ rules: - pattern: requests.request($METHOD, $SINK, ...) - pattern: requests.Request($METHOD, $SINK, ...) - focus-metavariable: $SINK -- id: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure - patterns: - - pattern: '$LOGGER_OBJ.$LOGGER_CALL($FORMAT_STRING,...) - - ' - - metavariable-regex: - metavariable: $LOGGER_OBJ - regex: (?i)(_logger|logger|self.logger|log) - - metavariable-regex: - metavariable: $LOGGER_CALL - regex: (debug|info|warn|warning|error|exception|critical) - - metavariable-regex: - metavariable: $FORMAT_STRING - regex: (?i).*(api.key|secret|credential|token|password).*\%s.* - message: Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret - credentials being exposed. Make sure that the logger is not logging sensitive information. - severity: WARNING + pattern-sources: + - patterns: + - pattern: "\"$URL\"\n" + - metavariable-pattern: + language: regex + metavariable: $URL + patterns: + - pattern-regex: http:// + - pattern-not-regex: .*://localhost + - pattern-not-regex: .*://127\.0\.0\.1 + severity: INFO +- id: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure languages: - python + message: Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to + secret credentials being exposed. Make sure that the logger is not logging sensitive information. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-532: Insertion of Sensitive Information into Log File' - category: security - technology: - - python + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A09:2021 - Security Logging and Monitoring Failures - A09:2025 - Security Logging & Alerting Failures references: - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure - shortlink: https://sg.run/ydNx semgrep.dev: rule: + origin: community r_id: 9668 - rv_id: 1263501 rule_id: x8UnJk + rv_id: 1263501 + url: + https://semgrep.dev/playground/r/A8TgdOR/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure version_id: A8TgdOR - url: https://semgrep.dev/playground/r/A8TgdOR/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure - origin: community -- id: python.lang.security.audit.md5-used-as-password.md5-used-as-password + shortlink: https://sg.run/ydNx + source: + https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Mishandled Sensitive Information + patterns: + - pattern: "$LOGGER_OBJ.$LOGGER_CALL($FORMAT_STRING,...)\n" + - metavariable-regex: + metavariable: $LOGGER_OBJ + regex: (?i)(_logger|logger|self.logger|log) + - metavariable-regex: + metavariable: $LOGGER_CALL + regex: (debug|info|warn|warning|error|exception|critical) + - metavariable-regex: + metavariable: $FORMAT_STRING + regex: (?i).*(api.key|secret|credential|token|password).*\%s.* severity: WARNING - message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked - by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`. +- id: python.lang.security.audit.md5-used-as-password.md5-used-as-password languages: - python + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be + cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can + use `hashlib.scrypt`. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -30280,30 +22014,32 @@ rules: - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords - https://github.com/returntocorp/semgrep-rules/issues/1609 - https://docs.python.org/3/library/hashlib.html#hashlib.scrypt - category: security + semgrep.dev: + rule: + origin: community + r_id: 14703 + rule_id: 6JU1w1 + rv_id: 1263504 + url: + https://semgrep.dev/playground/r/WrTqKDz/python.lang.security.audit.md5-used-as-password.md5-used-as-password + version_id: WrTqKDz + shortlink: https://sg.run/5DwD + source: https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password + subcategory: + - vuln technology: - pycryptodome - hashlib - md5 - subcategory: - - vuln - likelihood: HIGH - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password - shortlink: https://sg.run/5DwD - semgrep.dev: - rule: - r_id: 14703 - rv_id: 1263504 - rule_id: 6JU1w1 - version_id: WrTqKDz - url: https://semgrep.dev/playground/r/WrTqKDz/python.lang.security.audit.md5-used-as-password.md5-used-as-password - origin: community mode: taint + pattern-sinks: + - patterns: + - pattern: $FUNCTION(...) + - metavariable-regex: + metavariable: $FUNCTION + regex: (?i)(.*password.*) pattern-sources: - patterns: - pattern-either: @@ -30312,163 +22048,152 @@ rules: - pattern: Cryptodome.Hash.MD5 - pattern: Crypto.Hash.MD5 - pattern: cryptography.hazmat.primitives.hashes.MD5 - pattern-sinks: - - patterns: - - pattern: $FUNCTION(...) - - metavariable-regex: - metavariable: $FUNCTION - regex: (?i)(.*password.*) + severity: WARNING - id: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces - message: Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to - all available interfaces. Consider instead getting correct address from an environment variable or configuration file. + languages: + - python + message: Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds + to all available interfaces. Consider instead getting correct address from an environment variable or configuration + file. metadata: + category: security + confidence: HIGH cwe: - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - python references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces - shortlink: https://sg.run/rdln semgrep.dev: rule: + origin: community r_id: 9669 - rv_id: 1263505 rule_id: OrU3og + rv_id: 1263505 + url: + https://semgrep.dev/playground/r/0bTKzDL/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces version_id: 0bTKzDL - url: https://semgrep.dev/playground/r/0bTKzDL/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces - origin: community - languages: - - python - severity: INFO + shortlink: https://sg.run/rdln + source: https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Mishandled Sensitive Information pattern-either: - - pattern: '$S = socket.socket(...) - - ... - - $S.bind(("0.0.0.0", ...)) - - ' - - pattern: '$S = socket.socket(...) - - ... - - $S.bind(("::", ...)) - - ' - - pattern: '$S = socket.socket(...) - - ... - - $S.bind(("", ...)) - - ' + - pattern: "$S = socket.socket(...)\n...\n$S.bind((\"0.0.0.0\", ...))\n" + - pattern: "$S = socket.socket(...)\n...\n$S.bind((\"::\", ...))\n" + - pattern: "$S = socket.socket(...)\n...\n$S.bind((\"\", ...))\n" + severity: INFO - id: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation - patterns: - - pattern-either: - - pattern: urllib3.PoolManager(..., cert_reqs=$REQS, ...) - - pattern: urllib3.ProxyManager(..., cert_reqs=$REQS, ...) - - pattern: urllib3.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) - - pattern: urllib3.connectionpool.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) - - pattern: urllib3.connection_from_url(..., cert_reqs=$REQS, ...) - - pattern: urllib3.proxy_from_url(..., cert_reqs=$REQS, ...) - - pattern: $CONTEXT.wrap_socket(..., cert_reqs=$REQS, ...) - - pattern: ssl.wrap_socket(..., cert_reqs=$REQS, ...) - - metavariable-regex: - metavariable: $REQS - regex: (NONE|CERT_NONE|CERT_OPTIONAL|ssl\.CERT_NONE|ssl\.CERT_OPTIONAL|\'NONE\'|\"NONE\"|\'OPTIONAL\'|\"OPTIONAL\") + languages: + - python message: certificate verification explicitly disabled, insecure connections possible metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-295: Improper Certificate Validation' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - category: security - technology: - - python references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation - shortlink: https://sg.run/b7yp semgrep.dev: rule: + origin: community r_id: 9670 - rv_id: 1263506 rule_id: eqU87k + rv_id: 1263506 + url: + https://semgrep.dev/playground/r/K3TKkZn/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation version_id: K3TKkZn - url: https://semgrep.dev/playground/r/K3TKkZn/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation - origin: community - languages: - - python + shortlink: https://sg.run/b7yp + source: https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Improper Authentication + patterns: + - pattern-either: + - pattern: urllib3.PoolManager(..., cert_reqs=$REQS, ...) + - pattern: urllib3.ProxyManager(..., cert_reqs=$REQS, ...) + - pattern: urllib3.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) + - pattern: urllib3.connectionpool.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) + - pattern: urllib3.connection_from_url(..., cert_reqs=$REQS, ...) + - pattern: urllib3.proxy_from_url(..., cert_reqs=$REQS, ...) + - pattern: $CONTEXT.wrap_socket(..., cert_reqs=$REQS, ...) + - pattern: ssl.wrap_socket(..., cert_reqs=$REQS, ...) + - metavariable-regex: + metavariable: $REQS + regex: + (NONE|CERT_NONE|CERT_OPTIONAL|ssl\.CERT_NONE|ssl\.CERT_OPTIONAL|\'NONE\'|\"NONE\"|\'OPTIONAL\'|\"OPTIONAL\") severity: ERROR - id: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection - message: Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool - instead for to encrypt communications. + languages: + - python + message: Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use + HTTPSConnectionPool instead for to encrypt communications. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool - category: security - technology: - - python - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection - shortlink: https://sg.run/N4Np semgrep.dev: rule: + origin: community r_id: 9671 - rv_id: 1263507 rule_id: v8UnWQ + rv_id: 1263507 + url: + https://semgrep.dev/playground/r/qkTR7E1/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection version_id: qkTR7E1 - url: https://semgrep.dev/playground/r/qkTR7E1/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection - origin: community - languages: - - python - severity: ERROR + shortlink: https://sg.run/N4Np + source: https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection + subcategory: + - audit + technology: + - python + vulnerability_class: + - Mishandled Sensitive Information pattern-either: - pattern: urllib3.HTTPConnectionPool(...) - pattern: urllib3.connectionpool.HTTPConnectionPool(...) + severity: ERROR - id: python.lang.security.audit.sha224-hash.sha224-hash - message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating - to a stronger hash function such as SHA-384 or higher to ensure compliance and security. + languages: + - python + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider + updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security. metadata: + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -30476,40 +22201,39 @@ rules: references: - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography - category: security - technology: - - python - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.audit.sha224-hash.sha224-hash - shortlink: https://sg.run/Db1Yv semgrep.dev: rule: + origin: community r_id: 151752 - rv_id: 1263511 rule_id: BYUX0y9 - version_id: 5PTo1QL + rv_id: 1263511 url: https://semgrep.dev/playground/r/5PTo1QL/python.lang.security.audit.sha224-hash.sha224-hash - origin: community - severity: WARNING - languages: - - python + version_id: 5PTo1QL + shortlink: https://sg.run/Db1Yv + source: https://semgrep.dev/r/python.lang.security.audit.sha224-hash.sha224-hash + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: hashlib.sha224(...) - pattern: hashlib.sha3_224(...) + severity: WARNING - id: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated - pattern: ssl.wrap_socket(...) - message: '''ssl.wrap_socket()'' is deprecated. This function creates an insecure socket without server name indication or - hostname matching. Instead, create an SSL context using ''ssl.SSLContext()'' and use that to wrap a socket.' + languages: + - python + message: "'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or + hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket." metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -30517,125 +22241,120 @@ rules: references: - https://docs.python.org/3/library/ssl.html#ssl.wrap_socket - https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket - category: security - technology: - - python - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated - shortlink: https://sg.run/PJOY semgrep.dev: rule: + origin: community r_id: 9645 - rv_id: 1263516 rule_id: BYUN2e + rv_id: 1263516 + url: + https://semgrep.dev/playground/r/DkTRbgn/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated version_id: DkTRbgn - url: https://semgrep.dev/playground/r/DkTRbgn/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated - origin: community + shortlink: https://sg.run/PJOY + source: https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Cryptographic Issues + pattern: ssl.wrap_socket(...) + severity: WARNING +- fix: "False\n" + id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true languages: - python - severity: WARNING -- id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true - patterns: - - pattern: subprocess.$FUNC(..., shell=$TRUE, ...) - - metavariable-pattern: - metavariable: $TRUE - pattern: "True \n" - - pattern-not: subprocess.$FUNC("...", shell=True, ...) - - focus-metavariable: $TRUE - message: Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command - using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious - actor to execute commands. Use 'shell=False' instead. - fix: 'False - - ' + message: Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the + command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier + for a malicious actor to execute commands. Use 'shell=False' instead. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' references: - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess - https://docs.python.org/3/library/subprocess.html - category: security - technology: - - python - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - secure default - likelihood: HIGH - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true - shortlink: https://sg.run/J92w semgrep.dev: rule: + origin: community r_id: 9646 - rv_id: 1263518 rule_id: DbUpz2 + rv_id: 1263518 + url: + https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true version_id: 0bTKzDK - url: https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true - origin: community - languages: - - python + shortlink: https://sg.run/J92w + source: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html + subcategory: + - secure default + technology: + - python + vulnerability_class: + - Command Injection + patterns: + - pattern: subprocess.$FUNC(..., shell=$TRUE, ...) + - metavariable-pattern: + metavariable: $TRUE + pattern: "True \n" + - pattern-not: subprocess.$FUNC("...", shell=True, ...) + - focus-metavariable: $TRUE severity: ERROR - id: python.lang.security.audit.weak-ssl-version.weak-ssl-version - message: An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption - and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher. + languages: + - python + message: An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak + encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher. metadata: + asvs: + control_id: 9.1.3 Weak TLS + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements + section: V9 Communications Verification Requirements + version: '4' + category: security + confidence: MEDIUM cwe: - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/insecure_ssl_tls.py#L30 - asvs: - section: V9 Communications Verification Requirements - control_id: 9.1.3 Weak TLS - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements - version: '4' references: - https://tools.ietf.org/html/rfc7568 - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html - https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2 - category: security - technology: - - python - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version - shortlink: https://sg.run/RoZO semgrep.dev: rule: + origin: community r_id: 9649 - rv_id: 1263520 rule_id: KxUbNG - version_id: qkTR7Ev + rv_id: 1263520 url: https://semgrep.dev/playground/r/qkTR7Ev/python.lang.security.audit.weak-ssl-version.weak-ssl-version - origin: community - languages: - - python - severity: WARNING + version_id: qkTR7Ev + shortlink: https://sg.run/RoZO + source: https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/insecure_ssl_tls.py#L30 + subcategory: + - audit + technology: + - python + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: ssl.PROTOCOL_SSLv2 - pattern: ssl.PROTOCOL_SSLv3 @@ -30646,10 +22365,60 @@ rules: - pattern: pyOpenSSL.SSL.SSLv3_METHOD - pattern: pyOpenSSL.SSL.TLSv1_METHOD - pattern: pyOpenSSL.SSL.TLSv1_1_METHOD + severity: WARNING - id: python.lang.security.dangerous-code-run.dangerous-interactive-code-run + languages: + - python + message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if + external data can reach this function call because it allows a malicious actor to run arbitrary Python code. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 27267 + rule_id: KxUKzx + rv_id: 1263521 + url: + https://semgrep.dev/playground/r/l4TJRgo/python.lang.security.dangerous-code-run.dangerous-interactive-code-run + version_id: l4TJRgo + shortlink: https://sg.run/9pRY + source: https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "$X = code.InteractiveConsole(...)\n...\n" + - pattern-inside: "$X = code.InteractiveInterpreter(...)\n...\n" + - pattern-either: + - pattern: "$X.push($PAYLOAD,...)\n" + - pattern: "$X.runsource($PAYLOAD,...)\n" + - pattern: "$X.runcode(code.compile_command($PAYLOAD),...)\n" + - pattern: "$PL = code.compile_command($PAYLOAD,...)\n...\n$X.runcode($PL,...)\n" + - focus-metavariable: $PAYLOAD + - pattern-not: "$X.push(\"...\",...)\n" + - pattern-not: "$X.runsource(\"...\",...)\n" + - pattern-not: "$X.runcode(code.compile_command(\"...\"),...)\n" + - pattern-not: "$PL = code.compile_command(\"...\",...)\n...\n$X.runcode($PL,...)\n" pattern-sources: - patterns: - pattern-either: @@ -30725,91 +22494,82 @@ rules: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '$X = code.InteractiveConsole(...) - - ... - - ' - - pattern-inside: '$X = code.InteractiveInterpreter(...) - - ... - - ' - - pattern-either: - - pattern: '$X.push($PAYLOAD,...) - - ' - - pattern: '$X.runsource($PAYLOAD,...) - - ' - - pattern: '$X.runcode(code.compile_command($PAYLOAD),...) - - ' - - pattern: '$PL = code.compile_command($PAYLOAD,...) - - ... - - $X.runcode($PL,...) - - ' - - focus-metavariable: $PAYLOAD - - pattern-not: '$X.push("...",...) - - ' - - pattern-not: '$X.runsource("...",...) - - ' - - pattern-not: '$X.runcode(code.compile_command("..."),...) - - ' - - pattern-not: '$PL = code.compile_command("...",...) - - ... - - $X.runcode($PL,...) - - ' - message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external - data can reach this function call because it allows a malicious actor to run arbitrary Python code. - metadata: - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + severity: WARNING +- id: python.lang.security.dangerous-os-exec.dangerous-os-exec + languages: + - python + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor + to execute commands. + metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: + - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run - shortlink: https://sg.run/9pRY semgrep.dev: rule: - r_id: 27267 - rv_id: 1263521 - rule_id: KxUKzx - version_id: l4TJRgo - url: https://semgrep.dev/playground/r/l4TJRgo/python.lang.security.dangerous-code-run.dangerous-interactive-code-run origin: community - severity: WARNING - languages: - - python -- id: python.lang.security.dangerous-os-exec.dangerous-os-exec + r_id: 27268 + rule_id: qNUR13 + rv_id: 1263523 + url: https://semgrep.dev/playground/r/6xT29rz/python.lang.security.dangerous-os-exec.dangerous-os-exec + version_id: 6xT29rz + shortlink: https://sg.run/yL9x + source: https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: os.$METHOD("...", ...) + - pattern: os.$METHOD(...) + - metavariable-regex: + metavariable: $METHOD + regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe) + - patterns: + - pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...) + - pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (execv|execve|execvp|execvpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + - patterns: + - pattern-not: os.$METHOD("...", $PATH, "...", "...",...) + - pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (execl|execle|execlp|execlpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) pattern-sources: - patterns: - pattern-either: @@ -30885,81 +22645,86 @@ rules: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession + severity: ERROR +- id: python.lang.security.dangerous-spawn-process.dangerous-spawn-process + languages: + - python + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor + to execute commands. + metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 27269 + rule_id: lBUJrn + rv_id: 1263524 + url: + https://semgrep.dev/playground/r/o5TbDO5/python.lang.security.dangerous-spawn-process.dangerous-spawn-process + version_id: o5TbDO5 + shortlink: https://sg.run/r8Zn + source: https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection + mode: taint + options: + symbolic_propagation: true pattern-sinks: - patterns: - pattern-either: - patterns: - - pattern-not: os.$METHOD("...", ...) - - pattern: os.$METHOD(...) + - pattern-not: os.$METHOD($MODE, "...", ...) + - pattern-inside: os.$METHOD($MODE, $CMD, ...) + - pattern: $CMD - metavariable-regex: metavariable: $METHOD - regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe) + regex: + (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) - patterns: - - pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...) - - pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...) + - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...) + - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD - regex: (execv|execve|execvp|execvpe) + regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - patterns: - - pattern-not: os.$METHOD("...", $PATH, "...", "...",...) - - pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...) + - pattern-not: os.$METHOD($MODE, "...", "...", "...", ...) + - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD - regex: (execl|execle|execlp|execlpe) + regex: (spawnl|spawnle|spawnlp|spawnlpe) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to - execute commands. - metadata: - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' - confidence: MEDIUM - category: security - technology: - - python - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec - shortlink: https://sg.run/yL9x - semgrep.dev: - rule: - r_id: 27268 - rv_id: 1263523 - rule_id: qNUR13 - version_id: 6xT29rz - url: https://semgrep.dev/playground/r/6xT29rz/python.lang.security.dangerous-os-exec.dangerous-os-exec - origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.dangerous-spawn-process.dangerous-spawn-process - mode: taint - options: - symbolic_propagation: true pattern-sources: - patterns: - pattern-either: @@ -31050,119 +22815,68 @@ rules: - pattern: sys.argv[...] - pattern: sys.orig_argv[...] - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS - pattern-sinks: - - patterns: - - pattern-either: - - patterns: - - pattern-not: os.$METHOD($MODE, "...", ...) - - pattern-inside: os.$METHOD($MODE, $CMD, ...) - - pattern: $CMD - - metavariable-regex: - metavariable: $METHOD - regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) - - patterns: - - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...) - - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...) - - pattern: $CMD - - metavariable-regex: - metavariable: $METHOD - regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) - - metavariable-regex: - metavariable: $BASH - regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - - patterns: - - pattern-not: os.$METHOD($MODE, "...", "...", "...", ...) - - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) - - pattern: $CMD - - metavariable-regex: - metavariable: $METHOD - regex: (spawnl|spawnle|spawnlp|spawnlpe) - - metavariable-regex: - metavariable: $BASH - regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to - execute commands. + severity: ERROR +- id: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + languages: + - python + message: Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run + arbitrary Python code. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + category: security + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: + - https://bugs.python.org/issue43472 - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' - category: security - technology: - - python - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process - shortlink: https://sg.run/r8Zn semgrep.dev: rule: - r_id: 27269 - rv_id: 1263524 - rule_id: lBUJrn - version_id: o5TbDO5 - url: https://semgrep.dev/playground/r/o5TbDO5/python.lang.security.dangerous-spawn-process.dangerous-spawn-process origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + r_id: 27270 + rule_id: PeURWr + rv_id: 1263525 + url: + https://semgrep.dev/playground/r/zyTb2OX/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + version_id: zyTb2OX + shortlink: https://sg.run/bPop + source: + https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern: "_xxsubinterpreters.run_string($ID, $PAYLOAD, ...)\n" + - pattern-not: "_xxsubinterpreters.run_string($ID, \"...\", ...)\n" + - focus-metavariable: $PAYLOAD pattern-sources: - patterns: - pattern-either: @@ -31238,54 +22952,86 @@ rules: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - pattern-sinks: - - patterns: - - pattern: '_xxsubinterpreters.run_string($ID, $PAYLOAD, ...) - - ' - - pattern-not: '_xxsubinterpreters.run_string($ID, "...", ...) - - ' - - focus-metavariable: $PAYLOAD - message: Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary - Python code. + severity: WARNING +- id: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + languages: + - python + message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to + perform command injection. You may consider using 'shlex.escape()'. metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: + - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - - https://bugs.python.org/issue43472 + - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess + - https://docs.python.org/3/library/subprocess.html + - https://docs.python.org/3/library/shlex.html - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string - shortlink: https://sg.run/bPop semgrep.dev: rule: - r_id: 27270 - rv_id: 1263525 - rule_id: PeURWr - version_id: zyTb2OX - url: https://semgrep.dev/playground/r/zyTb2OX/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string origin: community - severity: WARNING - languages: - - python -- id: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + r_id: 27271 + rule_id: JDUz3R + rv_id: 1263526 + url: + https://semgrep.dev/playground/r/pZT038J/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + version_id: pZT038J + shortlink: https://sg.run/NWxp + source: https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: subprocess.$FUNC("...", ...) + - pattern-not: subprocess.$FUNC(["...",...], ...) + - pattern-not: subprocess.$FUNC(("...",...), ...) + - pattern-not: subprocess.CalledProcessError(...) + - pattern-not: subprocess.SubprocessError(...) + - pattern: subprocess.$FUNC($CMD, ...) + - patterns: + - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...) + - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD) + - patterns: + - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...) + - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...) + - pattern-either: + - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD], ...) + - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD), ...) + - patterns: + - pattern-not: subprocess.$FUNC("=~/(python)/","...",...) + - pattern: subprocess.$FUNC("=~/(python)/", $CMD) + - patterns: + - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...) + - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...) + - pattern-either: + - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...) + - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...) + - focus-metavariable: $CMD pattern-sources: - patterns: - pattern-either: @@ -31361,84 +23107,71 @@ rules: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - pattern-sinks: - - patterns: - - pattern-either: - - patterns: - - pattern-not: subprocess.$FUNC("...", ...) - - pattern-not: subprocess.$FUNC(["...",...], ...) - - pattern-not: subprocess.$FUNC(("...",...), ...) - - pattern-not: subprocess.CalledProcessError(...) - - pattern-not: subprocess.SubprocessError(...) - - pattern: subprocess.$FUNC($CMD, ...) - - patterns: - - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...) - - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD) - - patterns: - - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...) - - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...) - - pattern-either: - - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD], ...) - - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD), ...) - - patterns: - - pattern-not: subprocess.$FUNC("=~/(python)/","...",...) - - pattern: subprocess.$FUNC("=~/(python)/", $CMD) - - patterns: - - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...) - - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...) - - pattern-either: - - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...) - - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...) - - focus-metavariable: $CMD - message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform - command injection. You may consider using 'shlex.escape()'. + severity: ERROR +- id: python.lang.security.dangerous-system-call.dangerous-system-call + languages: + - python + message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use + the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection + vulnerability. metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: + control_id: 5.2.4 Dyanmic Code Execution Features + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' - references: - - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess - - https://docs.python.org/3/library/subprocess.html - - https://docs.python.org/3/library/shlex.html - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ category: security - technology: - - python confidence: MEDIUM - cwe2022-top25: true + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use - shortlink: https://sg.run/NWxp + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ semgrep.dev: rule: - r_id: 27271 - rv_id: 1263526 - rule_id: JDUz3R - version_id: pZT038J - url: https://semgrep.dev/playground/r/pZT038J/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.dangerous-system-call.dangerous-system-call + r_id: 27272 + rule_id: 5rUoP1 + rv_id: 1263527 + url: https://semgrep.dev/playground/r/2KTv2Zn/python.lang.security.dangerous-system-call.dangerous-system-call + version_id: 2KTv2Zn + shortlink: https://sg.run/k0W7 + source: https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-not: os.$W("...", ...) + - pattern-either: + - pattern: os.system(...) + - pattern: getattr(os, "system")(...) + - pattern: __import__("os").system(...) + - pattern: getattr(__import__("os"), "system")(...) + - pattern: "$X = __import__(\"os\")\n...\n$X.system(...)\n" + - pattern: "$X = __import__(\"os\")\n...\ngetattr($X, \"system\")(...)\n" + - pattern: "$X = getattr(os, \"system\")\n...\n$X(...)\n" + - pattern: "$X = __import__(\"os\")\n...\n$Y = getattr($X, \"system\")\n...\n$Y(...)\n" + - pattern: os.popen(...) + - pattern: os.popen2(...) + - pattern: os.popen3(...) + - pattern: os.popen4(...) pattern-sources: - patterns: - pattern-either: @@ -31514,97 +23247,54 @@ rules: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - pattern-sinks: - - patterns: - - pattern-not: os.$W("...", ...) - - pattern-either: - - pattern: os.system(...) - - pattern: getattr(os, "system")(...) - - pattern: __import__("os").system(...) - - pattern: getattr(__import__("os"), "system")(...) - - pattern: '$X = __import__("os") - - ... - - $X.system(...) - - ' - - pattern: '$X = __import__("os") - - ... - - getattr($X, "system")(...) - - ' - - pattern: '$X = getattr(os, "system") - - ... - - $X(...) - - ' - - pattern: '$X = __import__("os") - - ... - - $Y = getattr($X, "system") - - ... - - $Y(...) - - ' - - pattern: os.popen(...) - - pattern: os.popen2(...) - - pattern: os.popen3(...) - - pattern: os.popen4(...) - message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the - 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. + severity: ERROR +- id: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + languages: + - python + message: Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to + run arbitrary Python code. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + category: security + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.2.4 Dyanmic Code Execution Features - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements - version: '4' - category: security - technology: - - python - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call - shortlink: https://sg.run/k0W7 semgrep.dev: rule: - r_id: 27272 - rv_id: 1263527 - rule_id: 5rUoP1 - version_id: 2KTv2Zn - url: https://semgrep.dev/playground/r/2KTv2Zn/python.lang.security.dangerous-system-call.dangerous-system-call origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + r_id: 27273 + rule_id: GdUkxR + rv_id: 1263528 + url: + https://semgrep.dev/playground/r/X0Tzy1e/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + version_id: X0Tzy1e + shortlink: https://sg.run/wLpY + source: + https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "_testcapi.run_in_subinterp($PAYLOAD, ...)\n" + - pattern: "test.support.run_in_subinterp($PAYLOAD, ...)\n" + - focus-metavariable: $PAYLOAD + - pattern-not: "_testcapi.run_in_subinterp(\"...\", ...)\n" + - pattern-not: "test.support.run_in_subinterp(\"...\", ...)\n" pattern-sources: - patterns: - pattern-either: @@ -31680,113 +23370,56 @@ rules: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - pattern-sinks: - - patterns: - - pattern-either: - - pattern: '_testcapi.run_in_subinterp($PAYLOAD, ...) - - ' - - pattern: 'test.support.run_in_subinterp($PAYLOAD, ...) - - ' - - focus-metavariable: $PAYLOAD - - pattern-not: '_testcapi.run_in_subinterp("...", ...) - - ' - - pattern-not: 'test.support.run_in_subinterp("...", ...) - - ' - message: Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run - arbitrary Python code. - metadata: - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' - owasp: - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp - shortlink: https://sg.run/wLpY - semgrep.dev: - rule: - r_id: 27273 - rv_id: 1263528 - rule_id: GdUkxR - version_id: X0Tzy1e - url: https://semgrep.dev/playground/r/X0Tzy1e/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp - origin: community severity: WARNING +- fix-regex: + count: 1 + regex: unsafe_load + replacement: safe_load + id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load languages: - python -- id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load + message: Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, + and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the + YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow + the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` + or `yaml.SafeLoader` instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - cwe: - - 'CWE-502: Deserialization of Untrusted Data' references: - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation - https://nvd.nist.gov/vuln/detail/CVE-2017-18342 - category: security - technology: - - pyyaml - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load - shortlink: https://sg.run/we9Y semgrep.dev: rule: - r_id: 9673 - rv_id: 1263530 - rule_id: ZqU5jZ - version_id: 1QTyprw - url: https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load origin: community - languages: - - python - message: Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and - `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input - could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to - steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` - instead. - fix-regex: - regex: unsafe_load - replacement: safe_load - count: 1 - severity: ERROR + r_id: 9673 + rule_id: ZqU5jZ + rv_id: 1263530 + url: + https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load + version_id: 1QTyprw + shortlink: https://sg.run/we9Y + source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load + subcategory: + - audit + technology: + - pyyaml + vulnerability_class: + - 'Insecure Deserialization ' patterns: - - pattern-inside: 'import yaml - - ... - - ' - - pattern-not-inside: '$YAML = ruamel.yaml.YAML(...) - - ... - - ' + - pattern-inside: "import yaml\n...\n" + - pattern-not-inside: "$YAML = ruamel.yaml.YAML(...)\n...\n" - pattern-either: - pattern: yaml.unsafe_load(...) - pattern: yaml.load(..., Loader=yaml.Loader, ...) @@ -31795,614 +23428,645 @@ rules: - pattern: yaml.load_all(..., Loader=yaml.Loader, ...) - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...) - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...) + severity: ERROR - id: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel + languages: + - python + message: Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious + actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - cwe: - - 'CWE-502: Deserialization of Untrusted Data' references: - https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ - category: security - technology: - - ruamel.yaml - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel - shortlink: https://sg.run/x1rz semgrep.dev: rule: + origin: community r_id: 9674 - rv_id: 1263531 rule_id: nJUzqK + rv_id: 1263531 + url: + https://semgrep.dev/playground/r/9lT4bvG/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel version_id: 9lT4bvG - url: https://semgrep.dev/playground/r/9lT4bvG/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel - origin: community - languages: - - python - message: Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor - could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead. - severity: ERROR + shortlink: https://sg.run/x1rz + source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel + subcategory: + - audit + technology: + - ruamel.yaml + vulnerability_class: + - 'Insecure Deserialization ' pattern-either: - pattern: ruamel.yaml.YAML(..., typ='unsafe', ...) - pattern: ruamel.yaml.YAML(..., typ='base', ...) + severity: ERROR - id: python.lang.security.deserialization.pickle.avoid-shelve + languages: + - python + message: Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When + unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the + relevant data as JSON or a similar text-based serialization format. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - cwe: - - 'CWE-502: Deserialization of Untrusted Data' references: - https://docs.python.org/3/library/pickle.html - category: security - technology: - - python - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve - shortlink: https://sg.run/dKkZ semgrep.dev: rule: + origin: community r_id: 9678 - rv_id: 1263535 rule_id: 8GUje2 - version_id: NdTzyb4 + rv_id: 1263535 url: https://semgrep.dev/playground/r/NdTzyb4/python.lang.security.deserialization.pickle.avoid-shelve - origin: community - languages: - - python - message: Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, - the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON - or a similar text-based serialization format. - severity: WARNING + version_id: NdTzyb4 + shortlink: https://sg.run/dKkZ + source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve + subcategory: + - audit + technology: + - python + vulnerability_class: + - 'Insecure Deserialization ' pattern: shelve.$FUNC(...) + severity: WARNING - id: python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 - patterns: - - pattern: hashlib.md5(...) - - pattern-not: hashlib.md5(..., usedforsecurity=False, ...) - message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use SHA256 or SHA3 instead. + languages: + - python + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + asvs: + control_id: 6.2.2 Insecure Custom Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + bandit-code: B303 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B303 - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.2 Insecure Custom Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' references: - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - python - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 - shortlink: https://sg.run/vYrY semgrep.dev: rule: + origin: community r_id: 33633 - rv_id: 1263536 rule_id: PeU2e2 + rv_id: 1263536 + url: + https://semgrep.dev/playground/r/kbTzGE1/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 version_id: kbTzGE1 - url: https://semgrep.dev/playground/r/kbTzGE1/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 - origin: community + shortlink: https://sg.run/vYrY + source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: hashlib.md5(...) + - pattern-not: hashlib.md5(..., usedforsecurity=False, ...) severity: WARNING - languages: - - python -- id: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 - pattern: hashlib.sha1(...) - fix-regex: +- fix-regex: regex: sha1 replacement: sha256 - message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not - suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + id: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + languages: + - python + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore + not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + asvs: + control_id: 6.2.2 Insecure Custom Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + bandit-code: B303 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B303 - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.2 Insecure Custom Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' references: - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - python - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 - shortlink: https://sg.run/ydYx semgrep.dev: rule: + origin: community r_id: 9624 - rv_id: 1263537 rule_id: x8UnBk + rv_id: 1263537 + url: + https://semgrep.dev/playground/r/w8TRoE7/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 version_id: w8TRoE7 - url: https://semgrep.dev/playground/r/w8TRoE7/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 - origin: community + shortlink: https://sg.run/ydYx + source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Cryptographic Issues + pattern: hashlib.sha1(...) severity: WARNING +- id: python.lang.security.insecure-hash-function.insecure-hash-function languages: - python -- id: python.lang.security.insecure-hash-function.insecure-hash-function - message: Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered - deprecated. Consider using 'SHA256' or a similar function instead. + message: Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are + considered deprecated. Consider using 'SHA256' or a similar function instead. metadata: + asvs: + control_id: 6.2.2 Insecure Custom Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/hashlib_new_insecure_functions.py - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.2 Insecure Custom Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' references: - https://tools.ietf.org/html/rfc6151 - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - python - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function - shortlink: https://sg.run/rdBn semgrep.dev: rule: + origin: community r_id: 9625 - rv_id: 1501841 rule_id: OrU30g - version_id: xyT0gk7 + rv_id: 1501841 url: https://semgrep.dev/playground/r/xyT0gk7/python.lang.security.insecure-hash-function.insecure-hash-function - origin: community - languages: - - python - severity: WARNING + version_id: xyT0gk7 + shortlink: https://sg.run/rdBn + source: https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/hashlib_new_insecure_functions.py + subcategory: + - audit + technology: + - python + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - pattern: hashlib.new("=~/[M|m][D|d][4|5]/", ...) - pattern: hashlib.new(..., name="=~/[M|m][D|d][4|5]/", ...) - pattern-not: hashlib.new(..., usedforsecurity=False, ...) -- id: python.lang.security.insecure-uuid-version.insecure-uuid-version - patterns: - - pattern: uuid.uuid1(...) - message: Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, - timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better - randomness and security. + severity: WARNING +- fix-regex: + regex: uuid1 + replacement: uuid4 + id: python.lang.security.insecure-uuid-version.insecure-uuid-version + languages: + - python + message: Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC + address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` + instead for better randomness and security. metadata: - references: - - https://www.landh.tech/blog/20230811-sandwich-attack/ - cwe: - - 'CWE-330: Use of Insufficiently Random Values' - owasp: - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures asvs: - section: V6 Stored Cryptography Verification Requirements control_id: 6.3.2 Insecure UUID Generation control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v63-random-values + section: V6 Stored Cryptography Verification Requirements version: '4' category: security - technology: - - python - subcategory: - - audit - likelihood: LOW - impact: MEDIUM confidence: MEDIUM + cwe: + - 'CWE-330: Use of Insufficiently Random Values' + impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version - shortlink: https://sg.run/BYBgW + likelihood: LOW + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://www.landh.tech/blog/20230811-sandwich-attack/ semgrep.dev: rule: + origin: community r_id: 148295 - rv_id: 1263539 rule_id: kxUd1yD - version_id: O9Tpx97 + rv_id: 1263539 url: https://semgrep.dev/playground/r/O9Tpx97/python.lang.security.insecure-uuid-version.insecure-uuid-version - origin: community - languages: - - python - severity: WARNING - fix-regex: - regex: uuid1 - replacement: uuid4 -- id: python.lang.security.unverified-ssl-context.unverified-ssl-context + version_id: O9Tpx97 + shortlink: https://sg.run/BYBgW + source: https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version + subcategory: + - audit + technology: + - python + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-either: - - pattern: ssl._create_unverified_context(...) - - pattern: ssl._create_default_https_context = ssl._create_unverified_context - fix-regex: + - pattern: uuid.uuid1(...) + severity: WARNING +- fix-regex: regex: _create_unverified_context replacement: create_default_context - message: Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use - 'ssl.create_default_context' instead. + id: python.lang.security.unverified-ssl-context.unverified-ssl-context + languages: + - python + message: Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. + Use 'ssl.create_default_context' instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-295: Improper Certificate Validation' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - cwe: - - 'CWE-295: Improper Certificate Validation' references: - https://docs.python.org/3/library/ssl.html#ssl-security - https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection - category: security - technology: - - python - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context - shortlink: https://sg.run/N4lp semgrep.dev: rule: + origin: community r_id: 9627 - rv_id: 1263540 rule_id: v8UnkQ - version_id: e1Tyjlj + rv_id: 1263540 url: https://semgrep.dev/playground/r/e1Tyjlj/python.lang.security.unverified-ssl-context.unverified-ssl-context - origin: community + version_id: e1Tyjlj + shortlink: https://sg.run/N4lp + source: https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context + subcategory: + - audit + technology: + - python + vulnerability_class: + - Improper Authentication + patterns: + - pattern-either: + - pattern: ssl._create_unverified_context(...) + - pattern: ssl._create_default_https_context = ssl._create_unverified_context severity: ERROR +- fix: defusedxml.etree.ElementTree.parse($...ARGS) + id: python.lang.security.use-defused-xml-parse.use-defused-xml-parse languages: - python -- id: python.lang.security.use-defused-xml-parse.use-defused-xml-parse + message: The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak + confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. + Instead the Python documentation recommends using `defusedxml`. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - cwe: - - 'CWE-611: Improper Restriction of XML External Entity Reference' references: - https://docs.python.org/3/library/xml.html - https://github.com/tiran/defusedxml - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing - category: security - technology: - - python - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse - shortlink: https://sg.run/n3jG semgrep.dev: rule: + origin: community r_id: 72436 - rv_id: 1263541 rule_id: X5Uqnx - version_id: vdT06ER + rv_id: 1263541 url: https://semgrep.dev/playground/r/vdT06ER/python.lang.security.use-defused-xml-parse.use-defused-xml-parse - origin: community - message: The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential - data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python - documentation recommends using `defusedxml`. - languages: - - python - severity: ERROR + version_id: vdT06ER + shortlink: https://sg.run/n3jG + source: https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse + subcategory: + - vuln + technology: + - python + vulnerability_class: + - XML Injection patterns: - pattern: xml.etree.ElementTree.parse($...ARGS) - pattern-not: xml.etree.ElementTree.parse("...") - fix: defusedxml.etree.ElementTree.parse($...ARGS) + severity: ERROR - id: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish - message: Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure - and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such - as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, - such as GCM. + languages: + - python + message: Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically + secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block + cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that + also provides authentication, such as GCM. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + bandit-code: B304 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption - https://www.pycryptodome.org/src/cipher/cipher - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::symmetric-algorithm::pycryptodome - - crypto::search::symmetric-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish - shortlink: https://sg.run/dlOE semgrep.dev: rule: + origin: community r_id: 33634 - rv_id: 1263545 rule_id: JDUGnK + rv_id: 1263545 + url: + https://semgrep.dev/playground/r/ExTExln/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish version_id: ExTExln - url: https://semgrep.dev/playground/r/ExTExln/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish - origin: community + shortlink: https://sg.run/dlOE + source: + https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - severity: WARNING - languages: - - python pattern-either: - pattern: Cryptodome.Cipher.Blowfish.new(...) - pattern: Crypto.Cipher.Blowfish.new(...) + severity: WARNING - id: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des - message: Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically - secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream - ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using - a block cipher, use a modern mode of operation that also provides authentication, such as GCM. + languages: + - python + message: Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not + cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package + instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a + block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, + such as GCM. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + bandit-code: B304 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://cwe.mitre.org/data/definitions/326.html - https://www.pycryptodome.org/src/cipher/cipher - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::symmetric-algorithm::pycryptodome - - crypto::search::symmetric-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des - shortlink: https://sg.run/Z5bw semgrep.dev: rule: + origin: community r_id: 33635 - rv_id: 1263546 rule_id: 5rUr73 + rv_id: 1263546 + url: + https://semgrep.dev/playground/r/7ZTE3G7/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des version_id: 7ZTE3G7 - url: https://semgrep.dev/playground/r/7ZTE3G7/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des - origin: community + shortlink: https://sg.run/Z5bw + source: + https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - severity: WARNING - languages: - - python pattern-either: - pattern: Cryptodome.Cipher.DES.new(...) - pattern: Crypto.Cipher.DES.new(...) - pattern: Cryptodome.Cipher.DES3.new(...) - pattern: Crypto.Cipher.DES3.new(...) + severity: WARNING - id: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 - message: Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and - can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES - with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, - such as GCM. + languages: + - python + message: Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure + and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher + such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also + provides authentication, such as GCM. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 - cwe: - - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures bandit-code: B304 - references: - - https://cwe.mitre.org/data/definitions/326.html - - https://www.pycryptodome.org/src/cipher/cipher category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM confidence: HIGH + cwe: + - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' functional-categories: - crypto::search::symmetric-algorithm::pycryptodome - crypto::search::symmetric-algorithm::pycryptodomex + impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 - shortlink: https://sg.run/nAbY + likelihood: LOW + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://cwe.mitre.org/data/definitions/326.html + - https://www.pycryptodome.org/src/cipher/cipher semgrep.dev: rule: + origin: community r_id: 33636 - rv_id: 1263547 rule_id: GdUYlW + rv_id: 1263547 + url: + https://semgrep.dev/playground/r/LjTkgn6/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 version_id: LjTkgn6 - url: https://semgrep.dev/playground/r/LjTkgn6/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 - origin: community + shortlink: https://sg.run/nAbY + source: + https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - severity: WARNING - languages: - - python pattern-either: - pattern: Cryptodome.Cipher.ARC2.new(...) - pattern: Crypto.Cipher.ARC2.new(...) + severity: WARNING - id: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 - message: Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and - can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES - with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, - such as GCM. + languages: + - python + message: Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure + and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher + such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also + provides authentication, such as GCM. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + bandit-code: B304 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://cwe.mitre.org/data/definitions/326.html - https://www.pycryptodome.org/src/cipher/cipher - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::symmetric-algorithm::pycryptodome - - crypto::search::symmetric-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 - shortlink: https://sg.run/Eo6N semgrep.dev: rule: + origin: community r_id: 33637 - rv_id: 1263548 rule_id: ReUnEB + rv_id: 1263548 + url: + https://semgrep.dev/playground/r/8KT5rXY/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 version_id: 8KT5rXY - url: https://semgrep.dev/playground/r/8KT5rXY/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/Eo6N + source: + https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: Cryptodome.Cipher.ARC4.new(...) - pattern: Crypto.Cipher.ARC4.new(...) + severity: WARNING - id: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor - message: Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and - can be reversed easily. Use AES instead. + languages: + - python + message: Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure + and can be reversed easily. Use AES instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + bandit-code: B304 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor - shortlink: https://sg.run/L0yr semgrep.dev: rule: + origin: community r_id: 9683 - rv_id: 1263549 rule_id: PeUk5W + rv_id: 1263549 + url: + https://semgrep.dev/playground/r/gETB7j3/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor version_id: gETB7j3 - url: https://semgrep.dev/playground/r/gETB7j3/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/L0yr + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: Cryptodome.Cipher.XOR.new(...) - pattern: Crypto.Cipher.XOR.new(...) + severity: WARNING - id: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 - message: Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. + languages: + - python + message: Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::hash-algorithm::pycryptodome + - crypto::search::hash-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -32413,45 +24077,47 @@ rules: - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::hash-algorithm::pycryptodome - - crypto::search::hash-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 - shortlink: https://sg.run/7JP2 semgrep.dev: rule: + origin: community r_id: 33638 - rv_id: 1263550 rule_id: AbU0Ex + rv_id: 1263550 + url: + https://semgrep.dev/playground/r/QkTGqD8/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 version_id: QkTGqD8 - url: https://semgrep.dev/playground/r/QkTGqD8/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 - origin: community + shortlink: https://sg.run/7JP2 + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - severity: WARNING - languages: - - python pattern-either: - pattern: Crypto.Hash.MD2.new(...) - pattern: Cryptodome.Hash.MD2.new (...) + severity: WARNING - id: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 - message: Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. + languages: + - python + message: Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::hash-algorithm::pycryptodome + - crypto::search::hash-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -32462,45 +24128,47 @@ rules: - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::hash-algorithm::pycryptodome - - crypto::search::hash-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 - shortlink: https://sg.run/Lve6 semgrep.dev: rule: + origin: community r_id: 33639 - rv_id: 1263551 rule_id: BYUJy4 + rv_id: 1263551 + url: + https://semgrep.dev/playground/r/3ZT4Xnp/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 version_id: 3ZT4Xnp - url: https://semgrep.dev/playground/r/3ZT4Xnp/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 - origin: community + shortlink: https://sg.run/Lve6 + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - severity: WARNING - languages: - - python pattern-either: - pattern: Crypto.Hash.MD4.new(...) - pattern: Cryptodome.Hash.MD4.new (...) + severity: WARNING - id: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 - message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. + languages: + - python + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::hash-algorithm::pycryptodome + - crypto::search::hash-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -32511,45 +24179,44 @@ rules: - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::hash-algorithm::pycryptodome - - crypto::search::hash-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 - shortlink: https://sg.run/85JN semgrep.dev: rule: + origin: community r_id: 33640 - rv_id: 1263552 rule_id: DbUXwo + rv_id: 1263552 + url: + https://semgrep.dev/playground/r/44TEjpk/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 version_id: 44TEjpk - url: https://semgrep.dev/playground/r/44TEjpk/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 - origin: community + shortlink: https://sg.run/85JN + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - severity: WARNING - languages: - - python pattern-either: - pattern: Crypto.Hash.MD5.new(...) - pattern: Cryptodome.Hash.MD5.new (...) + severity: WARNING - id: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 - message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not - suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + languages: + - python + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore + not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -32559,75 +24226,72 @@ rules: - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 - shortlink: https://sg.run/3ALr semgrep.dev: rule: + origin: community r_id: 9687 - rv_id: 1263553 rule_id: ReUPO3 + rv_id: 1263553 + url: + https://semgrep.dev/playground/r/PkTR3vk/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 version_id: PkTR3vk - url: https://semgrep.dev/playground/r/PkTR3vk/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/3ALr + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: Crypto.Hash.SHA.new(...) - pattern: Cryptodome.Hash.SHA.new (...) + severity: WARNING - id: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size + languages: + - python message: Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher. metadata: + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::key-length::pycryptodome + - crypto::search::key-length::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://www.pycryptodome.org/src/public_key/dsa - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::key-length::pycryptodome - - crypto::search::key-length::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size - shortlink: https://sg.run/4y8l semgrep.dev: rule: + origin: community r_id: 9688 - rv_id: 1263554 rule_id: AbUWje + rv_id: 1263554 + url: + https://semgrep.dev/playground/r/JdTzxbQ/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size version_id: JdTzxbQ - url: https://semgrep.dev/playground/r/JdTzxbQ/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size - origin: community + shortlink: https://sg.run/4y8l + source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - languages: - - python - severity: WARNING patterns: - pattern-either: - pattern: Crypto.PublicKey.DSA.generate(..., bits=$SIZE, ...) @@ -32635,50 +24299,52 @@ rules: - pattern: Cryptodome.PublicKey.DSA.generate(..., bits=$SIZE, ...) - pattern: Cryptodome.PublicKey.DSA.generate($SIZE, ...) - metavariable-comparison: - metavariable: $SIZE comparison: $SIZE < 2048 + metavariable: $SIZE + severity: WARNING - id: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size + languages: + - python message: Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher. metadata: + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::key-length::pycryptodome + - crypto::search::key-length::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://www.pycryptodome.org/src/public_key/rsa#rsa - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::key-length::pycryptodome - - crypto::search::key-length::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size - shortlink: https://sg.run/PprY semgrep.dev: rule: + origin: community r_id: 9689 - rv_id: 1263555 rule_id: BYUBWe + rv_id: 1263555 + url: + https://semgrep.dev/playground/r/5PTo1jL/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size version_id: 5PTo1jL - url: https://semgrep.dev/playground/r/5PTo1jL/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size - origin: community + shortlink: https://sg.run/PprY + source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - languages: - - python - severity: WARNING patterns: - pattern-either: - pattern: Crypto.PublicKey.RSA.generate(..., bits=$SIZE, ...) @@ -32686,58 +24352,52 @@ rules: - pattern: Cryptodome.PublicKey.RSA.generate(..., bits=$SIZE, ...) - pattern: Cryptodome.PublicKey.RSA.generate($SIZE, ...) - metavariable-comparison: - metavariable: $SIZE comparison: $SIZE < 3072 + metavariable: $SIZE + severity: WARNING - id: python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication - message: 'An encryption mode of operation is being used without proper message authentication. This can potentially result - in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ' languages: - python - severity: ERROR + message: 'An encryption mode of operation is being used without proper message authentication. This can potentially result + in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ' metadata: category: security - technology: - - cryptography + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication - shortlink: https://sg.run/k1K1 semgrep.dev: rule: + origin: community r_id: 31872 - rv_id: 1263556 rule_id: YGUw8w + rv_id: 1263556 + url: + https://semgrep.dev/playground/r/GxTkeyz/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication version_id: GxTkeyz - url: https://semgrep.dev/playground/r/GxTkeyz/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication - origin: community + shortlink: https://sg.run/k1K1 + source: + https://semgrep.dev/r/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - patterns: - pattern-either: - - pattern: 'AES.new(..., $PYCRYPTODOME_MODE) - - ' - - pattern-not-inside: 'AES.new(..., $PYCRYPTODOME_MODE) - - ... - - HMAC.new - - ' + - pattern: "AES.new(..., $PYCRYPTODOME_MODE)\n" + - pattern-not-inside: "AES.new(..., $PYCRYPTODOME_MODE)\n...\nHMAC.new\n" - metavariable-pattern: metavariable: $PYCRYPTODOME_MODE patterns: @@ -32746,7 +24406,45 @@ rules: - pattern: AES.MODE_CTR - pattern: AES.MODE_CFB - pattern: AES.MODE_OFB -- id: python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + severity: ERROR +- fix: "$...PARAMS, httponly=True\n" + id: python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + languages: + - python + message: Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies + should be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not + properly protected and are at risk of being stolen by an attacker. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + semgrep.dev: + rule: + origin: community + r_id: 21437 + rule_id: bwUXKB + rv_id: 1263557 + url: + https://semgrep.dev/playground/r/RGT0L7K/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + version_id: RGT0L7K + shortlink: https://sg.run/EprB + source: + https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - pattern: pyramid.authentication.$FUNC($...PARAMS) - metavariable-pattern: @@ -32757,45 +24455,45 @@ rules: - pattern-not: pyramid.authentication.$FUNC(..., httponly=$HTTPONLY, ...) - pattern-not: pyramid.authentication.$FUNC(..., **$PARAMS, ...) - focus-metavariable: $...PARAMS - fix: '$...PARAMS, httponly=True - - ' - message: Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should - be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected - and are at risk of being stolen by an attacker. + severity: WARNING +- fix: "True\n" + id: python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value + languages: + - python + message: Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies + should be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not + properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + semgrep.dev: + rule: + origin: community + r_id: 21438 + rule_id: NbUq9e + rv_id: 1263558 + url: + https://semgrep.dev/playground/r/A8Tgd8N/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value + version_id: A8Tgd8N + shortlink: https://sg.run/7DgQ + source: + https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value subcategory: - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - pyramid vulnerability_class: - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default - shortlink: https://sg.run/EprB - semgrep.dev: - rule: - r_id: 21437 - rv_id: 1263557 - rule_id: bwUXKB - version_id: RGT0L7K - url: https://semgrep.dev/playground/r/RGT0L7K/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value patterns: - pattern-either: - patterns: @@ -32807,48 +24505,45 @@ rules: - pattern: $HTTPONLY - metavariable-pattern: metavariable: $HTTPONLY - pattern: 'False - - ' - fix: 'True - - ' - message: Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should - be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected - and are at risk of being stolen by an attacker. + pattern: "False\n" + severity: WARNING +- fix: "'Lax'\n" + id: python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite + languages: + - python + message: Found a Pyramid Authentication Ticket without the samesite option correctly set. Pyramid cookies should be + handled securely by setting samesite='Lax'. If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - - A05:2021 - Security Misconfiguration - - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control references: - - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + semgrep.dev: + rule: + origin: community + r_id: 21439 + rule_id: kxUYjY + rv_id: 1263559 + url: + https://semgrep.dev/playground/r/BjTkZ51/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite + version_id: BjTkZ51 + shortlink: https://sg.run/LYrY + source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite subcategory: - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - pyramid vulnerability_class: - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value - shortlink: https://sg.run/7DgQ - semgrep.dev: - rule: - r_id: 21438 - rv_id: 1263558 - rule_id: NbUq9e - version_id: A8Tgd8N - url: https://semgrep.dev/playground/r/A8Tgd8N/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite patterns: - pattern-either: - pattern: pyramid.authentication.AuthTktCookieHelper(..., samesite=$SAMESITE, ...) @@ -32857,45 +24552,47 @@ rules: - metavariable-regex: metavariable: $SAMESITE regex: (?!'Lax') - fix: '''Lax'' - - ' - message: Found a Pyramid Authentication Ticket without the samesite option correctly set. Pyramid cookies should be handled - securely by setting samesite='Lax'. If this parameter is not properly set, your cookies are not properly protected and - are at risk of being stolen by an attacker. + severity: WARNING +- fix-regex: + regex: (.*)\) + replacement: \1, secure=True) + id: python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default + languages: + - python + message: Found a Pyramid Authentication Ticket cookie using an unsafe default for the secure option. Pyramid cookies + should be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not + properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - category: security - technology: - - pyramid + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration references: - - https://owasp.org/Top10/A01_2021-Broken_Access_Control + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + semgrep.dev: + rule: + origin: community + r_id: 21440 + rule_id: wdUKzn + rv_id: 1263560 + url: + https://semgrep.dev/playground/r/DkTRbJn/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default + version_id: DkTRbJn + shortlink: https://sg.run/8WxQ + source: + https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default subcategory: - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - pyramid vulnerability_class: - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite - shortlink: https://sg.run/LYrY - semgrep.dev: - rule: - r_id: 21439 - rv_id: 1263559 - rule_id: kxUYjY - version_id: BjTkZ51 - url: https://semgrep.dev/playground/r/BjTkZ51/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default patterns: - pattern-either: - patterns: @@ -32906,45 +24603,45 @@ rules: - pattern-not: pyramid.authentication.AuthTktAuthenticationPolicy(..., secure=$SECURE, ...) - pattern-not: pyramid.authentication.AuthTktAuthenticationPolicy(..., **$PARAMS) - pattern: pyramid.authentication.AuthTktAuthenticationPolicy(...) - fix-regex: - regex: (.*)\) - replacement: \1, secure=True) - message: Found a Pyramid Authentication Ticket cookie using an unsafe default for the secure option. Pyramid cookies should - be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected - and are at risk of being stolen by an attacker. + severity: WARNING +- fix: "True\n" + id: python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value + languages: + - python + message: Found a Pyramid Authentication Ticket cookie without the secure option correctly set. Pyramid cookies should + be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + semgrep.dev: + rule: + origin: community + r_id: 21441 + rule_id: x8UqAp + rv_id: 1263561 + url: + https://semgrep.dev/playground/r/WrTqK93/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value + version_id: WrTqK93 + shortlink: https://sg.run/gjp5 + source: + https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value subcategory: - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - pyramid vulnerability_class: - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default - shortlink: https://sg.run/8WxQ - semgrep.dev: - rule: - r_id: 21440 - rv_id: 1263560 - rule_id: wdUKzn - version_id: DkTRbJn - url: https://semgrep.dev/playground/r/DkTRbJn/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value patterns: - pattern-either: - patterns: @@ -32956,218 +24653,172 @@ rules: - pattern: $SECURE - metavariable-pattern: metavariable: $SECURE - pattern: 'False - - ' - fix: 'True - - ' - message: Found a Pyramid Authentication Ticket cookie without the secure option correctly set. Pyramid cookies should be - handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected - and are at risk of being stolen by an attacker. - metadata: - cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' - owasp: - - A05:2021 - Security Misconfiguration - - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid - references: - - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value - shortlink: https://sg.run/gjp5 - semgrep.dev: - rule: - r_id: 21441 - rv_id: 1263561 - rule_id: x8UqAp - version_id: WrTqK93 - url: https://semgrep.dev/playground/r/WrTqK93/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value - origin: community - languages: - - python + pattern: "False\n" severity: WARNING -- id: python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally - patterns: - - pattern-inside: '$CONFIG.set_default_csrf_options(..., check_origin=$CHECK_ORIGIN, ...) - - ' - - pattern: $CHECK_ORIGIN - - metavariable-comparison: - metavariable: $CHECK_ORIGIN - comparison: $CHECK_ORIGIN == False - message: Automatic check of the referrer for cross-site request forgery tokens has been explicitly disabled globally, which - might leave views unprotected when an unsafe CSRF storage policy is used. Use 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)' - to turn the automatic check for all unsafe methods (per RFC2616). +- fix: "True\n" + id: python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally languages: - python - severity: ERROR - fix: 'True - - ' + message: Automatic check of the referrer for cross-site request forgery tokens has been explicitly disabled globally, + which might leave views unprotected when an unsafe CSRF storage policy is used. Use + 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)' to turn the automatic check for all unsafe + methods (per RFC2616). metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site Request Forgery (CSRF) - source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally - shortlink: https://sg.run/3GeW semgrep.dev: rule: + origin: community r_id: 21443 - rv_id: 1263563 rule_id: eqU9Le + rv_id: 1263563 + url: + https://semgrep.dev/playground/r/K3TKkeo/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally version_id: K3TKkeo - url: https://semgrep.dev/playground/r/K3TKkeo/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally - origin: community -- id: python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled - message: Origin check for the CSRF token is disabled for this view. This might represent a security risk if the CSRF storage - policy is not known to be secure. + shortlink: https://sg.run/3GeW + source: + https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + patterns: + - pattern-inside: "$CONFIG.set_default_csrf_options(..., check_origin=$CHECK_ORIGIN, ...)\n" + - pattern: $CHECK_ORIGIN + - metavariable-comparison: + comparison: $CHECK_ORIGIN == False + metavariable: $CHECK_ORIGIN + severity: ERROR +- fix: "True\n" + id: python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled + languages: + - python + message: Origin check for the CSRF token is disabled for this view. This might represent a security risk if the CSRF + storage policy is not known to be secure. metadata: - cwe: - - 'CWE-352: Cross-Site Request Forgery (CSRF)' - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control asvs: - section: V4 Access Control control_id: 4.2.2 CSRF - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control + section: V4 Access Control version: '4' category: security - technology: - - pyramid - references: - - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2022-top25: true + confidence: MEDIUM + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW + cwe2022-top25: true impact: LOW - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site Request Forgery (CSRF) - source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled - shortlink: https://sg.run/4RB9 + likelihood: LOW + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control semgrep.dev: rule: + origin: community r_id: 21444 - rv_id: 1263564 rule_id: v8UGpL + rv_id: 1263564 + url: + https://semgrep.dev/playground/r/qkTR7Gv/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled version_id: qkTR7Gv - url: https://semgrep.dev/playground/r/qkTR7Gv/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/4RB9 + source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cross-Site Request Forgery (CSRF) patterns: - pattern-inside: "from pyramid.view import view_config\n...\n@view_config(..., check_origin=$CHECK_ORIGIN, ...)\ndef $VIEW(...):\n\ \ ...\n" - pattern: $CHECK_ORIGIN - metavariable-comparison: - metavariable: $CHECK_ORIGIN comparison: $CHECK_ORIGIN == False - fix: 'True - - ' -- id: python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default - patterns: - - pattern-either: - - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ - \ ...\n" - - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" - - pattern-not: $RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...) - - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) - - pattern: $RESPONSE.set_cookie(...) - fix-regex: + metavariable: $CHECK_ORIGIN + severity: WARNING +- fix-regex: regex: (.*)\) replacement: \1, httponly=True) - message: Found a Pyramid cookie using an unsafe default for the httponly option. Pyramid cookies should be handled securely - by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly - protected and are at risk of being stolen by an attacker. + id: python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default + languages: + - python + message: Found a Pyramid cookie using an unsafe default for the httponly option. Pyramid cookies should be handled + securely by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies + are not properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default - shortlink: https://sg.run/P19v semgrep.dev: rule: + origin: community r_id: 21445 - rv_id: 1263565 rule_id: d8UPQ7 + rv_id: 1263565 + url: + https://semgrep.dev/playground/r/l4TJRbo/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default version_id: l4TJRbo - url: https://semgrep.dev/playground/r/l4TJRbo/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value + shortlink: https://sg.run/P19v + source: + https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - pattern-either: - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ \ ...\n" - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...) - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) - - pattern: $RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...) - - pattern: $HTTPONLY - - metavariable-pattern: - metavariable: $HTTPONLY - pattern: 'False - - ' - fix: 'True - - ' - message: Found a Pyramid cookie without the httponly option correctly set. Pyramid cookies should be handled securely by - setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly - protected and are at risk of being stolen by an attacker. + - pattern: $RESPONSE.set_cookie(...) + severity: WARNING +- fix: "True\n" + id: python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value + languages: + - python + message: Found a Pyramid cookie without the httponly option correctly set. Pyramid cookies should be handled securely + by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not + properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration @@ -33175,401 +24826,387 @@ rules: - https://owasp.org/www-community/controls/SecureCookieAttribute - https://owasp.org/www-community/HttpOnly - https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#httponly-attribute - category: security - technology: - - pyramid - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value - shortlink: https://sg.run/JbqP semgrep.dev: rule: + origin: community r_id: 21446 - rv_id: 1263566 rule_id: ZqU37W + rv_id: 1263566 + url: + https://semgrep.dev/playground/r/YDTZe54/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value version_id: YDTZe54 - url: https://semgrep.dev/playground/r/YDTZe54/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default + shortlink: https://sg.run/JbqP + source: + https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - pattern-either: - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ \ ...\n" - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" - - pattern-not: $RESPONSE.set_cookie(..., samesite=$SAMESITE, ...) - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) - - pattern: $RESPONSE.set_cookie(...) - fix-regex: + - pattern: $RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...) + - pattern: $HTTPONLY + - metavariable-pattern: + metavariable: $HTTPONLY + pattern: "False\n" + severity: WARNING +- fix-regex: regex: (.*)\) replacement: \1, samesite='Lax') - message: Found a Pyramid cookie using an unsafe value for the samesite option. Pyramid cookies should be handled securely - by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly - protected and are at risk of being stolen by an attacker. + id: python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default + languages: + - python + message: Found a Pyramid cookie using an unsafe value for the samesite option. Pyramid cookies should be handled + securely by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies + are not properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default - shortlink: https://sg.run/5AWj semgrep.dev: rule: + origin: community r_id: 21447 - rv_id: 1263567 rule_id: nJUp80 + rv_id: 1263567 + url: + https://semgrep.dev/playground/r/6xT293z/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default version_id: 6xT293z - url: https://semgrep.dev/playground/r/6xT293z/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value + shortlink: https://sg.run/5AWj + source: + https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - pattern-either: - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ \ ...\n" - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., samesite=$SAMESITE, ...) - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) - - pattern: $RESPONSE.set_cookie(..., samesite=$SAMESITE, ...) - - pattern: $SAMESITE - - metavariable-regex: - metavariable: $SAMESITE - regex: (?!'Lax') - fix: '''Lax'' - - ' - message: Found a Pyramid cookie without the samesite option correctly set. Pyramid cookies should be handled securely by - setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly - protected and are at risk of being stolen by an attacker. + - pattern: $RESPONSE.set_cookie(...) + severity: WARNING +- fix: "'Lax'\n" + id: python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value + languages: + - python + message: Found a Pyramid cookie without the samesite option correctly set. Pyramid cookies should be handled securely + by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not + properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value - shortlink: https://sg.run/GXR6 semgrep.dev: rule: + origin: community r_id: 21448 - rv_id: 1263568 rule_id: EwUgpY + rv_id: 1263568 + url: + https://semgrep.dev/playground/r/o5TbDv5/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value version_id: o5TbDv5 - url: https://semgrep.dev/playground/r/o5TbDv5/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default + shortlink: https://sg.run/GXR6 + source: + https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - pattern-either: - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ \ ...\n" - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" - - pattern-not: $RESPONSE.set_cookie(..., secure=$SECURE, ...) - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) - - pattern: $RESPONSE.set_cookie(...) - fix-regex: + - pattern: $RESPONSE.set_cookie(..., samesite=$SAMESITE, ...) + - pattern: $SAMESITE + - metavariable-regex: + metavariable: $SAMESITE + regex: (?!'Lax') + severity: WARNING +- fix-regex: regex: (.*)\) replacement: \1, secure=True) - message: Found a Pyramid cookie using an unsafe default for the secure option. Pyramid cookies should be handled securely - by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly - protected and are at risk of being stolen by an attacker. + id: python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default + languages: + - python + message: Found a Pyramid cookie using an unsafe default for the secure option. Pyramid cookies should be handled + securely by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are + not properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default - shortlink: https://sg.run/RbrN semgrep.dev: rule: + origin: community r_id: 21449 - rv_id: 1263569 rule_id: 7KUr15 + rv_id: 1263569 + url: + https://semgrep.dev/playground/r/zyTb2dX/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default version_id: zyTb2dX - url: https://semgrep.dev/playground/r/zyTb2dX/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value + shortlink: https://sg.run/RbrN + source: + https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - pattern-either: - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ \ ...\n" - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., secure=$SECURE, ...) - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) - - pattern: $RESPONSE.set_cookie(..., secure=$SECURE, ...) - - pattern: $SECURE - - metavariable-pattern: - metavariable: $SECURE - pattern: 'False - - ' - fix: 'True - - ' - message: Found a Pyramid cookie without the secure option correctly set. Pyramid cookies should be handled securely by setting - secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected - and are at risk of being stolen by an attacker. + - pattern: $RESPONSE.set_cookie(...) + severity: WARNING +- fix: "True\n" + id: python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value + languages: + - python + message: Found a Pyramid cookie without the secure option correctly set. Pyramid cookies should be handled securely by + setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not + properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value - shortlink: https://sg.run/AzjB semgrep.dev: rule: + origin: community r_id: 21450 - rv_id: 1263570 rule_id: L1UX2J + rv_id: 1263570 + url: + https://semgrep.dev/playground/r/pZT03oJ/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value version_id: pZT03oJ - url: https://semgrep.dev/playground/r/pZT03oJ/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally + shortlink: https://sg.run/AzjB + source: + https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - - pattern-inside: '$CONFIG.set_default_csrf_options(..., require_csrf=$REQUIRE_CSRF, ...) - - ' - - pattern: $REQUIRE_CSRF - - metavariable-comparison: - metavariable: $REQUIRE_CSRF - comparison: $REQUIRE_CSRF == False - message: Automatic check of cross-site request forgery tokens has been explicitly disabled globally, which might leave views - unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)' to turn the automatic check - for all unsafe methods (per RFC2616). + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(..., secure=$SECURE, ...) + - pattern: $SECURE + - metavariable-pattern: + metavariable: $SECURE + pattern: "False\n" + severity: WARNING +- fix: "True\n" + id: python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally languages: - python - severity: ERROR - fix: 'True - - ' + message: Automatic check of cross-site request forgery tokens has been explicitly disabled globally, which might leave + views unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)' to turn the + automatic check for all unsafe methods (per RFC2616). metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site Request Forgery (CSRF) - source: https://semgrep.dev/r/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally - shortlink: https://sg.run/Bx2R semgrep.dev: rule: + origin: community r_id: 21451 - rv_id: 1263571 rule_id: 8GUKqP + rv_id: 1263571 + url: + https://semgrep.dev/playground/r/2KTv2en/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally version_id: 2KTv2en - url: https://semgrep.dev/playground/r/2KTv2en/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally - origin: community + shortlink: https://sg.run/Bx2R + source: + https://semgrep.dev/r/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + patterns: + - pattern-inside: "$CONFIG.set_default_csrf_options(..., require_csrf=$REQUIRE_CSRF, ...)\n" + - pattern: $REQUIRE_CSRF + - metavariable-comparison: + comparison: $REQUIRE_CSRF == False + metavariable: $REQUIRE_CSRF + severity: ERROR - id: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response - message: Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting - (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML. + languages: + - python + message: Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site + scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render + HTML. metadata: - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - owasp: - - A07:2017 - Cross-Site Scripting (XSS) - - A03:2021 - Injection - - A05:2025 - Injection category: security - technology: - - pyramid - references: - - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response - shortlink: https://sg.run/DX8G + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection semgrep.dev: rule: + origin: community r_id: 21452 - rv_id: 1263572 rule_id: gxUeA8 + rv_id: 1263572 + url: + https://semgrep.dev/playground/r/X0TzyEe/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response version_id: X0TzyEe - url: https://semgrep.dev/playground/r/X0TzyEe/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response - origin: community - languages: - - python - severity: ERROR + shortlink: https://sg.run/DX8G + source: https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "pyramid.request.Response.text($SINK)\n" + - pattern: "pyramid.request.Response($SINK)\n" + - pattern: "$REQ.response.body = $SINK\n" + - pattern: "$REQ.response.text = $SINK\n" + - pattern: "$REQ.response.ubody = $SINK\n" + - pattern: "$REQ.response.unicode_body = $SINK\n" + - pattern: $SINK pattern-sources: - patterns: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - pattern-sinks: - - patterns: - - pattern-either: - - pattern: 'pyramid.request.Response.text($SINK) - - ' - - pattern: 'pyramid.request.Response($SINK) - - ' - - pattern: '$REQ.response.body = $SINK - - ' - - pattern: '$REQ.response.text = $SINK - - ' - - pattern: '$REQ.response.ubody = $SINK - - ' - - pattern: '$REQ.response.unicode_body = $SINK - - ' - - pattern: $SINK -- id: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection - message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs - raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL - into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function - besides "bindparams". Use bindParams to securely bind user-input to SQL statements. + severity: ERROR +- fix-regex: + regex: format + replacement: bindparams + id: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection languages: - python - severity: ERROR + message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer + inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs + raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with + any function besides "bindparams". Use bindParams to securely bind user-input to SQL statements. metadata: category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data - technology: - - pyramid - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection - shortlink: https://sg.run/W7eE semgrep.dev: rule: + origin: community r_id: 21453 - rv_id: 1263573 rule_id: QrUZ7l + rv_id: 1263573 + url: + https://semgrep.dev/playground/r/jQTn5WA/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection version_id: jQTn5WA - url: https://semgrep.dev/playground/r/jQTn5WA/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection - origin: community + shortlink: https://sg.run/W7eE + source: https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - patterns: - - pattern-inside: "from pyramid.view import view_config\n...\n@view_config( ... )\ndef $VIEW($REQ):\n ...\n" - - pattern: $REQ.$ANYTHING - - pattern-not: $REQ.dbsession pattern-sinks: - patterns: - - pattern-inside: '$QUERY = $REQ.dbsession.query(...) - - ... - - ' - - pattern-either: - - pattern: '$QUERY.$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...)) - - ' - - pattern: '$QUERY.join(...).$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...)) - - ' + - pattern-inside: "$QUERY = $REQ.dbsession.query(...)\n...\n" + - pattern-either: + - pattern: "$QUERY.$SQLFUNC(\"...\".$FORMATFUNC(..., $SINK, ...))\n" + - pattern: "$QUERY.join(...).$SQLFUNC(\"...\".$FORMATFUNC(..., $SINK, ...))\n" - pattern: $SINK - metavariable-regex: metavariable: $SQLFUNC @@ -33577,87 +25214,121 @@ rules: - metavariable-regex: metavariable: $FORMATFUNC regex: (?!bindparams) - fix-regex: - regex: format - replacement: bindparams + pattern-sources: + - patterns: + - pattern-inside: "from pyramid.view import view_config\n...\n@view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + severity: ERROR - id: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text + languages: + - python + message: sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the + usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can + reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql + semgrep.dev: + rule: + origin: community + r_id: 15824 + rule_id: r6U2wE + rv_id: 1263577 + url: + https://semgrep.dev/playground/r/rxTAKqq/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text + version_id: rxTAKqq + shortlink: https://sg.run/yP1O + source: https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text + subcategory: + - audit + technology: + - sqlalchemy + vulnerability_class: + - SQL Injection mode: taint pattern-sinks: - - pattern: 'sqlalchemy.text(...) - - ' + - pattern: "sqlalchemy.text(...)\n" pattern-sources: - patterns: - - pattern: '$X + $Y - - ' + - pattern: "$X + $Y\n" - metavariable-type: metavariable: $X type: string - patterns: - - pattern: '$X + $Y - - ' + - pattern: "$X + $Y\n" - metavariable-type: metavariable: $Y type: string - patterns: - - pattern: 'f"..." - - ' + - pattern: "f\"...\"\n" - patterns: - - pattern: '$X.format(...) - - ' + - pattern: "$X.format(...)\n" - metavariable-type: metavariable: $X type: string - patterns: - - pattern: '$X % $Y - - ' + - pattern: "$X % $Y\n" - metavariable-type: metavariable: $X type: string - message: sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual - SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. - Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL. + severity: ERROR +- fix-regex: + regex: format + replacement: bindparams + id: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + languages: + - python + message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer + inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs + raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with + any function besides "bindparams". Use bindParams to securely bind user-input to SQL statements. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - category: security - technology: - - sqlalchemy - confidence: MEDIUM references: - - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text - shortlink: https://sg.run/yP1O + - https://owasp.org/Top10/A03_2021-Injection semgrep.dev: rule: - r_id: 15824 - rv_id: 1263577 - rule_id: r6U2wE - version_id: rxTAKqq - url: https://semgrep.dev/playground/r/rxTAKqq/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text origin: community - languages: - - python - severity: ERROR -- id: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + r_id: 9702 + rule_id: BYUBWo + rv_id: 1263579 + url: + https://semgrep.dev/playground/r/NdTzyL4/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + version_id: NdTzyL4 + shortlink: https://sg.run/J3Xo + source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + subcategory: + - vuln + technology: + - sqlalchemy + vulnerability_class: + - SQL Injection patterns: - pattern-either: - pattern: "def $FUNC(...,$VAR,...):\n ...\n $SESSION.query(...).$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n" @@ -33670,108 +25341,59 @@ rules: - metavariable-regex: metavariable: $FORMATFUNC regex: (?!bindparams) - message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs - raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL - into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function - besides "bindparams". Use bindParams to securely bind user-input to SQL statements. - fix-regex: - regex: format - replacement: bindparams - languages: - - python severity: WARNING - metadata: - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - category: security - technology: - - sqlalchemy - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection - shortlink: https://sg.run/J3Xo - semgrep.dev: - rule: - r_id: 9702 - rv_id: 1263579 - rule_id: BYUBWo - version_id: NdTzyL4 - url: https://semgrep.dev/playground/r/NdTzyL4/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection - origin: community - id: python.twilio.security.twiml-injection.twiml-injection languages: - python - severity: WARNING - message: Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the - injection of additional TwiML commands + message: Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow + the injection of additional TwiML commands metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-91: XML Injection' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - python - - twilio - - twiml - confidence: MEDIUM - likelihood: HIGH - impact: MEDIUM - subcategory: - - vuln references: - https://codeberg.org/fennix/funjection - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection - shortlink: https://sg.run/GdEEy semgrep.dev: rule: + origin: community r_id: 134692 - rv_id: 1263580 rule_id: oqUgjj2 - version_id: kbTzGp1 + rv_id: 1263580 url: https://semgrep.dev/playground/r/kbTzGp1/python.twilio.security.twiml-injection.twiml-injection - origin: community + version_id: kbTzGp1 + shortlink: https://sg.run/GdEEy + source: https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection + subcategory: + - vuln + technology: + - python + - twilio + - twiml + vulnerability_class: + - Other mode: taint - pattern-sources: - - pattern: 'f"..." - - ' - - pattern: '"..." % ... - - ' - - pattern: '"...".format(...) - - ' - - patterns: - - pattern: $ARG - - pattern-inside: "def $F(..., $ARG, ...):\n ...\n" pattern-sanitizers: - pattern: xml.sax.saxutils.escape(...) - pattern: html.escape(...) pattern-sinks: - patterns: - - pattern: '$CLIENT.calls.create(..., twiml=$SINK, ...) - - ' + - pattern: "$CLIENT.calls.create(..., twiml=$SINK, ...)\n" - focus-metavariable: $SINK + pattern-sources: + - pattern: "f\"...\"\n" + - pattern: "\"...\" % ...\n" + - pattern: "\"...\".format(...)\n" + - patterns: + - pattern: $ARG + - pattern-inside: "def $F(..., $ARG, ...):\n ...\n" + severity: WARNING - id: ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli languages: - ruby @@ -33779,40 +25401,40 @@ rules: user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql ["SELECT title FROM posts WHERE author = ? AND created > ?", author_id, start_date]`' - mode: taint metadata: - references: - - https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - active-record - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli - shortlink: https://sg.run/vXvY + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql semgrep.dev: rule: + origin: community r_id: 18277 - rv_id: 1263581 rule_id: 0oUw9g - version_id: w8TRor7 + rv_id: 1263581 url: https://semgrep.dev/playground/r/w8TRor7/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli - origin: community + version_id: w8TRor7 + shortlink: https://sg.run/vXvY + source: https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli + subcategory: + - vuln + technology: + - aws-lambda + - active-record + vulnerability_class: + - SQL Injection + mode: taint pattern-sinks: - patterns: - pattern: $QUERY @@ -33820,11 +25442,7 @@ rules: - pattern: ActiveRecord::Base.connection.execute($QUERY,...) - pattern: $MODEL.find_by_sql($QUERY,...) - pattern: $MODEL.select_all($QUERY,...) - - pattern-inside: 'require ''active_record'' - - ... - - ' + - pattern-inside: "require 'active_record'\n...\n" pattern-sources: - patterns: - pattern: event @@ -33836,53 +25454,49 @@ rules: message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`' - mode: taint metadata: - references: - - https://github.com/brianmario/mysql2 category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - mysql2 - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli - shortlink: https://sg.run/dJLE + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://github.com/brianmario/mysql2 semgrep.dev: rule: + origin: community r_id: 18278 - rv_id: 1263582 rule_id: KxUrQ3 - version_id: xyTjzOe + rv_id: 1263582 url: https://semgrep.dev/playground/r/xyTjzOe/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli - origin: community + version_id: xyTjzOe + shortlink: https://sg.run/dJLE + source: https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli + subcategory: + - vuln + technology: + - aws-lambda + - mysql2 + vulnerability_class: + - SQL Injection + mode: taint + pattern-sanitizers: + - pattern: $CLIENT.escape(...) pattern-sinks: - patterns: - pattern: $QUERY - pattern-either: - pattern: $CLIENT.query($QUERY,...) - pattern: $CLIENT.prepare($QUERY,...) - - pattern-inside: 'require ''mysql2'' - - ... - - ' - pattern-sanitizers: - - pattern: $CLIENT.escape(...) + - pattern-inside: "require 'mysql2'\n...\n" pattern-sources: - patterns: - pattern: event @@ -33891,45 +25505,44 @@ rules: - id: ruby.aws-lambda.security.pg-sqli.pg-sqli languages: - ruby - message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + message: "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `conn.exec_params(''SELECT $1 AS a, $2 AS b, $3 AS c'', [1, 2, - nil])`' - mode: taint + instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`" metadata: - references: - - https://www.rubydoc.info/gems/pg/PG/Connection category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + references: + - https://www.rubydoc.info/gems/pg/PG/Connection + semgrep.dev: + rule: + origin: community + r_id: 18279 + rule_id: qNUQee + rv_id: 1263583 + url: https://semgrep.dev/playground/r/O9Tpxz7/ruby.aws-lambda.security.pg-sqli.pg-sqli + version_id: O9Tpxz7 + shortlink: https://sg.run/ZKww + source: https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli + subcategory: + - vuln technology: - aws-lambda - postgres - pg - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection - source: https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli - shortlink: https://sg.run/ZKww - semgrep.dev: - rule: - r_id: 18279 - rv_id: 1263583 - rule_id: qNUQee - version_id: O9Tpxz7 - url: https://semgrep.dev/playground/r/O9Tpxz7/ruby.aws-lambda.security.pg-sqli.pg-sqli - origin: community + mode: taint pattern-sinks: - patterns: - pattern: $QUERY @@ -33940,11 +25553,7 @@ rules: - pattern: $CONN.async_exec($QUERY,...) - pattern: $CONN.async_exec_params($QUERY,...) - pattern: $CONN.async_exec_prepared($QUERY,...) - - pattern-inside: 'require ''pg'' - - ... - - ' + - pattern-inside: "require 'pg'\n...\n" pattern-sources: - patterns: - pattern: event @@ -33953,118 +25562,107 @@ rules: - id: ruby.aws-lambda.security.sequel-sqli.sequel-sqli languages: - ruby - message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + message: "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `DB[''select * from items where name = ?'', name]`' - mode: taint + instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`" metadata: - references: - - https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - sequel - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli - shortlink: https://sg.run/n9vY + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries semgrep.dev: rule: + origin: community r_id: 18280 - rv_id: 1263584 rule_id: lBUy2N - version_id: e1Tyj5j + rv_id: 1263584 url: https://semgrep.dev/playground/r/e1Tyj5j/ruby.aws-lambda.security.sequel-sqli.sequel-sqli - origin: community + version_id: e1Tyj5j + shortlink: https://sg.run/n9vY + source: https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli + subcategory: + - vuln + technology: + - aws-lambda + - sequel + vulnerability_class: + - SQL Injection + mode: taint pattern-sinks: - patterns: - pattern: $QUERY - pattern-either: - pattern: DB[$QUERY,...] - pattern: DB.run($QUERY,...) - - pattern-inside: 'require ''sequel'' - - ... - - ' + - pattern-inside: "require 'sequel'\n...\n" pattern-sources: - patterns: - pattern: event - pattern-inside: "def $HANDLER(event, context)\n ...\nend\n" severity: WARNING - id: ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization - mode: taint languages: - ruby - message: Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then - later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML - or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable - of returning 'primitive' types such as strings, arrays, hashes, numbers and nil. + message: Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, + then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with + MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as + it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil. metadata: - references: - - https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html - - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ - - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb category: security - owasp: - - A08:2017 - Insecure Deserialization - - A08:2021 - Software and Data Integrity Failures - - A08:2025 - Software or Data Integrity Failures + confidence: MEDIUM cwe: - 'CWE-502: Deserialization of Untrusted Data' - technology: - - ruby - - aws-lambda - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization - shortlink: https://sg.run/dplX + likelihood: MEDIUM + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + references: + - https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html + - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ + - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb semgrep.dev: rule: + origin: community r_id: 22078 - rv_id: 1263585 rule_id: zdUlNJ + rv_id: 1263585 + url: + https://semgrep.dev/playground/r/vdT06gR/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization version_id: vdT06gR - url: https://semgrep.dev/playground/r/vdT06gR/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization - origin: community + shortlink: https://sg.run/dplX + source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization + subcategory: + - vuln + technology: + - ruby + - aws-lambda + vulnerability_class: + - 'Insecure Deserialization ' + mode: taint pattern-sinks: - patterns: - pattern: $SINK - pattern-either: - - pattern-inside: 'YAML.load($SINK,...) - - ' - - pattern-inside: 'CSV.load($SINK,...) - - ' - - pattern-inside: 'Marshal.load($SINK,...) - - ' - - pattern-inside: 'Marshal.restore($SINK,...) - - ' + - pattern-inside: "YAML.load($SINK,...)\n" + - pattern-inside: "CSV.load($SINK,...)\n" + - pattern-inside: "Marshal.load($SINK,...)\n" + - pattern-inside: "Marshal.restore($SINK,...)\n" pattern-sources: - patterns: - pattern: event @@ -34073,108 +25671,99 @@ rules: - id: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - ruby - severity: ERROR - message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction - could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the - database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider - using an object-relational mapper (ORM) such as Sequelize which will protect your queries. + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual + construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify + contents of the database. Instead, use a parameterized query which is available by default in most database engines. + Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. metadata: - references: - - https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/EB7N + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet semgrep.dev: rule: + origin: community r_id: 18281 - rv_id: 1263586 rule_id: PeUxOE - version_id: d6Tyx1Z + rv_id: 1263586 url: https://semgrep.dev/playground/r/d6Tyx1Z/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string - origin: community + version_id: d6Tyx1Z + shortlink: https://sg.run/EB7N + source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context)\n ...\nend\n" pattern-sinks: - patterns: - pattern-either: - patterns: - - pattern: '"...#{...}..." - - ' + - pattern: "\"...#{...}...\"\n" - pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].* - patterns: - pattern-either: - pattern: Kernel::sprintf("$SQLSTR", ...) - - pattern: '"$SQLSTR" + $EXPR - - ' - - pattern: '"$SQLSTR" % $EXPR - - ' + - pattern: "\"$SQLSTR\" + $EXPR\n" + - pattern: "\"$SQLSTR\" % $EXPR\n" - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].* - - pattern-not-inside: 'puts(...) - - ' + - pattern-not-inside: "puts(...)\n" + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context)\n ...\nend\n" + severity: ERROR - id: ruby.lang.security.audit.sha224-hash.sha224-hash - message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating - to a stronger hash function such as SHA-384 or higher to ensure compliance and security. + languages: + - ruby + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider + updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security. metadata: + category: security + confidence: HIGH cwe: - 'CWE-328: Use of Weak Hash' - references: - - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf - - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography - category: security - technology: - - ruby + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/ruby.lang.security.audit.sha224-hash.sha224-hash - shortlink: https://sg.run/WABbo + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf + - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography semgrep.dev: rule: + origin: community r_id: 151753 - rv_id: 1263592 rule_id: DbU60wQ - version_id: 8KT5rRY + rv_id: 1263592 url: https://semgrep.dev/playground/r/8KT5rRY/ruby.lang.security.audit.sha224-hash.sha224-hash - origin: community - languages: - - ruby - severity: WARNING + version_id: 8KT5rRY + shortlink: https://sg.run/WABbo + source: https://semgrep.dev/r/ruby.lang.security.audit.sha224-hash.sha224-hash + subcategory: + - vuln + technology: + - ruby + vulnerability_class: + - Insecure Hashing Algorithm pattern-either: - pattern: Digest::SHA224.$FUNC - pattern: OpenSSL::Digest::SHA224.$FUNC @@ -34189,302 +25778,257 @@ rules: - metavariable-regex: metavariable: $ALGO regex: .*224 + severity: WARNING - id: ruby.lang.security.bad-deserialization.bad-deserialization - mode: taint - pattern-sources: - - pattern-either: - - pattern: params - - pattern: cookies - pattern-sinks: - - pattern-either: - - pattern: 'CSV.load(...) - - ' - - pattern: 'Marshal.load(...) - - ' - - pattern: 'Marshal.restore(...) - - ' - - pattern: 'Oj.object_load(...) - - ' - - pattern: 'Oj.load($X) - - ' - message: Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. - However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially - be dangerous. Use JSON in a secure fashion instead. + languages: + - ruby + message: Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from + strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or + CSV can potentially be dangerous. Use JSON in a secure fashion instead. metadata: - references: - - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ - - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb category: security + confidence: MEDIUM cwe: - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - technology: - - ruby - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization - shortlink: https://sg.run/DJj2 + references: + - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ + - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb semgrep.dev: rule: + origin: community r_id: 9708 - rv_id: 1263595 rule_id: lBUdQg - version_id: 3ZT4Xqp + rv_id: 1263595 url: https://semgrep.dev/playground/r/3ZT4Xqp/ruby.lang.security.bad-deserialization.bad-deserialization - origin: community - languages: - - ruby - severity: ERROR -- id: ruby.lang.security.dangerous-exec.dangerous-exec + version_id: 3ZT4Xqp + shortlink: https://sg.run/DJj2 + source: https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization + subcategory: + - vuln + technology: + - ruby + vulnerability_class: + - 'Insecure Deserialization ' mode: taint - pattern-sources: - - patterns: - - pattern: "def $F(...,$ARG,...)\n ...\nend\n" - - focus-metavariable: $ARG - - pattern: params - - pattern: cookies pattern-sinks: - - patterns: - - pattern: '$EXEC(...) - - ' - - pattern-not: '$EXEC("...","...","...",...) - - ' - - pattern-not: '$EXEC(["...","...","...",...],...) - - ' - - pattern-not: '$EXEC({...},"...","...","...",...) - - ' - - pattern-not: '$EXEC({...},["...","...","...",...],...) - - ' - - metavariable-regex: - metavariable: $EXEC - regex: ^(system|exec|spawn|Process.exec|Process.spawn|Open3.capture2|Open3.capture2e|Open3.capture3|Open3.popen2|Open3.popen2e|Open3.popen3|IO.popen|Gem::Util.popen|PTY.spawn)$ - message: Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call - site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. + - pattern-either: + - pattern: "CSV.load(...)\n" + - pattern: "Marshal.load(...)\n" + - pattern: "Marshal.restore(...)\n" + - pattern: "Oj.object_load(...)\n" + - pattern: "Oj.load($X)\n" + pattern-sources: + - pattern-either: + - pattern: params + - pattern: cookies + severity: ERROR +- id: ruby.lang.security.dangerous-exec.dangerous-exec + languages: + - ruby + message: Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this + call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute + arbitrary code. metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_execute.rb + category: security + confidence: MEDIUM cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - ruby - - rails references: - https://guides.rubyonrails.org/security.html#command-line-injection - cwe2022-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec - shortlink: https://sg.run/R8GY semgrep.dev: rule: + origin: community r_id: 9805 - rv_id: 1409405 rule_id: WAUZOw - version_id: WrT7erb + rv_id: 1409405 url: https://semgrep.dev/playground/r/WrT7erb/ruby.lang.security.dangerous-exec.dangerous-exec - origin: community + version_id: WrT7erb + shortlink: https://sg.run/R8GY + source: https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_execute.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - Code Injection + mode: taint + pattern-sinks: + - patterns: + - pattern: "$EXEC(...)\n" + - pattern-not: "$EXEC(\"...\",\"...\",\"...\",...)\n" + - pattern-not: "$EXEC([\"...\",\"...\",\"...\",...],...)\n" + - pattern-not: "$EXEC({...},\"...\",\"...\",\"...\",...)\n" + - pattern-not: "$EXEC({...},[\"...\",\"...\",\"...\",...],...)\n" + - metavariable-regex: + metavariable: $EXEC + regex: + ^(system|exec|spawn|Process.exec|Process.spawn|Open3.capture2|Open3.capture2e|Open3.capture3|Open3.popen2|Open3.popen2e|Open3.popen3|IO.popen|Gem::Util.popen|PTY.spawn)$ + pattern-sources: + - patterns: + - pattern: "def $F(...,$ARG,...)\n ...\nend\n" + - focus-metavariable: $ARG + - pattern: params + - pattern: cookies severity: WARNING +- fix-regex: + regex: =\s*false + replacement: = true + id: ruby.lang.security.force-ssl-false.force-ssl-false languages: - ruby -- id: ruby.lang.security.force-ssl-false.force-ssl-false - message: Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network - interception of unencrypted application traffic. To fix, set config.force_ssl = true. + message: Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to + network interception of unencrypted application traffic. To fix, set config.force_ssl = true. metadata: + category: security + confidence: HIGH cwe: - 'CWE-311: Missing Encryption of Sensitive Data' - references: - - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb - category: security - technology: - - ruby + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A04:2021 - Insecure Design - A06:2025 - Insecure Design - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false - shortlink: https://sg.run/YgkW + references: + - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb semgrep.dev: rule: + origin: community r_id: 9714 - rv_id: 1263605 rule_id: 2ZU4lx - version_id: WrTqKB3 + rv_id: 1263605 url: https://semgrep.dev/playground/r/WrTqKB3/ruby.lang.security.force-ssl-false.force-ssl-false - origin: community - languages: - - ruby - severity: WARNING + version_id: WrTqKB3 + shortlink: https://sg.run/YgkW + source: https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false + subcategory: + - vuln + technology: + - ruby + vulnerability_class: + - Cryptographic Issues pattern: config.force_ssl = false - fix-regex: - regex: =\s*false - replacement: = true -- id: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller - patterns: - - pattern-inside: "class $CONTROLLER < ApplicationController\n ...\n http_basic_authenticate_with ..., :password => \"\ - $SECRET\", ...\nend\n" - - focus-metavariable: $SECRET - message: Detected hardcoded password used in basic authentication in a controller class. Including this password in version - control could expose this credential. Consider refactoring to use environment variables or configuration files. severity: WARNING +- id: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller + languages: + - ruby + message: Detected hardcoded password used in basic authentication in a controller class. Including this password in + version control could expose this credential. Consider refactoring to use environment variables or configuration + files. metadata: + category: security + confidence: HIGH cwe: - 'CWE-798: Use of Hard-coded Credentials' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/basic_auth/index.markdown - category: security - technology: - - ruby - - secrets - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller - shortlink: https://sg.run/6r0w semgrep.dev: rule: + origin: community r_id: 9715 - rv_id: 1263606 rule_id: X5UZWK + rv_id: 1263606 + url: + https://semgrep.dev/playground/r/0bTKzNK/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller version_id: 0bTKzNK - url: https://semgrep.dev/playground/r/0bTKzNK/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller - origin: community - languages: - - ruby + shortlink: https://sg.run/6r0w + source: https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/basic_auth/index.markdown + subcategory: + - audit + technology: + - ruby + - secrets + vulnerability_class: + - Hard-coded Secrets + patterns: + - pattern-inside: "class $CONTROLLER < ApplicationController\n ...\n http_basic_authenticate_with ..., :password => \"\ + $SECRET\", ...\nend\n" + - focus-metavariable: $SECRET + severity: WARNING - id: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase - message: Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should - not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment - variables or a restricted configuration file. languages: - ruby - severity: WARNING + message: Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore + should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system + environment variables or a restricted configuration file. metadata: - technology: - - ruby - - secrets category: security - references: - - https://cwe.mitre.org/data/definitions/522.html + confidence: HIGH cwe: - 'CWE-798: Use of Hard-coded Credentials' - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM - confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase - shortlink: https://sg.run/xPEe + likelihood: MEDIUM + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cwe.mitre.org/data/definitions/522.html semgrep.dev: rule: + origin: community r_id: 20730 - rv_id: 1263607 rule_id: bwULyN + rv_id: 1263607 + url: + https://semgrep.dev/playground/r/K3TKkEo/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase version_id: K3TKkEo - url: https://semgrep.dev/playground/r/K3TKkEo/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase - origin: community + shortlink: https://sg.run/xPEe + source: https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase + subcategory: + - vuln + technology: + - ruby + - secrets + vulnerability_class: + - Hard-coded Secrets patterns: - pattern-either: - pattern: OpenSSL::PKey::RSA.new(..., '...') - pattern: OpenSSL::PKey::RSA.new(...).to_pem(..., '...') - pattern: OpenSSL::PKey::RSA.new(...).export(..., '...') - patterns: - - pattern-inside: '$OPENSSL = OpenSSL::PKey::RSA.new(...) - - ... - - ' + - pattern-inside: "$OPENSSL = OpenSSL::PKey::RSA.new(...)\n...\n" - pattern-either: - - pattern: '$OPENSSL.export(...,''...'') - - ' - - pattern: '$OPENSSL.to_pem(...,''...'') - - ' + - pattern: "$OPENSSL.export(...,'...')\n" + - pattern: "$OPENSSL.to_pem(...,'...')\n" - patterns: - pattern-either: - patterns: - - pattern-inside: '$ASSIGN = ''...'' - - ... - - ' + - pattern-inside: "$ASSIGN = '...'\n...\n" - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN) - patterns: - - pattern-inside: 'def $METHOD1(...) - - ... - - $ASSIGN = ''...'' - - ... - - end - - ... - - def $METHOD2(...) - - ... - - end - - ' + - pattern-inside: "def $METHOD1(...)\n...\n$ASSIGN = '...'\n...\nend\n...\ndef $METHOD2(...)\n...\nend\n" - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN) - patterns: - pattern-inside: "$ASSIGN = '...'\n...\ndef $METHOD(...)\n $OPENSSL = OpenSSL::PKey::RSA.new(...)\n...\nend\n\ @@ -34493,90 +26037,54 @@ rules: - pattern: $OPENSSL.export(...,$ASSIGN) - pattern: $OPENSSL.to_pem(...,$ASSIGN) - patterns: - - pattern-inside: 'def $METHOD1(...) - - ... - - $OPENSSL = OpenSSL::PKey::RSA.new(...) - - ... - - $ASSIGN = ''...'' - - ... - - end - - ... - - ' + - pattern-inside: "def $METHOD1(...)\n...\n$OPENSSL = OpenSSL::PKey::RSA.new(...)\n...\n$ASSIGN = '...'\n...\nend\n\ + ...\n" - pattern-either: - pattern: $OPENSSL.export(...,$ASSIGN) - pattern: $OPENSSL.to_pem(...,$ASSIGN) - patterns: - - pattern-inside: 'def $METHOD1(...) - - ... - - $ASSIGN = ''...'' - - ... - - end - - ... - - def $METHOD2(...) - - ... - - $OPENSSL = OpenSSL::PKey::RSA.new(...) - - ... - - end - - ... - - ' + - pattern-inside: "def $METHOD1(...)\n...\n$ASSIGN = '...'\n...\nend\n...\ndef $METHOD2(...)\n...\n$OPENSSL = OpenSSL::PKey::RSA.new(...)\n\ + ...\nend\n...\n" - pattern-either: - pattern: $OPENSSL.export(...,$ASSIGN) - pattern: $OPENSSL.to_pem(...,$ASSIGN) + severity: WARNING - id: ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size - message: The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher. languages: - ruby - severity: WARNING + message: The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or + higher. metadata: - technology: - - ruby category: security - references: - - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size - shortlink: https://sg.run/O4Re + references: + - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf semgrep.dev: rule: + origin: community r_id: 20731 - rv_id: 1263608 rule_id: NbUe4N + rv_id: 1263608 + url: + https://semgrep.dev/playground/r/qkTR76v/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size version_id: qkTR76v - url: https://semgrep.dev/playground/r/qkTR76v/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size - origin: community + shortlink: https://sg.run/O4Re + source: https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size + subcategory: + - vuln + technology: + - ruby + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - pattern: OpenSSL::PKey::RSA.generate($SIZE,...) @@ -34584,133 +26092,107 @@ rules: - patterns: - pattern-either: - patterns: - - pattern-inside: '$ASSIGN = $SIZE - - ... - - ' + - pattern-inside: "$ASSIGN = $SIZE\n...\n" - pattern-either: - pattern: OpenSSL::PKey::RSA.new($ASSIGN, ...) - pattern: OpenSSL::PKey::RSA.generate($ASSIGN, ...) - patterns: - - pattern-inside: 'def $METHOD1(...) - - ... - - $ASSIGN = $SIZE - - ... - - end - - ... - - ' + - pattern-inside: "def $METHOD1(...)\n...\n$ASSIGN = $SIZE\n...\nend\n...\n" - pattern-either: - pattern: OpenSSL::PKey::RSA.new($ASSIGN, ...) - pattern: OpenSSL::PKey::RSA.generate($ASSIGN, ...) - metavariable-comparison: - metavariable: $SIZE comparison: $SIZE < 2048 + metavariable: $SIZE + severity: WARNING - id: ruby.lang.security.md5-used-as-password.md5-used-as-password languages: - ruby - severity: WARNING - message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked - by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use - the `bcrypt` gem. + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be + cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. + You can use the `bcrypt` gem. metadata: category: security - technology: - - md5 - references: - - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html - - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords - - https://github.com/returntocorp/semgrep-rules/issues/1609 - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - subcategory: - - vuln - likelihood: HIGH impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password - shortlink: https://sg.run/GOZy + likelihood: HIGH + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html + - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords + - https://github.com/returntocorp/semgrep-rules/issues/1609 semgrep.dev: rule: + origin: community r_id: 14704 - rv_id: 1263611 rule_id: oqU4p2 - version_id: JdTzx0e + rv_id: 1263611 url: https://semgrep.dev/playground/r/JdTzx0e/ruby.lang.security.md5-used-as-password.md5-used-as-password - origin: community + version_id: JdTzx0e + shortlink: https://sg.run/GOZy + source: https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password + subcategory: + - vuln + technology: + - md5 + vulnerability_class: + - Cryptographic Issues mode: taint - pattern-sources: - - pattern: Digest::MD5 pattern-sinks: - patterns: - pattern: $FUNCTION(...); - metavariable-regex: metavariable: $FUNCTION regex: (?i)(.*password.*) -- id: ruby.lang.security.no-eval.ruby-eval - message: Use of eval with user-controllable input detected. This can lead to attackers running arbitrary code. Ensure external - data does not reach here, otherwise this is a security vulnerability. Consider other ways to do this without eval. + pattern-sources: + - pattern: Digest::MD5 severity: WARNING +- id: ruby.lang.security.no-eval.ruby-eval + languages: + - ruby + message: Use of eval with user-controllable input detected. This can lead to attackers running arbitrary code. Ensure + external data does not reach here, otherwise this is a security vulnerability. Consider other ways to do this + without eval. metadata: - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM category: security - cwe2022-top25: true - cwe2021-top25: true + confidence: MEDIUM cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection + semgrep.dev: + rule: + origin: community + r_id: 9726 + rule_id: OrUGNk + rv_id: 1263615 + url: https://semgrep.dev/playground/r/A8TgdDv/ruby.lang.security.no-eval.ruby-eval + version_id: A8TgdDv + shortlink: https://sg.run/bDwZ + source: https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_evaluation.rb subcategory: - vuln technology: - ruby - rails - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection - source: https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval - shortlink: https://sg.run/bDwZ - semgrep.dev: - rule: - r_id: 9726 - rv_id: 1263615 - rule_id: OrUGNk - version_id: A8TgdDv - url: https://semgrep.dev/playground/r/A8TgdDv/ruby.lang.security.no-eval.ruby-eval - origin: community - languages: - - ruby mode: taint - pattern-sources: - - pattern-either: - - pattern: params - - pattern: cookies - - patterns: - - pattern: 'RubyVM::InstructionSequence.compile(...) - - ' - - pattern-not: 'RubyVM::InstructionSequence.compile("...") - - ' pattern-sinks: - patterns: - pattern-either: @@ -34727,82 +26209,90 @@ rules: - pattern: module_eval(...) - pattern: instance_eval(...) - pattern-not: $M("...",...) -- id: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify - pattern: OpenSSL::SSL::VERIFY_NONE - message: Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle - attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. - fix-regex: + pattern-sources: + - pattern-either: + - pattern: params + - pattern: cookies + - patterns: + - pattern: "RubyVM::InstructionSequence.compile(...)\n" + - pattern-not: "RubyVM::InstructionSequence.compile(\"...\")\n" + severity: WARNING +- fix-regex: regex: VERIFY_NONE replacement: VERIFY_PEER - severity: WARNING + id: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify languages: - ruby + message: Detected SSL that will accept an unverified connection. This makes the connections susceptible to + man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-295: Improper Certificate Validation' - category: security - technology: - - ruby + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify - shortlink: https://sg.run/kLxX semgrep.dev: rule: + origin: community r_id: 9728 - rv_id: 1263617 rule_id: v8U5Yn - version_id: DkTRbl4 + rv_id: 1263617 url: https://semgrep.dev/playground/r/DkTRbl4/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify - origin: community + version_id: DkTRbl4 + shortlink: https://sg.run/kLxX + source: https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify + subcategory: + - vuln + technology: + - ruby + vulnerability_class: + - Improper Authentication + pattern: OpenSSL::SSL::VERIFY_NONE + severity: WARNING - id: ruby.lang.security.weak-hashes-md5.weak-hashes-md5 - message: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could - also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. + languages: + - ruby + message: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. + Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions + instead. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-328: Use of Weak Hash' - references: - - https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575 - category: security - technology: - - ruby + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5 - shortlink: https://sg.run/O1re + references: + - https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575 semgrep.dev: rule: + origin: community r_id: 9731 - rv_id: 1263619 rule_id: nJUYxZ - version_id: 0bTKzN8 - url: https://semgrep.dev/playground/r/0bTKzN8/ruby.lang.security.weak-hashes-md5.weak-hashes-md5 - origin: community - languages: - - ruby - severity: WARNING + rv_id: 1263619 + url: https://semgrep.dev/playground/r/0bTKzN8/ruby.lang.security.weak-hashes-md5.weak-hashes-md5 + version_id: 0bTKzN8 + shortlink: https://sg.run/O1re + source: https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5 + subcategory: + - vuln + technology: + - ruby + vulnerability_class: + - Insecure Hashing Algorithm pattern-either: - pattern: Digest::MD5.base64digest $X - pattern: Digest::MD5.hexdigest $X @@ -34812,149 +26302,138 @@ rules: - pattern: OpenSSL::Digest::MD5.hexdigest $X - pattern: OpenSSL::Digest::MD5.digest $X - pattern: OpenSSL::Digest::MD5.new + severity: WARNING - id: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1 - message: Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. - Use SHA256, SHA3 or other hashing functions instead. + languages: + - ruby + message: Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to + vulnerabilities. Use SHA256, SHA3 or other hashing functions instead. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-328: Use of Weak Hash' - references: - - https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html - - https://shattered.io/ - category: security - technology: - - ruby + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1 - shortlink: https://sg.run/e4qX + references: + - https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html + - https://shattered.io/ semgrep.dev: rule: + origin: community r_id: 9732 - rv_id: 1263620 rule_id: EwU4jq - version_id: K3TKkEZ + rv_id: 1263620 url: https://semgrep.dev/playground/r/K3TKkEZ/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1 - origin: community - languages: - - ruby - severity: WARNING + version_id: K3TKkEZ + shortlink: https://sg.run/e4qX + source: https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1 + subcategory: + - vuln + technology: + - ruby + vulnerability_class: + - Insecure Hashing Algorithm pattern-either: - pattern: Digest::SHA1.$FUNC - pattern: OpenSSL::Digest::SHA1.$FUNC - pattern: OpenSSL::HMAC.$FUNC("sha1",...) + severity: WARNING - id: ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation + languages: + - ruby + message: This gets data from session using user inputs. A malicious user may be able to retrieve information from your + session that you didn't intend them to. Do not use user input as a session key. metadata: - shortDescription: Allowing an attacker to manipulate the session may lead to unintended behavior. - tags: - - security - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control + category: security + confidence: MEDIUM cwe: - 'CWE-276: Incorrect Default Permissions' - references: - - https://brakemanscanner.org/docs/warning_types/session_manipulation/ - category: security - technology: - - rails - help: '## Remediation - - Session manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered - a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the - session may lead to unintended behavior. - - - ## References - - [Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/) - - ' - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true + help: "## Remediation\nSession manipulation can occur when an application allows user-input in session keys. Since sessions + are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker + to manipulate the session may lead to unintended behavior.\n\n## References\n[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n" impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation - shortlink: https://sg.run/86q7 + likelihood: MEDIUM + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://brakemanscanner.org/docs/warning_types/session_manipulation/ semgrep.dev: rule: + origin: community r_id: 13584 - rv_id: 1263621 rule_id: BYUdW6 + rv_id: 1263621 + url: + https://semgrep.dev/playground/r/qkTR76G/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation version_id: qkTR76G - url: https://semgrep.dev/playground/r/qkTR76G/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation - origin: community - message: This gets data from session using user inputs. A malicious user may be able to retrieve information from your session - that you didn't intend them to. Do not use user input as a session key. - languages: - - ruby - severity: WARNING + shortDescription: Allowing an attacker to manipulate the session may lead to unintended behavior. + shortlink: https://sg.run/86q7 + source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation + subcategory: + - vuln + tags: + - security + technology: + - rails + vulnerability_class: + - Improper Authorization mode: taint + pattern-sinks: + - pattern: session[...] pattern-sources: - pattern: params - pattern: cookies - pattern: request.env - pattern-sinks: - - pattern: session[...] + severity: WARNING - id: ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access + languages: + - ruby + message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or + access files they have no right to. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' references: - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown - category: security - technology: - - rails - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access - shortlink: https://sg.run/gYln semgrep.dev: rule: + origin: community r_id: 13585 - rv_id: 1263622 rule_id: DbU1dr + rv_id: 1263622 + url: + https://semgrep.dev/playground/r/l4TJRkk/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access version_id: l4TJRkk - url: https://semgrep.dev/playground/r/l4TJRkk/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access - origin: community - message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access - files they have no right to. - languages: - - ruby - severity: WARNING + shortlink: https://sg.run/gYln + source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access + subcategory: + - vuln + technology: + - rails + vulnerability_class: + - Path Traversal mode: taint - pattern-sources: - - pattern: params - - pattern: cookies - - pattern: request.env pattern-sinks: - patterns: - pattern-either: @@ -34994,103 +26473,99 @@ rules: - pattern: sysopen - pattern: truncate - pattern: unlink + pattern-sources: + - pattern: params + - pattern: cookies + - pattern: request.env + severity: WARNING - id: ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call + languages: + - ruby + message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or + access files they have no right to. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' references: - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown - category: security - technology: - - rails - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call - shortlink: https://sg.run/Q9gP semgrep.dev: rule: + origin: community r_id: 13586 - rv_id: 1263623 rule_id: WAUyzp + rv_id: 1263623 + url: + https://semgrep.dev/playground/r/YDTZeWL/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call version_id: YDTZeWL - url: https://semgrep.dev/playground/r/YDTZeWL/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call - origin: community - message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access - files they have no right to. - languages: - - ruby - severity: WARNING + shortlink: https://sg.run/Q9gP + source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call + subcategory: + - vuln + technology: + - rails + vulnerability_class: + - Path Traversal mode: taint - pattern-sources: - - pattern: params - - pattern: cookies - - pattern: request.env pattern-sinks: - pattern-either: - pattern: Net::FTP.$X(...) - patterns: - - pattern-inside: '$FTP = Net::FTP.$OPEN(...) - - ... - - $FTP.$METHOD(...) - - ' + - pattern-inside: "$FTP = Net::FTP.$OPEN(...)\n...\n$FTP.$METHOD(...)\n" - pattern: $FTP.$METHOD(...) + pattern-sources: + - pattern: params + - pattern: cookies + - pattern: request.env + severity: WARNING - id: ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request + languages: + - ruby + message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or + access files they have no right to. metadata: - owasp: - - A10:2021 - Server-Side Request Forgery (SSRF) - - A01:2025 - Broken Access Control + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' - references: - - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown - category: security - technology: - - rails - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln + cwe2022-top25: true impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request - shortlink: https://sg.run/3rLb + likelihood: MEDIUM + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown semgrep.dev: rule: + origin: community r_id: 13587 - rv_id: 1263624 rule_id: 0oU2x3 + rv_id: 1263624 + url: + https://semgrep.dev/playground/r/6xT29nN/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request version_id: 6xT29nN - url: https://semgrep.dev/playground/r/6xT29nN/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request - origin: community - message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access - files they have no right to. - languages: - - ruby - severity: WARNING - mode: taint - pattern-sources: - - pattern: params - - pattern: cookies - - pattern: request.env + shortlink: https://sg.run/3rLb + source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request + subcategory: + - vuln + technology: + - rails + vulnerability_class: + - Server-Side Request Forgery (SSRF) + mode: taint pattern-sinks: - pattern-either: - patterns: @@ -35139,50 +26614,50 @@ rules: - pattern: get_print - pattern: get_response - pattern: start + pattern-sources: + - pattern: params + - pattern: cookies + - pattern: request.env + severity: WARNING - id: ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call + languages: + - ruby + message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or + access files they have no right to. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' references: - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown - category: security - technology: - - rails - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call - shortlink: https://sg.run/4e8E semgrep.dev: rule: + origin: community r_id: 13588 - rv_id: 1263625 rule_id: KxU72k + rv_id: 1263625 + url: + https://semgrep.dev/playground/r/o5TbDq8/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call version_id: o5TbDq8 - url: https://semgrep.dev/playground/r/o5TbDq8/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call - origin: community - message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access - files they have no right to. - languages: - - ruby - severity: ERROR + shortlink: https://sg.run/4e8E + source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call + subcategory: + - vuln + technology: + - rails + vulnerability_class: + - Command Injection mode: taint - pattern-sources: - - pattern-either: - - pattern: params[...] - - pattern: cookies - - pattern: request.env pattern-sinks: - patterns: - pattern-either: @@ -35192,13 +26667,7 @@ rules: - pattern-either: - pattern: Shell.$X(...) - patterns: - - pattern-inside: '$SHELL = Shell.$ANY(...) - - ... - - $SHELL.$X(...) - - ' + - pattern-inside: "$SHELL = Shell.$ANY(...)\n...\n$SHELL.$X(...)\n" - pattern: $SHELL.$X(...) - metavariable-pattern: metavariable: $X @@ -35233,130 +26702,122 @@ rules: - pattern: system - pattern: truncate - pattern: unlink -- id: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli - mode: taint - pattern-propagators: - - pattern: $X << $Y - from: $Y - to: $X pattern-sources: - pattern-either: - - pattern: 'params - - ' - - pattern: 'cookies - - ' - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '$CON = PG.connect(...) - - ... - - ' - - pattern-inside: '$CON = PG::Connection.open(...) - - ... - - ' - - pattern-inside: '$CON = PG::Connection.new(...) - - ... - - ' - - pattern-either: - - pattern: '$CON.$METHOD($X,...) - - ' - - pattern: '$CON.$METHOD $X, ... - - ' - - focus-metavariable: $X - - metavariable-regex: - metavariable: $METHOD - regex: ^(exec|exec_params)$ + - pattern: params[...] + - pattern: cookies + - pattern: request.env + severity: ERROR +- id: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli languages: - ruby - message: 'Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection + message: "Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries - or prepared statements instead. You can use parameterized queries like so: `conn.exec_params(''SELECT $1 AS a, $2 AS b, - $3 AS c'', [1, 2, nil])` And you can use prepared statements with `exec_prepared`.' + or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, + $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`." metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://www.rubydoc.info/gems/pg/PG/Connection - category: security - technology: - - rails - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli - shortlink: https://sg.run/kL0o semgrep.dev: rule: + origin: community r_id: 10328 - rv_id: 1263628 rule_id: NbUAz7 - version_id: 2KTv2y2 + rv_id: 1263628 url: https://semgrep.dev/playground/r/2KTv2y2/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli - origin: community + version_id: 2KTv2y2 + shortlink: https://sg.run/kL0o + source: https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli + subcategory: + - vuln + technology: + - rails + vulnerability_class: + - SQL Injection + mode: taint + pattern-propagators: + - from: $Y + pattern: $X << $Y + to: $X + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "$CON = PG.connect(...)\n...\n" + - pattern-inside: "$CON = PG::Connection.open(...)\n...\n" + - pattern-inside: "$CON = PG::Connection.new(...)\n...\n" + - pattern-either: + - pattern: "$CON.$METHOD($X,...)\n" + - pattern: "$CON.$METHOD $X, ...\n" + - focus-metavariable: $X + - metavariable-regex: + metavariable: $METHOD + regex: ^(exec|exec_params)$ + pattern-sources: + - pattern-either: + - pattern: "params\n" + - pattern: "cookies\n" severity: WARNING - id: ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to + languages: + - ruby + message: This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means + that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values + starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks + the body argument. metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_link_to.rb + category: security + confidence: MEDIUM + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' references: - https://brakemanscanner.org/docs/warning_types/link_to/ - https://brakemanscanner.org/docs/warning_types/link_to_href/ - category: security - technology: - - rails - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to - shortlink: https://sg.run/JxXQ semgrep.dev: rule: + origin: community r_id: 13590 - rv_id: 1263632 rule_id: lBU8Qj - version_id: 9lT4brj + rv_id: 1263632 url: https://semgrep.dev/playground/r/9lT4brj/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to - origin: community - message: This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that - user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting - with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument. - languages: - - ruby - severity: WARNING + version_id: 9lT4brj + shortlink: https://sg.run/JxXQ + source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_link_to.rb + subcategory: + - vuln + technology: + - rails + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint + pattern-sanitizers: + - patterns: + - pattern: "\"...#{...}...\"\n" + - pattern-not: "\"#{...}...\"\n" + pattern-sinks: + - pattern: link_to(...) pattern-sources: - pattern: params - pattern: cookies @@ -35367,52 +26828,47 @@ rules: - pattern: $MODEL.link(...) - pattern: $MODEL.page(...) - pattern: $MODEL.site(...) - pattern-sinks: - - pattern: link_to(...) - pattern-sanitizers: - - patterns: - - pattern: '"...#{...}..." - - ' - - pattern-not: '"#{...}..." - - ' + severity: WARNING - id: ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect + languages: + - ruby + message: When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access + restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' references: - https://brakemanscanner.org/docs/warning_types/redirect/ - category: security - technology: - - rails - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect - shortlink: https://sg.run/5DY3 semgrep.dev: rule: + origin: community r_id: 13591 - rv_id: 1263634 rule_id: YGUDqJ - version_id: rxTAKdY + rv_id: 1263634 url: https://semgrep.dev/playground/r/rxTAKdY/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect - origin: community - message: When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted - parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. - languages: - - ruby - severity: WARNING + version_id: rxTAKdY + shortlink: https://sg.run/5DY3 + source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect + subcategory: + - vuln + technology: + - rails + vulnerability_class: + - Open Redirect mode: taint + pattern-sanitizers: + - pattern: params.merge(:only_path => true) + - pattern: params.merge(:host => ...) + pattern-sinks: + - pattern: redirect_to(...) pattern-sources: - pattern: params - pattern: cookies @@ -35443,55 +26899,47 @@ rules: - pattern: find_by - pattern: find_by! - pattern: take - pattern-sinks: - - pattern: redirect_to(...) - pattern-sanitizers: - - pattern: params.merge(:only_path => true) - - pattern: params.merge(:host => ...) + severity: WARNING - id: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path + languages: + - ruby + message: Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a + template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure + it's an allowed template. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' references: - https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/ - category: security - technology: - - rails - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path - shortlink: https://sg.run/GO2n semgrep.dev: rule: + origin: community r_id: 13592 - rv_id: 1263635 rule_id: 6JU1bL - version_id: bZT53p0 - url: https://semgrep.dev/playground/r/bZT53p0/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path - origin: community - message: Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template - they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed - template. - languages: - - ruby - severity: WARNING + rv_id: 1263635 + url: + https://semgrep.dev/playground/r/bZT53p0/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path + version_id: bZT53p0 + shortlink: https://sg.run/GO2n + source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path + subcategory: + - vuln + technology: + - rails + vulnerability_class: + - Path Traversal mode: taint - pattern-sources: - - pattern: params - - pattern: cookies - - pattern: request.env pattern-sinks: - patterns: - pattern-inside: render($X => $INPUT, ...) @@ -35503,258 +26951,261 @@ rules: - pattern: template - pattern: partial - pattern: file + pattern-sources: + - pattern: params + - pattern: cookies + - pattern: request.env + severity: WARNING - id: ruby.rails.security.brakeman.check-before-filter.check-before-filter - mode: search - patterns: - - pattern-either: - - pattern: 'skip_filter ..., :except => $ARGS - - ' - - pattern: 'skip_before_filter ..., :except => $ARGS - - ' - - pattern: 'skip_before_action ..., :except => $ARGS - - ' - message: 'Disabled-by-default Rails controller checks make it much easier to introduce access control mistakes. Prefer an - allowlist approach with `:only => [...]` rather than `except: => [...]`' languages: - ruby - severity: ERROR + message: 'Disabled-by-default Rails controller checks make it much easier to introduce access control mistakes. Prefer an + allowlist approach with `:only => [...]` rather than `except: => [...]`' metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_skip_before_filter.rb category: security + confidence: MEDIUM cwe: - 'CWE-284: Improper Access Control' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - technology: - - ruby - - rails references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-before-filter.check-before-filter - shortlink: https://sg.run/O4Zn semgrep.dev: rule: + origin: community r_id: 20531 - rv_id: 1263649 rule_id: wdUkBP + rv_id: 1263649 + url: + https://semgrep.dev/playground/r/8KT5rDy/ruby.rails.security.brakeman.check-before-filter.check-before-filter version_id: 8KT5rDy - url: https://semgrep.dev/playground/r/8KT5rDy/ruby.rails.security.brakeman.check-before-filter.check-before-filter - origin: community -- id: ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include + shortlink: https://sg.run/O4Zn + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-before-filter.check-before-filter + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_skip_before_filter.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - Improper Authorization mode: search - paths: - include: - - '*.erb' patterns: - - pattern: 'params[...] - - ' - - pattern-inside: 'render :file => ... - - ' - message: Found request parameters in a call to `render` in a dynamic context. This can allow end users to request arbitrary - local files which may result in leaking sensitive information persisted on disk. + - pattern-either: + - pattern: "skip_filter ..., :except => $ARGS\n" + - pattern: "skip_before_filter ..., :except => $ARGS\n" + - pattern: "skip_before_action ..., :except => $ARGS\n" + severity: ERROR +- id: ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include languages: - generic - severity: WARNING + message: Found request parameters in a call to `render` in a dynamic context. This can allow end users to request + arbitrary local files which may result in leaking sensitive information persisted on disk. metadata: - technology: - - ruby - - rails category: security + confidence: MEDIUM cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb references: - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion - https://github.com/presidentbeef/brakeman/blob/f74cb53ead47f0af821d98b5b41e16d63100c240/test/apps/rails2/app/views/home/test_render.html.erb - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include - shortlink: https://sg.run/3QWl semgrep.dev: rule: + origin: community r_id: 20043 - rv_id: 1263651 rule_id: JDUokO + rv_id: 1263651 + url: + https://semgrep.dev/playground/r/QkTGq9X/ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include version_id: QkTGq9X - url: https://semgrep.dev/playground/r/QkTGq9X/ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include - origin: community -- id: ruby.rails.security.brakeman.check-http-verb-confusion.check-http-verb-confusion + shortlink: https://sg.run/3QWl + source: + https://semgrep.dev/r/ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - Path Traversal mode: search + paths: + include: + - '*.erb' patterns: - - pattern: "if request.get?\n ...\nelse\n ...\nend\n" - - pattern-not-inside: "if ...\nelsif ...\n ...\nend\n" - message: Found an improperly constructed control flow block with `request.get?`. Rails will route HEAD requests as GET requests - but they will fail the `request.get?` check, potentially causing unexpected behavior unless an `elif` condition is used. + - pattern: "params[...]\n" + - pattern-inside: "render :file => ...\n" + severity: WARNING +- id: ruby.rails.security.brakeman.check-http-verb-confusion.check-http-verb-confusion languages: - ruby - severity: ERROR + message: Found an improperly constructed control flow block with `request.get?`. Rails will route HEAD requests as GET + requests but they will fail the `request.get?` check, potentially causing unexpected behavior unless an `elif` + condition is used. metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_verb_confusion.rb category: security + confidence: MEDIUM cwe: - 'CWE-650: Trusting HTTP Permission Methods on the Server Side' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design - technology: - - ruby - - rails references: - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/accounts_controller.rb - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-http-verb-confusion.check-http-verb-confusion - shortlink: https://sg.run/eJ6y semgrep.dev: rule: + origin: community r_id: 20532 - rv_id: 1263652 rule_id: x8UdDE + rv_id: 1263652 + url: + https://semgrep.dev/playground/r/3ZT4X82/ruby.rails.security.brakeman.check-http-verb-confusion.check-http-verb-confusion version_id: 3ZT4X82 - url: https://semgrep.dev/playground/r/3ZT4X82/ruby.rails.security.brakeman.check-http-verb-confusion.check-http-verb-confusion - origin: community -- id: ruby.rails.security.brakeman.check-rails-session-secret-handling.check-rails-session-secret-handling + shortlink: https://sg.run/eJ6y + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-http-verb-confusion.check-http-verb-confusion + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_verb_confusion.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - Other + mode: search patterns: - - pattern-either: - - patterns: - - pattern: ':$KEY => "$LITERAL" - - ' - - pattern-inside: 'ActionController::Base.session = {...} - - ' - - pattern: '$RAILS::Application.config.$KEY = "$LITERAL" - - ' - - pattern: 'Rails.application.config.$KEY = "$LITERAL" - - ' - - metavariable-regex: - metavariable: $KEY - regex: ^secret(_(token|key_base))?$ - message: Found a string literal assignment to a Rails session secret `$KEY`. Do not commit secret values to source control! - Any user in possession of this value may falsify arbitrary session data in your application. Read this value from an environment - variable, KMS, or file on disk outside of source control. + - pattern: "if request.get?\n ...\nelse\n ...\nend\n" + - pattern-not-inside: "if ...\nelsif ...\n ...\nend\n" + severity: ERROR +- id: ruby.rails.security.brakeman.check-rails-session-secret-handling.check-rails-session-secret-handling languages: - ruby - severity: WARNING + message: Found a string literal assignment to a Rails session secret `$KEY`. Do not commit secret values to source + control! Any user in possession of this value may falsify arbitrary session data in your application. Read this + value from an environment variable, KMS, or file on disk outside of source control. metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_session_settings.rb category: security + confidence: MEDIUM cwe: - 'CWE-540: Inclusion of Sensitive Information in Source Code' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - technology: - - ruby - - rails references: - https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails4_with_engines/config/initializers/secret_token.rb - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3/config/initializers/secret_token.rb + semgrep.dev: + rule: + origin: community + r_id: 20155 + rule_id: lBUX1r + rv_id: 1263656 + url: + https://semgrep.dev/playground/r/5PTo1ZY/ruby.rails.security.brakeman.check-rails-session-secret-handling.check-rails-session-secret-handling + version_id: 5PTo1ZY + shortlink: https://sg.run/KyJd + source: + https://semgrep.dev/r/ruby.rails.security.brakeman.check-rails-session-secret-handling.check-rails-session-secret-handling + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_session_settings.rb subcategory: - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - ruby + - rails vulnerability_class: - Mishandled Sensitive Information - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-rails-session-secret-handling.check-rails-session-secret-handling - shortlink: https://sg.run/KyJd + patterns: + - pattern-either: + - patterns: + - pattern: ":$KEY => \"$LITERAL\"\n" + - pattern-inside: "ActionController::Base.session = {...}\n" + - pattern: "$RAILS::Application.config.$KEY = \"$LITERAL\"\n" + - pattern: "Rails.application.config.$KEY = \"$LITERAL\"\n" + - metavariable-regex: + metavariable: $KEY + regex: ^secret(_(token|key_base))?$ + severity: WARNING +- id: ruby.rails.security.brakeman.check-redirect-to.check-redirect-to + languages: + - ruby + message: Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the + `:only_path => true` hash value. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html semgrep.dev: rule: - r_id: 20155 - rv_id: 1263656 - rule_id: lBUX1r - version_id: 5PTo1ZY - url: https://semgrep.dev/playground/r/5PTo1ZY/ruby.rails.security.brakeman.check-rails-session-secret-handling.check-rails-session-secret-handling origin: community -- id: ruby.rails.security.brakeman.check-redirect-to.check-redirect-to + r_id: 20732 + rule_id: kxUOJ6 + rv_id: 1263657 + url: https://semgrep.dev/playground/r/GxTke14/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to + version_id: GxTke14 + shortlink: https://sg.run/eJNX + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_redirect.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - Open Redirect mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: params - - pattern: cookies - - pattern: request.env - - pattern: url_for(params[...],...,:only_path => false,...) pattern-sanitizers: - patterns: - pattern-either: - patterns: - - pattern: '$F(...) - - ' + - pattern: "$F(...)\n" - metavariable-pattern: metavariable: $F patterns: - pattern-not-regex: (params|url_for|cookies|request.env|permit|redirect_to) - - pattern: 'params.merge! :only_path => true - - ... - - ' - - pattern: 'params.slice(...) - - ... - - ' - - pattern: 'redirect_to [...] - - ' + - pattern: "params.merge! :only_path => true\n...\n" + - pattern: "params.slice(...)\n...\n" + - pattern: "redirect_to [...]\n" - patterns: - - pattern: '$MODEL. ... .$M(...) - - ... - - ' + - pattern: "$MODEL. ... .$M(...)\n...\n" - metavariable-regex: metavariable: $MODEL regex: '[A-Z]\w+' - metavariable-regex: metavariable: $M - regex: (all|create|find|find_by|find_by_sql|first|last|new|from|group|having|joins|lock|order|reorder|select|where|take) + regex: + (all|create|find|find_by|find_by_sql|first|last|new|from|group|having|joins|lock|order|reorder|select|where|take) - patterns: - - pattern: 'params.$UNSAFE_HASH.merge(...,:only_path => true,...) - - ... - - ' + - pattern: "params.$UNSAFE_HASH.merge(...,:only_path => true,...)\n...\n" - metavariable-regex: metavariable: $UNSAFE_HASH regex: to_unsafe_h(ash)? @@ -35767,153 +27218,129 @@ rules: pattern-sinks: - patterns: - pattern: $X - - pattern-inside: 'redirect_to $X, ... - - ' + - pattern-inside: "redirect_to $X, ...\n" - pattern-not-regex: params\.\w+(? true` hash value. + pattern-sources: + - patterns: + - pattern-either: + - pattern: params + - pattern: cookies + - pattern: request.env + - pattern: url_for(params[...],...,:only_path => false,...) + severity: WARNING +- id: ruby.rails.security.brakeman.check-regex-dos.check-regex-dos languages: - ruby - severity: WARNING + message: Found a potentially user-controllable argument in the construction of a regular expressions. This may result + in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match + target. Avoid allowing users to specify regular expressions processed by the server. If you must support + user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to + limit catastrophic backtracking. metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_redirect.rb category: security + confidence: MEDIUM cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + - 'CWE-1333: Inefficient Regular Expression Complexity' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A03:2017 - Sensitive Data Exposure + references: + - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS + semgrep.dev: + rule: + origin: community + r_id: 20156 + rule_id: YGUY4R + rv_id: 1409406 + url: https://semgrep.dev/playground/r/0bTG0WO/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos + version_id: 0bTG0WO + shortlink: https://sg.run/qZwx + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_regex_dos.rb + subcategory: + - vuln technology: - ruby - rails - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to - shortlink: https://sg.run/eJNX - semgrep.dev: - rule: - r_id: 20732 - rv_id: 1263657 - rule_id: kxUOJ6 - version_id: GxTke14 - url: https://semgrep.dev/playground/r/GxTke14/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to - origin: community -- id: ruby.rails.security.brakeman.check-regex-dos.check-regex-dos + - Denial-of-Service (DoS) mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: $Y + - pattern-inside: "/...#{...}.../\n" + - patterns: + - pattern: $Y + - pattern-inside: "Regexp.new(...)\n" pattern-sources: - patterns: - pattern-either: - - pattern: 'cookies[...] - - ' + - pattern: "cookies[...]\n" - patterns: - - pattern: 'cookies. ... .$PROPERTY[...] - - ' + - pattern: "cookies. ... .$PROPERTY[...]\n" - metavariable-regex: metavariable: $PROPERTY regex: (?!signed|encrypted) - - pattern: 'params[...] - - ' - - pattern: 'request.env[...] - - ' + - pattern: "params[...]\n" + - pattern: "request.env[...]\n" - patterns: - pattern: $Y - pattern-either: - - pattern-inside: '$RECORD.read_attribute($Y) - - ' - - pattern-inside: '$RECORD[$Y] - - ' + - pattern-inside: "$RECORD.read_attribute($Y)\n" + - pattern-inside: "$RECORD[$Y]\n" - metavariable-regex: metavariable: $RECORD regex: '[A-Z][a-z]+' - pattern-sinks: - - patterns: - - pattern-either: - - patterns: - - pattern: $Y - - pattern-inside: '/...#{...}.../ - - ' - - patterns: - - pattern: $Y - - pattern-inside: 'Regexp.new(...) - - ' - message: Found a potentially user-controllable argument in the construction of a regular expressions. This may result in - excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. - Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input - in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking. + severity: ERROR +- id: ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include languages: - ruby - severity: ERROR + message: Found request parameters in a call to `render`. This can allow end users to request arbitrary local files + which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify + template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the + user-supplied value with `File.basename(...)`. metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_regex_dos.rb category: security + confidence: MEDIUM cwe: - - 'CWE-1333: Inefficient Regular Expression Complexity' + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - - A03:2017 - Sensitive Data Exposure - technology: - - ruby - - rails + - A05:2017 - Broken Access Control + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control references: - - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Denial-of-Service (DoS) - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos - shortlink: https://sg.run/qZwx + - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion + - https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60 semgrep.dev: rule: - r_id: 20156 - rv_id: 1409406 - rule_id: YGUY4R - version_id: 0bTG0WO - url: https://semgrep.dev/playground/r/0bTG0WO/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos origin: community -- id: ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include + r_id: 20046 + rule_id: ReU2pZ + rv_id: 1409407 + url: + https://semgrep.dev/playground/r/K3TgANN/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include + version_id: K3TgANN + shortlink: https://sg.run/Jw8Z + source: + https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - Path Traversal mode: taint - pattern-sources: - - patterns: - - pattern: params[...] - pattern-sinks: - - patterns: - - pattern-either: - - pattern: 'render ..., file: $X - - ' - - pattern: 'render ..., inline: $X - - ' - - pattern: 'render ..., template: $X - - ' - - pattern: 'render ..., action: $X - - ' - - pattern: 'render $X, ... - - ' - - focus-metavariable: $X pattern-sanitizers: - patterns: - pattern: $MAP[...] @@ -35922,49 +27349,57 @@ rules: patterns: - pattern-not-regex: params - pattern: File.basename(...) - message: Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which - may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths - for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value - with `File.basename(...)`. + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "render ..., file: $X\n" + - pattern: "render ..., inline: $X\n" + - pattern: "render ..., template: $X\n" + - pattern: "render ..., action: $X\n" + - pattern: "render $X, ...\n" + - focus-metavariable: $X + pattern-sources: + - patterns: + - pattern: params[...] + severity: WARNING +- id: ruby.rails.security.brakeman.check-secrets.check-secrets languages: - ruby - severity: WARNING + message: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a + non-empty string literal value. metadata: - technology: - - ruby - - rails category: security + confidence: MEDIUM cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb references: - - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion - - https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60 - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - vulnerability_class: - - Path Traversal - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include - shortlink: https://sg.run/Jw8Z + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html + - https://github.com/presidentbeef/brakeman/blob/3f5d5d5f00864cdf7769c50f5bd26f1769a4ba75/test/apps/rails3.1/app/controllers/users_controller.rb semgrep.dev: rule: - r_id: 20046 - rv_id: 1409407 - rule_id: ReU2pZ - version_id: K3TgANN - url: https://semgrep.dev/playground/r/K3TgANN/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include origin: community -- id: ruby.rails.security.brakeman.check-secrets.check-secrets + r_id: 20047 + rule_id: AbUNqO + rv_id: 1263659 + url: https://semgrep.dev/playground/r/A8TgdBv/ruby.rails.security.brakeman.check-secrets.check-secrets + version_id: A8TgdBv + shortlink: https://sg.run/5ZKl + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-secrets.check-secrets + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_secrets.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - Mishandled Sensitive Information patterns: - pattern: $VAR = "$VALUE" - metavariable-regex: @@ -35973,733 +27408,623 @@ rules: - metavariable-regex: metavariable: $VALUE regex: .+ - message: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty - string literal value. + severity: WARNING +- id: ruby.rails.security.brakeman.check-send-file.check-send-file languages: - ruby - severity: WARNING + message: Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the + server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)` metadata: - technology: - - ruby - - rails category: security + confidence: MEDIUM cwe: - - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_secrets.rb - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - - https://github.com/presidentbeef/brakeman/blob/3f5d5d5f00864cdf7769c50f5bd26f1769a4ba75/test/apps/rails3.1/app/controllers/users_controller.rb - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + - 'CWE-73: External Control of File Name or Path' impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-secrets.check-secrets - shortlink: https://sg.run/5ZKl + likelihood: MEDIUM + owasp: + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + references: + - https://owasp.org/www-community/attacks/Path_Traversal + - https://owasp.org/Top10/A01_2021-Broken_Access_Control/ semgrep.dev: rule: - r_id: 20047 - rv_id: 1263659 - rule_id: AbUNqO - version_id: A8TgdBv - url: https://semgrep.dev/playground/r/A8TgdBv/ruby.rails.security.brakeman.check-secrets.check-secrets origin: community -- id: ruby.rails.security.brakeman.check-send-file.check-send-file + r_id: 20048 + rule_id: BYUKbl + rv_id: 1263660 + url: https://semgrep.dev/playground/r/BjTkZRj/ruby.rails.security.brakeman.check-send-file.check-send-file + version_id: BjTkZRj + shortlink: https://sg.run/GbY1 + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send_file.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - Path Traversal mode: taint + pattern-sinks: + - patterns: + - pattern: "send_file ...\n" pattern-sources: - pattern-either: - - pattern: 'cookies[...] - - ' + - pattern: "cookies[...]\n" - patterns: - - pattern: 'cookies. ... .$PROPERTY[...] - - ' + - pattern: "cookies. ... .$PROPERTY[...]\n" - metavariable-regex: metavariable: $PROPERTY regex: (?!signed|encrypted) - - pattern: 'params[...] - - ' - - pattern: 'request.env[...] - - ' - pattern-sinks: - - patterns: - - pattern: 'send_file ... - - ' - message: Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. - Avoid accepting user input in `send_file` or normalize with `File.basename(...)` + - pattern: "params[...]\n" + - pattern: "request.env[...]\n" + severity: ERROR +- id: ruby.rails.security.brakeman.check-sql.check-sql languages: - ruby - severity: ERROR + message: Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer + parameterized queries. metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send_file.rb category: security + confidence: MEDIUM cwe: - - 'CWE-73: External Control of File Name or Path' - owasp: - - A04:2021 - Insecure Design - - A06:2025 - Insecure Design - technology: - - ruby - - rails - references: - - https://owasp.org/www-community/attacks/Path_Traversal - - https://owasp.org/Top10/A01_2021-Broken_Access_Control/ - subcategory: - - vuln - likelihood: MEDIUM + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file - shortlink: https://sg.run/GbY1 + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/SQL_Injection + - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb semgrep.dev: rule: - r_id: 20048 - rv_id: 1263660 - rule_id: BYUKbl - version_id: BjTkZRj - url: https://semgrep.dev/playground/r/BjTkZRj/ruby.rails.security.brakeman.check-send-file.check-send-file origin: community -- id: ruby.rails.security.brakeman.check-sql.check-sql + r_id: 20533 + rule_id: OrUv2z + rv_id: 1263661 + url: https://semgrep.dev/playground/r/DkTRbE4/ruby.rails.security.brakeman.check-sql.check-sql + version_id: DkTRbE4 + shortlink: https://sg.run/vpgb + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_sql.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - pattern-either: - - pattern: 'cookies[...] - - ' - - patterns: - - pattern: 'cookies. ... .$PROPERTY[...] - - ' - - metavariable-regex: - metavariable: $PROPERTY - regex: (?!signed|encrypted) - - pattern: 'params[...] - - ' - - pattern: 'request.env[...] - - ' pattern-sanitizers: - patterns: - pattern-either: - patterns: - pattern: $X - pattern-either: - - pattern-inside: ':$KEY => $X - - ' - - pattern-inside: '["...",$X,...] - - ' - - pattern: 'params[...].to_i - - ' - - pattern: 'params[...].to_f - - ' + - pattern-inside: ":$KEY => $X\n" + - pattern-inside: "[\"...\",$X,...]\n" + - pattern: "params[...].to_i\n" + - pattern: "params[...].to_f\n" - patterns: - - pattern: 'params[...] ? $A : $B - - ' + - pattern: "params[...] ? $A : $B\n" - metavariable-pattern: metavariable: $A patterns: - - pattern-not: 'params[...] - - ' + - pattern-not: "params[...]\n" - metavariable-pattern: metavariable: $B patterns: - - pattern-not: 'params[...] - - ' + - pattern-not: "params[...]\n" pattern-sinks: - patterns: - pattern: $X - - pattern-not-inside: '$P.where("...",...) - - ' - - pattern-not-inside: '$P.where(:$KEY => $VAL,...) - - ' - - pattern-either: - - pattern-inside: '$P.$M(...) - - ' - - pattern-inside: '$P.$M("...",...) - - ' + - pattern-not-inside: "$P.where(\"...\",...)\n" + - pattern-not-inside: "$P.where(:$KEY => $VAL,...)\n" + - pattern-either: + - pattern-inside: "$P.$M(...)\n" + - pattern-inside: "$P.$M(\"...\",...)\n" - pattern-inside: "class $P < ActiveRecord::Base\n ...\nend\n" - metavariable-regex: metavariable: $M regex: (where|find|first|last|select|minimum|maximum|calculate|sum|average) - message: Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized - queries. + pattern-sources: + - pattern-either: + - pattern: "cookies[...]\n" + - patterns: + - pattern: "cookies. ... .$PROPERTY[...]\n" + - metavariable-regex: + metavariable: $PROPERTY + regex: (?!signed|encrypted) + - pattern: "params[...]\n" + - pattern: "request.env[...]\n" + severity: ERROR +- id: ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods languages: - ruby - severity: ERROR + message: Found user-controllable input to a reflection method. This may allow a user to alter program behavior and + potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to + `tap`, `method`, or `to_proc` metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_sql.rb category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - technology: - - ruby - - rails references: - - https://owasp.org/www-community/attacks/SQL_Injection - - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql - shortlink: https://sg.run/vpgb + - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb semgrep.dev: rule: - r_id: 20533 - rv_id: 1263661 - rule_id: OrUv2z - version_id: DkTRbE4 - url: https://semgrep.dev/playground/r/DkTRbE4/ruby.rails.security.brakeman.check-sql.check-sql origin: community -- id: ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods + r_id: 20534 + rule_id: eqUZ2Q + rv_id: 1263662 + url: + https://semgrep.dev/playground/r/WrTqKLA/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods + version_id: WrTqKLA + shortlink: https://sg.run/dPYd + source: + https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods + source-rule-url: + https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection_methods.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - Code Injection mode: taint - pattern-sources: - - pattern-either: - - pattern: 'cookies[...] - - ' - - patterns: - - pattern: 'cookies. ... .$PROPERTY[...] - - ' - - metavariable-regex: - metavariable: $PROPERTY - regex: (?!signed|encrypted) - - pattern: 'params[...] - - ' - - pattern: 'request.env[...] - - ' pattern-sinks: - patterns: - pattern: $X - pattern-either: - - pattern-inside: '$X. ... .to_proc - - ' + - pattern-inside: "$X. ... .to_proc\n" - patterns: - - pattern-inside: '$Y.method($Z) - - ' + - pattern-inside: "$Y.method($Z)\n" - focus-metavariable: $Z - patterns: - - pattern-inside: '$Y.tap($Z) - - ' + - pattern-inside: "$Y.tap($Z)\n" - focus-metavariable: $Z - patterns: - - pattern-inside: '$Y.tap{ |$ANY| $Z } - - ' + - pattern-inside: "$Y.tap{ |$ANY| $Z }\n" - focus-metavariable: $Z - message: Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially - execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, - or `to_proc` - languages: - - ruby - severity: ERROR - metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection_methods.rb - category: security - cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' - owasp: - - A03:2021 - Injection - - A05:2025 - Injection - technology: - - ruby - - rails - references: - - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb - cwe2022-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods - shortlink: https://sg.run/dPYd - semgrep.dev: - rule: - r_id: 20534 - rv_id: 1263662 - rule_id: eqUZ2Q - version_id: WrTqKLA - url: https://semgrep.dev/playground/r/WrTqKLA/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods - origin: community -- id: ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection - mode: taint pattern-sources: - pattern-either: - - pattern: 'cookies[...] - - ' + - pattern: "cookies[...]\n" - patterns: - - pattern: 'cookies. ... .$PROPERTY[...] - - ' + - pattern: "cookies. ... .$PROPERTY[...]\n" - metavariable-regex: metavariable: $PROPERTY regex: (?!signed|encrypted) - - pattern: 'params[...] - - ' - - pattern: 'request.env[...] - - ' - pattern-sinks: - - patterns: - - pattern: $X - - pattern-either: - - pattern-inside: '$X.constantize - - ' - - pattern-inside: '$X. ... .safe_constantize - - ' - - pattern-inside: 'const_get(...) - - ' - - pattern-inside: 'qualified_const_get(...) - - ' - message: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime - behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. - Do not call symbol conversion on user-controllable input. + - pattern: "params[...]\n" + - pattern: "request.env[...]\n" + severity: ERROR +- id: ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection languages: - ruby - severity: ERROR + message: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence + runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to + reflection functionality. Do not call symbol conversion on user-controllable input. metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection.rb category: security + confidence: MEDIUM cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - technology: - - ruby - - rails references: - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb - cwe2022-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection - shortlink: https://sg.run/vpEX semgrep.dev: rule: + origin: community r_id: 20733 - rv_id: 1263663 rule_id: wdUkYA + rv_id: 1263663 + url: + https://semgrep.dev/playground/r/0bTKzn8/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection version_id: 0bTKzn8 - url: https://semgrep.dev/playground/r/0bTKzn8/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection - origin: community -- id: ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find + shortlink: https://sg.run/vpEX + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - Code Injection mode: taint + pattern-sinks: + - patterns: + - pattern: $X + - pattern-either: + - pattern-inside: "$X.constantize\n" + - pattern-inside: "$X. ... .safe_constantize\n" + - pattern-inside: "const_get(...)\n" + - pattern-inside: "qualified_const_get(...)\n" pattern-sources: - pattern-either: - - pattern: 'cookies[...] - - ' + - pattern: "cookies[...]\n" - patterns: - - pattern: 'cookies. ... .$PROPERTY[...] - - ' + - pattern: "cookies. ... .$PROPERTY[...]\n" - metavariable-regex: metavariable: $PROPERTY regex: (?!signed|encrypted) - - pattern: 'params[...] - - ' - - pattern: 'request.env[...] - - ' - pattern-sinks: - - patterns: - - pattern-either: - - pattern: $MODEL.find(...) - - pattern: $MODEL.find_by_id(...) - - pattern: $MODEL.find_by_id!(...) - - metavariable-regex: - metavariable: $MODEL - regex: '[A-Z]\S+' - message: Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is - sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. - Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`. + - pattern: "params[...]\n" + - pattern: "request.env[...]\n" + severity: ERROR +- id: ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find languages: - ruby - severity: WARNING + message: Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against + is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary + records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`. metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unscoped_find.rb category: security + confidence: MEDIUM cwe: - 'CWE-639: Authorization Bypass Through User-Controlled Key' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - technology: - - ruby - - rails references: - https://brakemanscanner.org/docs/warning_types/unscoped_find/ - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find - shortlink: https://sg.run/dPbP semgrep.dev: rule: + origin: community r_id: 20734 - rv_id: 1263664 rule_id: x8Ud6d + rv_id: 1263664 + url: + https://semgrep.dev/playground/r/K3TKkxZ/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find version_id: K3TKkxZ - url: https://semgrep.dev/playground/r/K3TKkxZ/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find - origin: community -- id: ruby.rails.security.brakeman.check-validation-regex.check-validation-regex - mode: search - patterns: + shortlink: https://sg.run/dPbP + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unscoped_find.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - Improper Authorization + mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $MODEL.find(...) + - pattern: $MODEL.find_by_id(...) + - pattern: $MODEL.find_by_id!(...) + - metavariable-regex: + metavariable: $MODEL + regex: '[A-Z]\S+' + pattern-sources: - pattern-either: - - pattern: 'validates ..., :format => <... $V ...>,... - - ' - - pattern: 'validates_format_of ..., :with => <... $V ...>,... - - ' - - metavariable-regex: - metavariable: $V - regex: /(.{2}(? ...`. Ruby regex - behavior is multiline by default and lines should be terminated by `\A` for beginning of line and `\Z` for end of line, - respectively. + - pattern: "cookies[...]\n" + - patterns: + - pattern: "cookies. ... .$PROPERTY[...]\n" + - metavariable-regex: + metavariable: $PROPERTY + regex: (?!signed|encrypted) + - pattern: "params[...]\n" + - pattern: "request.env[...]\n" + severity: WARNING +- id: ruby.rails.security.brakeman.check-validation-regex.check-validation-regex languages: - ruby - severity: ERROR + message: $V Found an incorrectly-bounded regex passed to `validates_format_of` or `validate ... format => ...`. Ruby + regex behavior is multiline by default and lines should be terminated by `\A` for beginning of line and `\Z` for end + of line, respectively. metadata: - source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_validation_regex.rb category: security + confidence: MEDIUM cwe: - 'CWE-185: Incorrect Regular Expression' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - technology: - - ruby - - rails references: - https://brakemanscanner.org/docs/warning_types/format_validation/ - https://github.com/presidentbeef/brakeman/blob/aef6253a8b7bcb97116f2af1ed2a561a6ae35bd5/test/apps/rails3/app/models/account.rb - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/account.rb - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-validation-regex.check-validation-regex - shortlink: https://sg.run/ZPo7 semgrep.dev: rule: + origin: community r_id: 20735 - rv_id: 1263665 rule_id: OrUv1X + rv_id: 1263665 + url: + https://semgrep.dev/playground/r/qkTR7DG/ruby.rails.security.brakeman.check-validation-regex.check-validation-regex version_id: qkTR7DG - url: https://semgrep.dev/playground/r/qkTR7DG/ruby.rails.security.brakeman.check-validation-regex.check-validation-regex - origin: community + shortlink: https://sg.run/ZPo7 + source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-validation-regex.check-validation-regex + source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_validation_regex.rb + subcategory: + - vuln + technology: + - ruby + - rails + vulnerability_class: + - Improper Validation + mode: search + patterns: + - pattern-either: + - pattern: "validates ..., :format => <... $V ...>,...\n" + - pattern: "validates_format_of ..., :with => <... $V ...>,...\n" + - metavariable-regex: + metavariable: $V + regex: /(.{2}(? $X,...) - - ' + - pattern: "$RECORD.where($X,...)\n" + - pattern: "$RECORD.find(..., :conditions => $X,...)\n" - focus-metavariable: $X - patterns: - - pattern: '"$SQLVERB#{$EXPR}..." - - ' - - pattern-not-inside: '$FUNC("...", "...#{$EXPR}...",...) - - ' + - pattern: "\"$SQLVERB#{$EXPR}...\"\n" + - pattern-not-inside: "$FUNC(\"...\", \"...#{$EXPR}...\",...)\n" - focus-metavariable: $SQLVERB - pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b - patterns: - pattern-either: - pattern: Kernel::sprintf("$SQLSTR", $EXPR) - - pattern: '"$SQLSTR" + $EXPR - - ' - - pattern: '"$SQLSTR" % $EXPR - - ' - - pattern-not-inside: '$FUNC("...", "...#{$EXPR}...",...) - - ' + - pattern: "\"$SQLSTR\" + $EXPR\n" + - pattern: "\"$SQLSTR\" % $EXPR\n" + - pattern-not-inside: "$FUNC(\"...\", \"...#{$EXPR}...\",...)\n" - focus-metavariable: $EXPR - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop)\b + pattern-sources: + - patterns: + - pattern-either: + - pattern: params + - pattern: request + severity: ERROR - id: ruby.rails.security.injection.tainted-url-host.tainted-url-host languages: - ruby - severity: WARNING - message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data - to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. - They could also probe internal servers or other resources that the server running this code can access. (This is called - server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction - with `SsrfFilter(...)`, or create an allowlist for approved hosts. + message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send + data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with + this request. They could also probe internal servers or other resources that the server running this code can + access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` + gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - rails references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html - https://github.com/arkadiyt/ssrf_filter - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host - shortlink: https://sg.run/RX3g semgrep.dev: rule: + origin: community r_id: 14705 - rv_id: 1263668 rule_id: zdUY0W - version_id: 6xT29BN + rv_id: 1263668 url: https://semgrep.dev/playground/r/6xT29BN/ruby.rails.security.injection.tainted-url-host.tainted-url-host - origin: community + version_id: 6xT29BN + shortlink: https://sg.run/RX3g + source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host + subcategory: + - vuln + technology: + - rails + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint pattern-sanitizers: - pattern: SsrfFilter - pattern-sources: - - patterns: - - pattern-either: - - pattern: params - - pattern: request pattern-sinks: - patterns: - pattern-either: - patterns: - - pattern: '$URLSTR - - ' + - pattern: "$URLSTR\n" - pattern-regex: \w+:\/\/#{.*} - patterns: - pattern-either: - pattern: Kernel::sprintf("$URLSTR", ...) - - pattern: '"$URLSTR" + $EXPR - - ' - - pattern: '"$URLSTR" % $EXPR - - ' + - pattern: "\"$URLSTR\" + $EXPR\n" + - pattern: "\"$URLSTR\" % $EXPR\n" - metavariable-pattern: - metavariable: $URLSTR language: generic + metavariable: $URLSTR pattern: $SCHEME:// ... + pattern-sources: + - patterns: + - pattern-either: + - pattern: params + - pattern: request + severity: WARNING - id: scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode + languages: + - scala + message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html + Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' + metadata: + category: security + confidence: HIGH + cwe: + - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A02:2017 - Broken Authentication + - A04:2021 - Insecure Design + - A06:2025 - Insecure Design + references: + - https://jwt-scala.github.io/jwt-scala/ + semgrep.dev: + rule: + origin: community + r_id: 19040 + rule_id: WAUdK0 + rv_id: 1263669 + url: https://semgrep.dev/playground/r/o5TbDA8/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode + version_id: o5TbDA8 + shortlink: https://sg.run/8zE7 + source: https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode + subcategory: + - vuln + technology: + - scala + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: 'import pdi.jwt.$DEPS - - ... - - ' + - pattern-inside: "import pdi.jwt.$DEPS\n...\n" - pattern-either: - pattern: $JWT.encode($X, "...", ...) - pattern: $JWT.decode($X, "...", ...) @@ -36743,506 +28068,328 @@ rules: - pattern: JwtJson4s - pattern: JwtJson - pattern: JwtUpickle - message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html - Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' + severity: WARNING +- id: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled languages: - scala - severity: WARNING + message: Document Builder being instantiated without calling the `setFeature` functions that are generally used for + disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity + Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery + (SSRF), port scanning. Make sure to disable entity processing functionality. metadata: - references: - - https://jwt-scala.github.io/jwt-scala/ category: security - cwe: - - 'CWE-522: Insufficiently Protected Credentials' - owasp: - - A02:2017 - Broken Authentication - - A04:2021 - Insecure Design - - A06:2025 - Insecure Design - technology: - - scala confidence: HIGH + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode - shortlink: https://sg.run/8zE7 - semgrep.dev: - rule: - r_id: 19040 - rv_id: 1263669 - rule_id: WAUdK0 - version_id: o5TbDA8 - url: https://semgrep.dev/playground/r/o5TbDA8/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode - origin: community -- id: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled - patterns: - - pattern-either: - - pattern: '$DF = DocumentBuilderFactory.newInstance(...) - - ... - - $DB = $DF.newDocumentBuilder(...) - - ' - - patterns: - - pattern: $DB = DocumentBuilderFactory.newInstance(...) - - pattern-not-inside: '... - - $X = $DB.newDocumentBuilder(...) - - ' - - pattern: $DB = DocumentBuilderFactory.newInstance(...).newDocumentBuilder(...) - - pattern-not-inside: '... - - $DB.setXIncludeAware(true) - - ... - - $DB.setNamespaceAware(true) - - ... - - $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) - - ... - - $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) - - ... - - $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - - ' - - pattern-not-inside: '... - - $DB.setXIncludeAware(true) - - ... - - $DB.setNamespaceAware(true) - - ... - - $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) - - ... - - $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - - ... - - $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) - - ' - - pattern-not-inside: '... - - $DB.setXIncludeAware(true) - - ... - - $DB.setNamespaceAware(true) - - ... - - $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) - - ... - - $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) - - ... - - $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - - ' - - pattern-not-inside: '... - - $DB.setXIncludeAware(true) - - ... - - $DB.setNamespaceAware(true) - - ... - - $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) - - ... - - $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - - ... - - $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) - - ' - message: Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling - entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities - like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure - to disable entity processing functionality. - languages: - - scala - severity: WARNING - metadata: - cwe: - - 'CWE-611: Improper Restriction of XML External Entity Reference' + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html - category: security - technology: - - scala - confidence: HIGH references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - cwe2022-top25: true - cwe2021-top25: true + semgrep.dev: + rule: + origin: community + r_id: 19041 + rule_id: 0oUwzP + rv_id: 1263673 + url: + https://semgrep.dev/playground/r/X0TzyRq/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled + version_id: X0TzyRq + shortlink: https://sg.run/gRQn + source: https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled + source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html subcategory: - vuln - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - scala vulnerability_class: - XML Injection - source: https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled - shortlink: https://sg.run/gRQn - semgrep.dev: - rule: - r_id: 19041 - rv_id: 1263673 - rule_id: 0oUwzP - version_id: X0TzyRq - url: https://semgrep.dev/playground/r/X0TzyRq/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled - origin: community -- id: scala.lang.security.audit.io-source-ssrf.io-source-ssrf patterns: - pattern-either: - - pattern: Source.fromURL($URL,...) - - pattern: Source.fromURI($URL,...) - - pattern-inside: 'import scala.io.$SOURCE - - ... - - ' - - pattern-either: - - pattern-inside: "def $FUNC(..., $URL: $T, ...) = $A {\n ...\n}\n" - - pattern-inside: "def $FUNC(..., $URL: $T, ...) = {\n ...\n}\n" - message: A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send - data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers - or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist - for approved hosts, or hardcode the correct host. + - pattern: "$DF = DocumentBuilderFactory.newInstance(...)\n...\n$DB = $DF.newDocumentBuilder(...)\n" + - patterns: + - pattern: $DB = DocumentBuilderFactory.newInstance(...) + - pattern-not-inside: "...\n$X = $DB.newDocumentBuilder(...)\n" + - pattern: $DB = DocumentBuilderFactory.newInstance(...).newDocumentBuilder(...) + - pattern-not-inside: "...\n$DB.setXIncludeAware(true)\n...\n$DB.setNamespaceAware(true)\n...\n$DB.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\"\ + , true)\n...\n$DB.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)\n...\n$DB.setFeature(\"\ + http://xml.org/sax/features/external-parameter-entities\", false)\n" + - pattern-not-inside: "...\n$DB.setXIncludeAware(true)\n...\n$DB.setNamespaceAware(true)\n...\n$DB.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\"\ + , true)\n...\n$DB.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)\n...\n$DB.setFeature(\"\ + http://xml.org/sax/features/external-general-entities\", false)\n" + - pattern-not-inside: "...\n$DB.setXIncludeAware(true)\n...\n$DB.setNamespaceAware(true)\n...\n$DB.setFeature(\"http://xml.org/sax/features/external-general-entities\"\ + , false)\n...\n$DB.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true)\n...\n$DB.setFeature(\"\ + http://xml.org/sax/features/external-parameter-entities\", false)\n" + - pattern-not-inside: "...\n$DB.setXIncludeAware(true)\n...\n$DB.setNamespaceAware(true)\n...\n$DB.setFeature(\"http://xml.org/sax/features/external-general-entities\"\ + , false)\n...\n$DB.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)\n...\n$DB.setFeature(\"\ + http://apache.org/xml/features/disallow-doctype-decl\", true)\n" + severity: WARNING +- id: scala.lang.security.audit.io-source-ssrf.io-source-ssrf + languages: + - scala + message: A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to + send data to their own server, potentially exposing sensitive data sent with this request. They could also probe + internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. + Instead, create an allowlist for approved hosts, or hardcode the correct host. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html - https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource - category: security - technology: - - scala - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf - shortlink: https://sg.run/Qbz4 semgrep.dev: rule: + origin: community r_id: 18486 - rv_id: 1263675 rule_id: GdUDOZ - version_id: 1QTypG9 + rv_id: 1263675 url: https://semgrep.dev/playground/r/1QTypG9/scala.lang.security.audit.io-source-ssrf.io-source-ssrf - origin: community - languages: - - scala + version_id: 1QTypG9 + shortlink: https://sg.run/Qbz4 + source: https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf + subcategory: + - audit + technology: + - scala + vulnerability_class: + - Server-Side Request Forgery (SSRF) + patterns: + - pattern-either: + - pattern: Source.fromURL($URL,...) + - pattern: Source.fromURI($URL,...) + - pattern-inside: "import scala.io.$SOURCE\n...\n" + - pattern-either: + - pattern-inside: "def $FUNC(..., $URL: $T, ...) = $A {\n ...\n}\n" + - pattern-inside: "def $FUNC(..., $URL: $T, ...) = {\n ...\n}\n" severity: WARNING - id: scala.lang.security.audit.rsa-padding-set.rsa-padding-set + languages: + - scala + message: Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to + sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead. metadata: + category: security + confidence: HIGH cwe: - 'CWE-780: Use of RSA Algorithm without OAEP' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - category: security - technology: - - scala - - cryptography - resources: - - https://blog.codacy.com/9-scala-security-issues/ - confidence: HIGH references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set - shortlink: https://sg.run/GO5p + resources: + - https://blog.codacy.com/9-scala-security-issues/ semgrep.dev: rule: + origin: community r_id: 15192 - rv_id: 1263677 rule_id: 3qUj1Q - version_id: yeTxpoX + rv_id: 1263677 url: https://semgrep.dev/playground/r/yeTxpoX/scala.lang.security.audit.rsa-padding-set.rsa-padding-set - origin: community - message: Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive - data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead. - severity: WARNING - languages: - - scala + version_id: yeTxpoX + shortlink: https://sg.run/GO5p + source: https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set + subcategory: + - audit + technology: + - scala + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: '$VAR = $CIPHER.getInstance($MODE) - - ' + - pattern: "$VAR = $CIPHER.getInstance($MODE)\n" - metavariable-regex: metavariable: $MODE regex: .*RSA/.*/NoPadding.* + severity: WARNING - id: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled - patterns: - - pattern-either: - - pattern: $SR = new SAXReader(...) - - pattern: '$SF = SAXParserFactory.newInstance(...) - - ... - - $SR = $SF.newSAXParser(...) - - ' - - patterns: - - pattern: $SR = SAXParserFactory.newInstance(...) - - pattern-not-inside: '... - - $X = $SR.newSAXParser(...) - - ' - - pattern: $SR = SAXParserFactory.newInstance(...).newSAXParser(...) - - pattern: $SR = new SAXBuilder(...) - - pattern-not-inside: '... - - $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) - - ... - - $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) - - ... - - $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - - ' - - pattern-not-inside: '... - - $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) - - ... - - $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - - ... - - $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) - - ' - - pattern-not-inside: '... - - $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) - - ... - - $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) - - ... - - $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - - ' - - pattern-not-inside: '... - - $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) - - ... - - $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - - ... - - $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) - - ' - message: XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling - entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like - the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to - disable entity processing functionality. languages: - scala - severity: WARNING + message: XML processor being instantiated without calling the `setFeature` functions that are generally used for + disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing + vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), + port scanning. Make sure to disable entity processing functionality. metadata: + category: security + confidence: HIGH cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html - category: security - technology: - - scala - confidence: HIGH references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled - shortlink: https://sg.run/QbYP semgrep.dev: rule: + origin: community r_id: 19042 - rv_id: 1263678 rule_id: KxUrkq - version_id: rxTAKWY + rv_id: 1263678 url: https://semgrep.dev/playground/r/rxTAKWY/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled - origin: community -- id: scala.lang.security.audit.scalac-debug.scalac-debug + version_id: rxTAKWY + shortlink: https://sg.run/QbYP + source: https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled + source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html + subcategory: + - audit + technology: + - scala + vulnerability_class: + - XML Injection patterns: - pattern-either: - - pattern: scalacOptions ... "-Vdebug" - - pattern: scalacOptions ... "-Ydebug" - message: Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug - mode also affects performance and reliability. Remove it from configuration. + - pattern: $SR = new SAXReader(...) + - pattern: "$SF = SAXParserFactory.newInstance(...)\n...\n$SR = $SF.newSAXParser(...)\n" + - patterns: + - pattern: $SR = SAXParserFactory.newInstance(...) + - pattern-not-inside: "...\n$X = $SR.newSAXParser(...)\n" + - pattern: $SR = SAXParserFactory.newInstance(...).newSAXParser(...) + - pattern: $SR = new SAXBuilder(...) + - pattern-not-inside: "...\n$SR.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true)\n...\n$SR.setFeature(\"\ + http://xml.org/sax/features/external-general-entities\", false)\n...\n$SR.setFeature(\"http://xml.org/sax/features/external-parameter-entities\"\ + , false)\n" + - pattern-not-inside: "...\n$SR.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true)\n...\n$SR.setFeature(\"\ + http://xml.org/sax/features/external-parameter-entities\", false)\n...\n$SR.setFeature(\"http://xml.org/sax/features/external-general-entities\"\ + , false)\n" + - pattern-not-inside: "...\n$SR.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)\n...\n$SR.setFeature(\"\ + http://apache.org/xml/features/disallow-doctype-decl\", true)\n...\n$SR.setFeature(\"http://xml.org/sax/features/external-parameter-entities\"\ + , false)\n" + - pattern-not-inside: "...\n$SR.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)\n...\n$SR.setFeature(\"\ + http://xml.org/sax/features/external-parameter-entities\", false)\n...\n$SR.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\"\ + , true)\n" + severity: WARNING +- id: scala.lang.security.audit.scalac-debug.scalac-debug languages: - generic - severity: WARNING - paths: - include: - - '*.sbt*' + message: Scala applications built with `debug` set to true in production may leak debug information to attackers. + Debug mode also affects performance and reliability. Remove it from configuration. metadata: category: security + confidence: MEDIUM cwe: - 'CWE-489: Active Debug Code' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: A05:2021 - Security Misconfiguration - technology: - - scala - - sbt references: - https://docs.scala-lang.org/overviews/compiler-options/index.html - confidence: MEDIUM - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Active Debug Code - source: https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug - shortlink: https://sg.run/QbGd semgrep.dev: rule: + origin: community r_id: 18686 - rv_id: 946569 rule_id: JDUlE0 - version_id: qkT4j0N + rv_id: 946569 url: https://semgrep.dev/playground/r/qkT4j0N/scala.lang.security.audit.scalac-debug.scalac-debug - origin: community + version_id: qkT4j0N + shortlink: https://sg.run/QbGd + source: https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug + subcategory: + - audit + technology: + - scala + - sbt + vulnerability_class: + - Active Debug Code + paths: + include: + - '*.sbt*' + patterns: + - pattern-either: + - pattern: scalacOptions ... "-Vdebug" + - pattern: scalacOptions ... "-Ydebug" + severity: WARNING - id: scala.lang.security.audit.tainted-sql-string.tainted-sql-string languages: - scala - severity: ERROR - mode: taint - message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using - prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of - SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements - (`connection.PreparedStatement`) or a safe library. + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings + using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible + indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use + prepared statements (`connection.PreparedStatement`) or a safe library. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html - category: security - technology: - - scala - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/scala.lang.security.audit.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/ALD6 semgrep.dev: rule: + origin: community r_id: 20050 - rv_id: 1263682 rule_id: WAUY8B - version_id: w8TRoO6 + rv_id: 1263682 url: https://semgrep.dev/playground/r/w8TRoO6/scala.lang.security.audit.tainted-sql-string.tainted-sql-string - origin: community - pattern-sources: - - patterns: - - pattern: $PARAM - - pattern-either: - - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = {\n ...\n}\n" - - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = $A {\n ...\n}\n" - - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = $A(...) {\n ...\n}\n" + version_id: w8TRoO6 + shortlink: https://sg.run/ALD6 + source: https://semgrep.dev/r/scala.lang.security.audit.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - scala + vulnerability_class: + - SQL Injection + mode: taint + pattern-sanitizers: + - pattern-either: + - patterns: + - pattern-either: + - pattern: $LOGGER.$METHOD(...) + - pattern: $LOGGER(...) + - metavariable-regex: + metavariable: $LOGGER + regex: (i?)log.* + - patterns: + - pattern: $LOGGER.$METHOD(...) + - metavariable-regex: + metavariable: $METHOD + regex: (i?)(trace|info|warn|warning|warnToError|error|debug) pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - - pattern: '"$SQLSTR" + ... - - ' - - pattern: '"$SQLSTR".format(...) - - ' + - pattern: "\"$SQLSTR\" + ...\n" + - pattern: "\"$SQLSTR\".format(...)\n" - patterns: - - pattern-inside: '$SB = new StringBuilder("$SQLSTR"); - - ... - - ' + - pattern-inside: "$SB = new StringBuilder(\"$SQLSTR\");\n...\n" - pattern: $SB.append(...) - patterns: - - pattern-inside: '$VAR = "$SQLSTR" - - ... - - ' + - pattern-inside: "$VAR = \"$SQLSTR\"\n...\n" - pattern: $VAR += ... - metavariable-regex: metavariable: $SQLSTR @@ -37251,88 +28398,113 @@ rules: - pattern-either: - pattern: s"..." - pattern: f"..." - - pattern-regex: '.*\b(?i)(select|delete|insert|create|update|alter|drop)\b.* - - ' + - pattern-regex: ".*\\b(?i)(select|delete|insert|create|update|alter|drop)\\b.*\n" - pattern-not-inside: println(...) - pattern-not-inside: throw new $EXCEPTION(...) - pattern-sanitizers: - - pattern-either: - - patterns: - - pattern-either: - - pattern: $LOGGER.$METHOD(...) - - pattern: $LOGGER(...) - - metavariable-regex: - metavariable: $LOGGER - regex: (i?)log.* - - patterns: - - pattern: $LOGGER.$METHOD(...) - - metavariable-regex: - metavariable: $METHOD - regex: (i?)(trace|info|warn|warning|warnToError|error|debug) + pattern-sources: + - patterns: + - pattern: $PARAM + - pattern-either: + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = $A {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = $A(...) {\n ...\n}\n" + severity: ERROR - id: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled - patterns: - - pattern-not-inside: '... - - $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false) - - ' - - pattern-either: - - pattern: $XMLFACTORY = XMLInputFactory.newFactory(...) - - pattern: $XMLFACTORY = XMLInputFactory.newInstance(...) - - pattern: $XMLFACTORY = new XMLInputFactory(...) - message: XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling - entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities - like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure - to disable entity processing functionality. languages: - scala - severity: WARNING + message: XMLInputFactory being instantiated without calling the setProperty functions that are generally used for + disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity + Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery + (SSRF), port scanning. Make sure to disable entity processing functionality. metadata: + category: security + confidence: HIGH cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html - category: security - technology: - - scala - confidence: HIGH references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - cwe2022-top25: true - cwe2021-top25: true + semgrep.dev: + rule: + origin: community + r_id: 19043 + rule_id: qNUQ7w + rv_id: 1263683 + url: + https://semgrep.dev/playground/r/xyTjzkA/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled + version_id: xyTjzkA + shortlink: https://sg.run/3BEb + source: https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled + source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html subcategory: - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - scala vulnerability_class: - XML Injection - source: https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled - shortlink: https://sg.run/3BEb + patterns: + - pattern-not-inside: "...\n$XMLFACTORY.setProperty(\"javax.xml.stream.isSupportingExternalEntities\", false)\n" + - pattern-either: + - pattern: $XMLFACTORY = XMLInputFactory.newFactory(...) + - pattern: $XMLFACTORY = XMLInputFactory.newInstance(...) + - pattern: $XMLFACTORY = new XMLInputFactory(...) + severity: WARNING +- id: scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass + languages: + - generic + message: Possibly bypassable CSRF configuration found. CSRF is an attack that forces an end user to execute unwanted + actions on a web application in which they’re currently authenticated. Make sure that Content-Type black list is + configured and CORS filter is turned on. + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://www.playframework.com/documentation/2.8.x/Migration25#CSRF-changes + - https://owasp.org/www-community/attacks/csrf semgrep.dev: rule: - r_id: 19043 - rv_id: 1263683 - rule_id: qNUQ7w - version_id: xyTjzkA - url: https://semgrep.dev/playground/r/xyTjzkA/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled origin: community -- id: scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass + r_id: 19044 + rule_id: lBUyRR + rv_id: 1263684 + url: + https://semgrep.dev/playground/r/O9Tpx53/scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass + version_id: O9Tpx53 + shortlink: https://sg.run/4DEE + source: https://semgrep.dev/r/scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass + subcategory: + - vuln + technology: + - scala + - play + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + paths: + include: + - '*.conf' patterns: - pattern-either: - pattern: X-Requested-With = "*" - pattern: Csrf-Token = "..." - - pattern-inside: 'bypassHeaders {... - - ... - - ...} - - ' + - pattern-inside: "bypassHeaders {...\n...\n...}\n" - pattern-not-inside: "{...\n ...\n ...blackList = [...\"application/x-www-form-urlencoded\"...\"multipart/form-data\"\ ...\"text/plain\"...]\n ...\n...}\n" - pattern-not-inside: "{...\n ...\n ...blackList = [...\"application/x-www-form-urlencoded\"...\"text/plain\"...\"multipart/form-data\"\ @@ -37345,146 +28517,92 @@ rules: ...]\n ...\n...}\n" - pattern-not-inside: "{...\n ...\n ...blackList = [...\"text/plain\"...\"multipart/form-data\"...\"application/x-www-form-urlencoded\"\ ...]\n ...\n...}\n" - message: Possibly bypassable CSRF configuration found. CSRF is an attack that forces an end user to execute unwanted actions - on a web application in which they’re currently authenticated. Make sure that Content-Type black list is configured and - CORS filter is turned on. - languages: - - generic severity: ERROR - paths: - include: - - '*.conf' - metadata: - references: - - https://www.playframework.com/documentation/2.8.x/Migration25#CSRF-changes - - https://owasp.org/www-community/attacks/csrf - cwe: - - 'CWE-352: Cross-Site Request Forgery (CSRF)' - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - category: security - technology: - - scala - - play - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site Request Forgery (CSRF) - source: https://semgrep.dev/r/scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass - shortlink: https://sg.run/4DEE - semgrep.dev: - rule: - r_id: 19044 - rv_id: 1263684 - rule_id: lBUyRR - version_id: O9Tpx53 - url: https://semgrep.dev/playground/r/O9Tpx53/scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass - origin: community - id: scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings - patterns: - - pattern: secure = false - - pattern-inside: "session = {\n ...\n}\n" - message: Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting - the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file. languages: - generic - severity: WARNING - paths: - include: - - '*.conf' + message: Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from + transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in + configuration file. metadata: category: security - references: - - https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security - - https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration - technology: - - play - - scala + confidence: MEDIUM cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - confidence: MEDIUM - subcategory: - - vuln - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings - shortlink: https://sg.run/8z8N + references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security + - https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration semgrep.dev: rule: + origin: community r_id: 18284 - rv_id: 1263685 rule_id: GdUDJO + rv_id: 1263685 + url: + https://semgrep.dev/playground/r/e1TyjJv/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings version_id: e1TyjJv - url: https://semgrep.dev/playground/r/e1TyjJv/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings - origin: community + shortlink: https://sg.run/8z8N + source: https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings + subcategory: + - vuln + technology: + - play + - scala + vulnerability_class: + - Cookie Security + paths: + include: + - '*.conf' + patterns: + - pattern: secure = false + - pattern-inside: "session = {\n ...\n}\n" + severity: WARNING - id: scala.play.security.tainted-html-response.tainted-html-response - mode: taint + languages: + - scala + message: Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or + template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) + vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views. metadata: category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - technology: - - scala - - play - confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response - shortlink: https://sg.run/BG96 semgrep.dev: rule: + origin: community r_id: 18795 - rv_id: 1263686 rule_id: 0oUwn2 - version_id: vdT06yj + rv_id: 1263686 url: https://semgrep.dev/playground/r/vdT06yj/scala.play.security.tainted-html-response.tainted-html-response - origin: community - message: Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template - environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. - Consider using a view technology such as Twirl which automatically escapes HTML views. - pattern-sources: - - patterns: - - pattern-either: - - patterns: - - pattern: $REQ - - pattern-either: - - pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n" - - pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n" - - pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n" - - pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n" - - patterns: - - pattern: $PARAM - - pattern-either: - - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action {\n ...\n}\n" - - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {\n ...\n}\n" - - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {\n ...\n}\n" - - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {\n ...\n}\n" + version_id: vdT06yj + shortlink: https://sg.run/BG96 + source: https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response + subcategory: + - vuln + technology: + - scala + - play + vulnerability_class: + - Cross-Site-Scripting (XSS) + mode: taint pattern-sanitizers: - pattern-either: - pattern: org.apache.commons.lang3.StringEscapeUtils.escapeHtml4(...) @@ -37505,48 +28623,71 @@ rules: - pattern-either: - pattern-inside: "def $FUNC(..., $URL: $T, ...) = $A {\n ...\n}\n" - pattern-inside: "def $FUNC(..., $URL: $T, ...) = {\n ...\n}\n" + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern: $REQ + - pattern-either: + - pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n" + - pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n" + - pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n" + - pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n" + - patterns: + - pattern: $PARAM + - pattern-either: + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {\n ...\n}\n" + - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {\n ...\n}\n" severity: WARNING +- id: scala.play.security.tainted-slick-sqli.tainted-slick-sqli languages: - scala -- id: scala.play.security.tainted-slick-sqli.tainted-slick-sqli - mode: taint + message: Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not + properly sanitized. Avoid using using user input for generating SQL strings. metadata: - references: - - https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values - - https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code category: security + confidence: HIGH cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection + references: + - https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values + - https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code + semgrep.dev: + rule: + origin: community + r_id: 18328 + rule_id: GdUDWO + rv_id: 1263687 + url: https://semgrep.dev/playground/r/d6TyxJe/scala.play.security.tainted-slick-sqli.tainted-slick-sqli + version_id: d6TyxJe + shortlink: https://sg.run/k9K2 + source: https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli + subcategory: + - vuln technology: - scala - slick - play - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection - source: https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli - shortlink: https://sg.run/k9K2 - semgrep.dev: - rule: - r_id: 18328 - rv_id: 1263687 - rule_id: GdUDWO - version_id: d6TyxJe - url: https://semgrep.dev/playground/r/d6TyxJe/scala.play.security.tainted-slick-sqli.tainted-slick-sqli - origin: community - message: Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly - sanitized. Avoid using using user input for generating SQL strings. + mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $MODEL.overrideSql(...) + - pattern: sql"..." + - pattern-inside: "import slick.$DEPS\n...\n" pattern-sources: - patterns: - pattern-either: @@ -37564,61 +28705,69 @@ rules: - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {\n ...\n}\n" - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {\n ...\n}\n" - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {\n ...\n}\n" - pattern-sinks: - - patterns: - - pattern-either: - - pattern: $MODEL.overrideSql(...) - - pattern: sql"..." - - pattern-inside: 'import slick.$DEPS - - ... - - ' severity: ERROR - languages: - - scala - id: scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request languages: - scala - severity: ERROR - mode: taint - message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using - prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of - SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements - (`connection.PreparedStatement`) or a safe library. + message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings + using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible + indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use + prepared statements (`connection.PreparedStatement`) or a safe library. metadata: + category: security + confidence: HIGH cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html - category: security - technology: - - scala - - play - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request - shortlink: https://sg.run/BeW9 semgrep.dev: rule: + origin: community r_id: 20051 - rv_id: 1263688 rule_id: 0oUpon + rv_id: 1263688 + url: + https://semgrep.dev/playground/r/ZRTKAoG/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request version_id: ZRTKAoG - url: https://semgrep.dev/playground/r/ZRTKAoG/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request - origin: community + shortlink: https://sg.run/BeW9 + source: https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request + subcategory: + - vuln + technology: + - scala + - play + vulnerability_class: + - SQL Injection + mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: "\"$SQLSTR\" + ...\n" + - pattern: "\"$SQLSTR\".format(...)\n" + - patterns: + - pattern-inside: "$SB = new StringBuilder(\"$SQLSTR\");\n...\n" + - pattern: $SB.append(...) + - patterns: + - pattern-inside: "$VAR = \"$SQLSTR\"\n...\n" + - pattern: $VAR += ... + - metavariable-regex: + metavariable: $SQLSTR + regex: (?i)(select|delete|insert|create|update|alter|drop)\b + - patterns: + - pattern: s"..." + - pattern-regex: ".*\\b(?i)(select|delete|insert|create|update|alter|drop)\\b.*\n" + - pattern-not-inside: println(...) pattern-sources: - patterns: - pattern-either: @@ -37636,40 +28785,7 @@ rules: - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {\n ...\n}\n" - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {\n ...\n}\n" - pattern-inside: "def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {\n ...\n}\n" - pattern-sinks: - - patterns: - - pattern-either: - - patterns: - - pattern-either: - - pattern: '"$SQLSTR" + ... - - ' - - pattern: '"$SQLSTR".format(...) - - ' - - patterns: - - pattern-inside: '$SB = new StringBuilder("$SQLSTR"); - - ... - - ' - - pattern: $SB.append(...) - - patterns: - - pattern-inside: '$VAR = "$SQLSTR" - - ... - - ' - - pattern: $VAR += ... - - metavariable-regex: - metavariable: $SQLSTR - regex: (?i)(select|delete|insert|create|update|alter|drop)\b - - patterns: - - pattern: s"..." - - pattern-regex: '.*\b(?i)(select|delete|insert|create|update|alter|drop)\b.* - - ' - - pattern-not-inside: println(...) + severity: ERROR - id: scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret languages: - scala @@ -37677,132 +28793,107 @@ rules: Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' metadata: category: security + confidence: HIGH cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - technology: - - jwt - confidence: HIGH references: - https://owasp.org/Top10/A04_2021-Insecure_Design - cwe2021-top25: true - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret - shortlink: https://sg.run/Z40o semgrep.dev: rule: + origin: community r_id: 15079 - rv_id: 1263691 rule_id: OrU6W1 - version_id: 7ZTE3kr + rv_id: 1263691 url: https://semgrep.dev/playground/r/7ZTE3kr/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret - origin: community + version_id: 7ZTE3kr + shortlink: https://sg.run/Z40o + source: https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - audit + technology: + - jwt + vulnerability_class: + - Cryptographic Issues pattern-either: - - pattern: 'com.auth0.jwt.algorithms.Algorithm.HMAC256("..."); - - ' - - pattern: '$SECRET = "..."; - - ... - - com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET); - - ' + - pattern: "com.auth0.jwt.algorithms.Algorithm.HMAC256(\"...\");\n" + - pattern: "$SECRET = \"...\";\n...\ncom.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET);\n" - pattern: "class $CLASS {\n ...\n $DECL $SECRET = \"...\";\n ...\n def $FUNC (...): $RETURNTYPE = {\n ...\n com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET);\n\ \ ...\n }\n ...\n}\n" - - pattern: 'com.auth0.jwt.algorithms.Algorithm.HMAC384("..."); - - ' - - pattern: '$SECRET = "..."; - - ... - - com.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET); - - ' + - pattern: "com.auth0.jwt.algorithms.Algorithm.HMAC384(\"...\");\n" + - pattern: "$SECRET = \"...\";\n...\ncom.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET);\n" - pattern: "class $CLASS {\n ...\n $DECL $SECRET = \"...\";\n ...\n def $FUNC (...): $RETURNTYPE = {\n ...\n com.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET);\n\ \ ...\n }\n ...\n}\n" - - pattern: 'com.auth0.jwt.algorithms.Algorithm.HMAC512("..."); - - ' - - pattern: '$SECRET = "..."; - - ... - - com.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET); - - ' + - pattern: "com.auth0.jwt.algorithms.Algorithm.HMAC512(\"...\");\n" + - pattern: "$SECRET = \"...\";\n...\ncom.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET);\n" - pattern: "class $CLASS {\n ...\n $DECL $SECRET = \"...\";\n ...\n def $FUNC (...): $RETURNTYPE = {\n ...\n com.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET);\n\ \ ...\n }\n ...\n}\n" severity: ERROR - id: solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx languages: - solidity - message: Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation - on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance - manipulation during self-transfers. - severity: ERROR + message: Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance + manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances + to prevent balance manipulation during self-transfers. metadata: category: security - technology: - - blockchain - - solidity - cwe: 'CWE-682: Incorrect Calculation' - subcategory: - - vuln confidence: HIGH - likelihood: HIGH + cwe: 'CWE-682: Incorrect Calculation' impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A7:2021 Identification and Authentication Failures references: - https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities - https://x.com/shoucccc/status/1757777764646859121 - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx - shortlink: https://sg.run/Or6X7 semgrep.dev: rule: + origin: community r_id: 133075 - rv_id: 946620 rule_id: 6JUv7Nz + rv_id: 946620 + url: + https://semgrep.dev/playground/r/A8TJzYz/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx version_id: A8TJzYz - url: https://semgrep.dev/playground/r/A8TJzYz/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx - origin: community + shortlink: https://sg.run/Or6X7 + source: https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx + subcategory: + - vuln + technology: + - blockchain + - solidity + vulnerability_class: + - Other patterns: - pattern-either: - - pattern: '_balances[$FROM] = $FROM_BALANCE - value; - - ' - - pattern: '_balances[$TO] = $TO_BALANCE + value; - - ' - - pattern-not-inside: "if ($FROM != $TO) {\n ...\n _balances[$FROM] = $FROM_BALANCE - value;\n ...\n _balances[$TO]\ - \ = $TO_BALANCE + value;\n ...\n}\n" + - pattern: "_balances[$FROM] = $FROM_BALANCE - value;\n" + - pattern: "_balances[$TO] = $TO_BALANCE + value;\n" + - pattern-not-inside: "if ($FROM != $TO) {\n ...\n _balances[$FROM] = $FROM_BALANCE - value;\n ...\n _balances[$TO] + = $TO_BALANCE + value;\n ...\n}\n" - pattern-inside: "function _update(address $FROM, address $TO, uint256 value, bool mint) internal virtual {\n ...\n}\n" + severity: ERROR - id: swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults - message: Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive - information. For data of a sensitive nature, applications should leverage the Keychain. - severity: WARNING + languages: + - swift + message: Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of + sensitive information. For data of a sensitive nature, applications should leverage the Keychain. metadata: - likelihood: LOW - impact: HIGH - confidence: MEDIUM category: security + confidence: MEDIUM cwe: - 'CWE-311: Missing Encryption of Sensitive Data' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW masvs: - 'MASVS-STORAGE-1: The app securely stores sensitive data' owasp: @@ -37812,175 +28903,148 @@ rules: references: - https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html - https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/ + semgrep.dev: + rule: + origin: community + r_id: 66512 + rule_id: KxUqoZ + rv_id: 1263696 + url: + https://semgrep.dev/playground/r/3ZT4Xy2/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults + version_id: 3ZT4Xy2 + shortlink: https://sg.run/qvoO + source: https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults subcategory: - vuln technology: - ios - macos - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues - source: https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults - shortlink: https://sg.run/qvoO - semgrep.dev: - rule: - r_id: 66512 - rv_id: 1263696 - rule_id: KxUqoZ - version_id: 3ZT4Xy2 - url: https://semgrep.dev/playground/r/3ZT4Xy2/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults - origin: community - languages: - - swift options: symbolic_propagation: true patterns: - pattern-either: - patterns: - pattern-either: - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) - - ' + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: $KEY)\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: $KEY)\n" - metavariable-regex: metavariable: $VALUE regex: (?i).*(passcode|password|pass_word|passphrase|pass_code|pass_word|pass_phrase)$ - focus-metavariable: $VALUE - patterns: - pattern-either: - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) - - ' + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: $KEY)\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: $KEY)\n" - metavariable-regex: metavariable: $KEY regex: (?i).*(passcode|password|pass_word|passphrase|pass_code|pass_word|pass_phrase)$ - focus-metavariable: $KEY - patterns: - pattern-either: - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) - - ' + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: $KEY)\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: $KEY)\n" - metavariable-regex: metavariable: $VALUE regex: (?i).*(api_key|apikey)$ - focus-metavariable: $VALUE - patterns: - pattern-either: - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) - - ' + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: $KEY)\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: $KEY)\n" - metavariable-regex: metavariable: $KEY regex: (?i).*(api_key|apikey)$ - focus-metavariable: $KEY - patterns: - pattern-either: - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) - - ' + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: $KEY)\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: $KEY)\n" - metavariable-regex: metavariable: $VALUE regex: (?i).*(secretkey|secret_key|secrettoken|secret_token|clientsecret|client_secret)$ - focus-metavariable: $VALUE - patterns: - pattern-either: - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) - - ' + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: $KEY)\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: $KEY)\n" - metavariable-regex: metavariable: $KEY regex: (?i).*(secretkey|secret_key|secrettoken|secret_token|clientsecret|client_secret)$ - focus-metavariable: $KEY - patterns: - pattern-either: - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) - - ' + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: $KEY)\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: $KEY)\n" - metavariable-regex: metavariable: $VALUE regex: (?i).*(cryptkey|cryptokey|crypto_key|cryptionkey|symmetrickey|privatekey|symmetric_key|private_key)$ - focus-metavariable: $VALUE - patterns: - pattern-either: - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set("$VALUE", forKey: $KEY) - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: "$KEY") - - ' - - pattern: 'UserDefaults.standard.set($VALUE, forKey: $KEY) - - ' + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set(\"$VALUE\", forKey: $KEY)\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: \"$KEY\")\n" + - pattern: "UserDefaults.standard.set($VALUE, forKey: $KEY)\n" - metavariable-regex: metavariable: $KEY regex: (?i).*(cryptkey|cryptokey|crypto_key|cryptionkey|symmetrickey|privatekey|symmetric_key|private_key)$ - focus-metavariable: $KEY + severity: WARNING - id: terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version + languages: + - hcl + message: Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are + considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `"TLSv1.2_2018", + "TLSv1.2_2019", "TLSv1.2_2021", "TLSv1.2_2025" or "TLSv1.3_2025"`. + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + semgrep.dev: + rule: + origin: community + r_id: 17342 + rule_id: kxU6A8 + rv_id: 1263700 + url: + https://semgrep.dev/playground/r/5PTo1bY/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version + version_id: 5PTo1bY + shortlink: https://sg.run/Q6o4 + source: + https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version + subcategory: + - vuln + technology: + - terraform + - aws + vulnerability_class: + - Cryptographic Issues patterns: - pattern: "resource \"aws_cloudfront_distribution\" $ANYTHING {\n ...\n viewer_certificate {\n ...\n }\n ...\n}\n" - pattern-not-inside: "resource \"aws_cloudfront_distribution\" $ANYTHING {\n ...\n viewer_certificate {\n ...\n \ @@ -37993,916 +29057,895 @@ rules: \ minimum_protocol_version = \"TLSv1.2_2025\"\n ...\n }\n ...\n}\n" - pattern-not-inside: "resource \"aws_cloudfront_distribution\" $ANYTHING {\n ...\n viewer_certificate {\n ...\n \ \ minimum_protocol_version = \"TLSv1.3_2025\"\n ...\n }\n ...\n}\n" - message: Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered - insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `"TLSv1.2_2018", "TLSv1.2_2019", - "TLSv1.2_2021", "TLSv1.2_2025" or "TLSv1.3_2025"`. + severity: WARNING +- id: terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention + languages: + - hcl + message: The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important + event information. metadata: category: security - technology: - - terraform - - aws + confidence: MEDIUM + cwe: + - 'CWE-320: CWE CATEGORY: Key Management Errors' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-326: Inadequate Encryption Strength' references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + semgrep.dev: + rule: + origin: community + r_id: 17344 + rule_id: x8UGBG + rv_id: 946665 + url: + https://semgrep.dev/playground/r/BjT1N2B/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention + version_id: BjT1N2B + shortlink: https://sg.run/4lwl + source: + https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention subcategory: - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - aws + - terraform vulnerability_class: - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version - shortlink: https://sg.run/Q6o4 - semgrep.dev: - rule: - r_id: 17342 - rv_id: 1263700 - rule_id: kxU6A8 - version_id: 5PTo1bY - url: https://semgrep.dev/playground/r/5PTo1bY/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version - origin: community - languages: - - hcl - severity: WARNING -- id: terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention patterns: - pattern: "resource \"aws_cloudwatch_log_group\" $ANYTHING {\n ...\n}\n" - pattern-not-inside: "resource \"aws_cloudwatch_log_group\" $ANYTHING {\n ...\n retention_in_days = ...\n ...\n}\n" - message: The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event - information. + severity: WARNING +- id: terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted languages: - hcl - severity: WARNING + message: The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To + create your own, create a aws_kms_key resource or use the ARN string of a key in your account. metadata: - owasp: - - A03:2017 - Sensitive Data Exposure + category: security + confidence: MEDIUM cwe: - 'CWE-320: CWE CATEGORY: Key Management Errors' - technology: - - aws - - terraform - category: security - references: - - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention - shortlink: https://sg.run/4lwl - semgrep.dev: - rule: - r_id: 17344 - rv_id: 946665 - rule_id: x8UGBG - version_id: BjT1N2B - url: https://semgrep.dev/playground/r/BjT1N2B/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention - origin: community -- id: terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted - patterns: - - pattern: "resource \"aws_codebuild_project\" $ANYTHING {\n ...\n}\n" - - pattern-not-inside: "resource \"aws_codebuild_project\" $ANYTHING {\n ...\n encryption_key = ...\n ...\n}\n" - message: The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create - your own, create a aws_kms_key resource or use the ARN string of a key in your account. - languages: - - hcl - severity: WARNING - metadata: + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - cwe: - - 'CWE-320: CWE CATEGORY: Key Management Errors' - technology: - - aws - - terraform - category: security references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted - shortlink: https://sg.run/5yxA semgrep.dev: rule: + origin: community r_id: 17347 - rv_id: 946669 rule_id: v8U4kG + rv_id: 946669 + url: + https://semgrep.dev/playground/r/K3TJbNr/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted version_id: K3TJbNr - url: https://semgrep.dev/playground/r/K3TJbNr/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted - origin: community + shortlink: https://sg.run/5yxA + source: + https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted + subcategory: + - vuln + technology: + - aws + - terraform + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: "resource \"aws_codebuild_project\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_codebuild_project\" $ANYTHING {\n ...\n encryption_key = ...\n ...\n}\n" + severity: WARNING - id: terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions - pattern-either: - - pattern: "resource \"aws_config_configuration_aggregator\" $ANYTHING {\n ...\n account_aggregation_source {\n ...\n\ - \ regions = ...\n ...\n }\n ...\n}\n" - - pattern: "resource \"aws_config_configuration_aggregator\" $ANYTHING {\n ...\n organization_aggregation_source {\n \ - \ ...\n regions = ...\n ...\n }\n ...\n}\n" - message: The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration - in regions that are thought to be unused. Configure the aggregator with all_regions for the source. languages: - hcl - severity: WARNING + message: The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored + configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source. metadata: category: security - technology: - - terraform - - aws + confidence: HIGH + cwe: + - 'CWE-778: Insufficient Logging' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A09:2021 - Security Logging and Monitoring Failures - A09:2025 - Security Logging & Alerting Failures - cwe: - - 'CWE-778: Insufficient Logging' references: - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/ - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insufficient Logging - source: https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions - shortlink: https://sg.run/O6A7 semgrep.dev: rule: + origin: community r_id: 47275 - rv_id: 1263703 rule_id: DbUo7v + rv_id: 1263703 + url: + https://semgrep.dev/playground/r/A8Tgdwv/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions version_id: A8Tgdwv - url: https://semgrep.dev/playground/r/A8Tgdwv/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions - origin: community + shortlink: https://sg.run/O6A7 + source: + https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions + subcategory: + - audit + technology: + - terraform + - aws + vulnerability_class: + - Insufficient Logging + pattern-either: + - pattern: "resource \"aws_config_configuration_aggregator\" $ANYTHING {\n ...\n account_aggregation_source {\n ...\n\ + \ regions = ...\n ...\n }\n ...\n}\n" + - pattern: "resource \"aws_config_configuration_aggregator\" $ANYTHING {\n ...\n organization_aggregation_source {\n \ + \ ...\n regions = ...\n ...\n }\n ...\n}\n" + severity: WARNING - id: terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging - patterns: - - pattern: "resource \"aws_db_instance\" $ANYTHING {\n ...\n}\n" - - pattern-not-inside: "resource \"aws_db_instance\" $ANYTHING {\n ...\n enabled_cloudwatch_logs_exports = [$SOMETHING,\ - \ ...]\n ...\n}\n" - message: Database instance has no logging. Missing logs can cause missing important event information. languages: - hcl - severity: WARNING + message: Database instance has no logging. Missing logs can cause missing important event information. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A04:2021 - Insecure Design - A06:2025 - Insecure Design - cwe: - - 'CWE-311: Missing Encryption of Sensitive Data' - technology: - - aws - - terraform - category: security references: - https://owasp.org/Top10/A04_2021-Insecure_Design - subcategory: - - vuln - likelihood: MEDIUM - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging - shortlink: https://sg.run/GyAp semgrep.dev: rule: + origin: community r_id: 17348 - rv_id: 1263704 rule_id: d8U4RA + rv_id: 1263704 + url: + https://semgrep.dev/playground/r/BjTkZ6j/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging version_id: BjTkZ6j - url: https://semgrep.dev/playground/r/BjTkZ6j/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging - origin: community -- id: terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled + shortlink: https://sg.run/GyAp + source: https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging + subcategory: + - vuln + technology: + - aws + - terraform + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: "resource \"aws_docdb_cluster\" $ANYTHING {\n ...\n}\n" - - pattern-not-inside: "resource \"aws_docdb_cluster\" $ANYTHING {\n ...\n enabled_cloudwatch_logs_exports = [..., \"audit\"\ - , ...]\n ...\n}\n" - message: Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB - cluster, you should enable auditing and export logs to CloudWatch. + - pattern: "resource \"aws_db_instance\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_db_instance\" $ANYTHING {\n ...\n enabled_cloudwatch_logs_exports = [$SOMETHING, + ...]\n ...\n}\n" + severity: WARNING +- id: terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled languages: - hcl - severity: INFO + message: Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your + DocumentDB cluster, you should enable auditing and export logs to CloudWatch. metadata: category: security - technology: - - terraform - - aws + confidence: MEDIUM + cwe: + - 'CWE-778: Insufficient Logging' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A09:2021 - Security Logging and Monitoring Failures - A09:2025 - Security Logging & Alerting Failures - cwe: - - 'CWE-778: Insufficient Logging' references: - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/ - subcategory: - - audit - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insufficient Logging - source: https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled - shortlink: https://sg.run/xJYP semgrep.dev: rule: + origin: community r_id: 48630 - rv_id: 1263705 rule_id: AbU1WN + rv_id: 1263705 + url: + https://semgrep.dev/playground/r/DkTRbA4/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled version_id: DkTRbA4 - url: https://semgrep.dev/playground/r/DkTRbA4/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled - origin: community -- id: terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted + shortlink: https://sg.run/xJYP + source: + https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled + subcategory: + - audit + technology: + - terraform + - aws + vulnerability_class: + - Insufficient Logging patterns: - - pattern: "resource \"aws_dynamodb_table\" $ANYTHING {\n ...\n}\n" - - pattern-not-inside: "resource \"aws_dynamodb_table\" $ANYTHING {\n ...\n server_side_encryption {\n enabled = true\n\ - \ kms_key_arn = ...\n }\n ...\n}\n" - message: By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended - to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key - resource or use the ARN of an existing key in your AWS account to do so. + - pattern: "resource \"aws_docdb_cluster\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_docdb_cluster\" $ANYTHING {\n ...\n enabled_cloudwatch_logs_exports = [..., \"audit\"\ + , ...]\n ...\n}\n" + severity: INFO +- id: terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted languages: - hcl - severity: WARNING + message: By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's + recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either + create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-326: Inadequate Encryption Strength' - technology: - - aws - - terraform - category: security references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted - shortlink: https://sg.run/Ay4p semgrep.dev: rule: + origin: community r_id: 17350 - rv_id: 1263707 rule_id: nJUGe2 + rv_id: 1263707 + url: + https://semgrep.dev/playground/r/0bTKzj8/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted version_id: 0bTKzj8 - url: https://semgrep.dev/playground/r/0bTKzj8/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted - origin: community -- id: terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk + shortlink: https://sg.run/Ay4p + source: https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted + subcategory: + - vuln + technology: + - aws + - terraform + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: "resource \"aws_ebs_snapshot_copy\" $ANYTHING {\n ...\n encrypted = true\n ...\n}\n" - - pattern-not-inside: "resource \"aws_ebs_snapshot_copy\" $ANYTHING {\n ...\n encrypted = true\n kms_key_id = ...\n \ - \ ...\n}\n" - message: Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms - of access and rotation. + - pattern: "resource \"aws_dynamodb_table\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_dynamodb_table\" $ANYTHING {\n ...\n server_side_encryption {\n enabled = true\n\ + \ kms_key_arn = ...\n }\n ...\n}\n" + severity: WARNING +- id: terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk + languages: + - hcl + message: Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in + terms of access and rotation. metadata: category: security - technology: - - terraform - - aws - owasp: - - A03:2017 - Sensitive Data Exposure + confidence: MEDIUM cwe: - 'CWE-320: CWE CATEGORY: Key Management Errors' - references: - - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk - shortlink: https://sg.run/ByPW + likelihood: MEDIUM + owasp: + - A03:2017 - Sensitive Data Exposure + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures semgrep.dev: rule: + origin: community r_id: 17351 - rv_id: 946677 rule_id: EwUqko + rv_id: 946677 + url: + https://semgrep.dev/playground/r/A8TJzb0/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk version_id: A8TJzb0 - url: https://semgrep.dev/playground/r/A8TJzb0/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk - origin: community - languages: - - hcl + shortlink: https://sg.run/ByPW + source: + https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk + subcategory: + - vuln + technology: + - terraform + - aws + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: "resource \"aws_ebs_snapshot_copy\" $ANYTHING {\n ...\n encrypted = true\n ...\n}\n" + - pattern-not-inside: "resource \"aws_ebs_snapshot_copy\" $ANYTHING {\n ...\n encrypted = true\n kms_key_id = ...\n \ + \ ...\n}\n" severity: WARNING - id: terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted - patterns: - - pattern: "resource \"aws_ebs_encryption_by_default\" $ANYTHING {\n ...\n enabled = false\n ...\n}\n" - message: The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS. languages: - hcl - severity: WARNING + message: The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS. metadata: - owasp: - - A03:2017 - Sensitive Data Exposure + category: security + confidence: MEDIUM cwe: - 'CWE-320: CWE CATEGORY: Key Management Errors' - technology: - - aws - - terraform - category: security - references: - - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted - shortlink: https://sg.run/Dy5Y + likelihood: MEDIUM + owasp: + - A03:2017 - Sensitive Data Exposure + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures semgrep.dev: rule: + origin: community r_id: 17352 - rv_id: 946678 rule_id: 7KUW7K - version_id: BjT1N2v + rv_id: 946678 url: https://semgrep.dev/playground/r/BjT1N2v/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted - origin: community -- id: terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted + version_id: BjT1N2v + shortlink: https://sg.run/Dy5Y + source: https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted + subcategory: + - vuln + technology: + - aws + - terraform + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: "resource \"aws_ebs_volume\" $ANYTHING {\n ...\n}\n" - - pattern-not: "resource \"aws_ebs_volume\" $ANYTHING {\n ...\n encrypted = true\n ...\n}\n" - message: The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. - Volumes should be encrypted to ensure sensitive data is stored securely. + - pattern: "resource \"aws_ebs_encryption_by_default\" $ANYTHING {\n ...\n enabled = false\n ...\n}\n" + severity: WARNING +- id: terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted languages: - hcl - severity: WARNING + message: The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if + compromised. Volumes should be encrypted to ensure sensitive data is stored securely. metadata: category: security - technology: - - terraform - - aws + confidence: MEDIUM + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A04:2021 - Insecure Design - A06:2025 - Insecure Design - cwe: - - 'CWE-311: Missing Encryption of Sensitive Data' references: - https://owasp.org/Top10/A04_2021-Insecure_Design - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html - subcategory: - - audit - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted - shortlink: https://sg.run/6ZbY semgrep.dev: rule: + origin: community r_id: 50759 - rv_id: 1263708 rule_id: YGUKl1 + rv_id: 1263708 + url: + https://semgrep.dev/playground/r/K3TKk1Z/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted version_id: K3TKk1Z - url: https://semgrep.dev/playground/r/K3TKk1Z/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted - origin: community -- id: terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip - patterns: - - pattern-either: - - pattern: "resource \"aws_instance\" $ANYTHING {\n ...\n associate_public_ip_address = true\n ...\n}\n" - - pattern: "resource \"aws_launch_template\" $ANYTHING {\n ...\n network_interfaces {\n ...\n associate_public_ip_address\ - \ = true\n ...\n }\n ...\n}\n" - message: EC2 instances should not have a public IP address attached in order to block public access to the instances. To - fix this, set your `associate_public_ip_address` to `"false"`. - metadata: - category: security + shortlink: https://sg.run/6ZbY + source: https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted + subcategory: + - audit technology: - terraform - aws + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: "resource \"aws_ebs_volume\" $ANYTHING {\n ...\n}\n" + - pattern-not: "resource \"aws_ebs_volume\" $ANYTHING {\n ...\n encrypted = true\n ...\n}\n" + severity: WARNING +- id: terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip + languages: + - hcl + message: EC2 instances should not have a public IP address attached in order to block public access to the instances. + To fix this, set your `associate_public_ip_address` to `"false"`. + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-1220: Insufficient Granularity of Access Control' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-1220: Insufficient Granularity of Access Control' references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip - shortlink: https://sg.run/08rv semgrep.dev: rule: + origin: community r_id: 17354 - rv_id: 1263709 rule_id: 8GUA2n - version_id: qkTR73G + rv_id: 1263709 url: https://semgrep.dev/playground/r/qkTR73G/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip - origin: community - languages: - - hcl - severity: WARNING -- id: terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled + version_id: qkTR73G + shortlink: https://sg.run/08rv + source: https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip + subcategory: + - vuln + technology: + - terraform + - aws + vulnerability_class: + - Other patterns: - - pattern: "resource \"aws_launch_template\" $ANYTHING {\n ...\n}\n" - - pattern-not-inside: "resource \"aws_launch_template\" $ANYTHING {\n ...\n metadata_options {\n ...\n http_endpoint\ - \ = \"disabled\"\n ...\n }\n ...\n}\n" - - pattern-not-inside: "resource \"aws_launch_template\" $ANYTHING {\n ...\n metadata_options {\n ...\n http_tokens\ - \ = \"required\"\n ...\n }\n ...\n}\n" - message: The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication - tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2. + - pattern-either: + - pattern: "resource \"aws_instance\" $ANYTHING {\n ...\n associate_public_ip_address = true\n ...\n}\n" + - pattern: "resource \"aws_launch_template\" $ANYTHING {\n ...\n network_interfaces {\n ...\n associate_public_ip_address + = true\n ...\n }\n ...\n}\n" + severity: WARNING +- id: + terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled languages: - hcl - severity: WARNING + message: The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session + authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use + of IMDSv2. metadata: category: security - technology: - - terraform - - aws - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures + confidence: MEDIUM cwe: - 'CWE-1390: Weak Authentication' - references: - - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/ - - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options - - https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service - subcategory: - - audit - likelihood: LOW impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled - shortlink: https://sg.run/pg9J + likelihood: LOW + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options + - https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service semgrep.dev: rule: + origin: community r_id: 50762 - rv_id: 1263712 rule_id: zdU0Wo + rv_id: 1263712 + url: + https://semgrep.dev/playground/r/JdTzx88/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled version_id: JdTzx88 - url: https://semgrep.dev/playground/r/JdTzx88/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled - origin: community -- id: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags + shortlink: https://sg.run/pg9J + source: + https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled + subcategory: + - audit + technology: + - terraform + - aws + vulnerability_class: + - Improper Authentication patterns: - - pattern: "resource \"aws_ecr_repository\" $ANYTHING {\n ...\n}\n" - - pattern-not-inside: "resource \"aws_ecr_repository\" $ANYTHING {\n ...\n image_tag_mutability = \"IMMUTABLE\"\n ...\n\ - }\n" - message: The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should - be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` - to IMMUTABLE. + - pattern: "resource \"aws_launch_template\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_launch_template\" $ANYTHING {\n ...\n metadata_options {\n ...\n http_endpoint + = \"disabled\"\n ...\n }\n ...\n}\n" + - pattern-not-inside: "resource \"aws_launch_template\" $ANYTHING {\n ...\n metadata_options {\n ...\n http_tokens + = \"required\"\n ...\n }\n ...\n}\n" + severity: WARNING +- id: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags languages: - hcl - severity: WARNING + message: The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images + should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting + `image_tag_mutability` to IMMUTABLE. metadata: category: security - technology: - - terraform - - aws + confidence: MEDIUM + cwe: + - 'CWE-345: Insufficient Verification of Data Authenticity' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - cwe: - - 'CWE-345: Insufficient Verification of Data Authenticity' references: - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/ - subcategory: - - audit - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags - shortlink: https://sg.run/ZEeL semgrep.dev: rule: + origin: community r_id: 48635 - rv_id: 1263716 rule_id: KxUB4o + rv_id: 1263716 + url: + https://semgrep.dev/playground/r/A8Tgdwd/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags version_id: A8Tgdwd - url: https://semgrep.dev/playground/r/A8Tgdwd/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags - origin: community -- id: terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal + shortlink: https://sg.run/ZEeL + source: https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags + subcategory: + - audit + technology: + - terraform + - aws + vulnerability_class: + - Improper Authentication patterns: - - pattern-inside: "resource \"aws_ecr_repository_policy\" $ANYTHING {\n ...\n}\n" - - pattern-either: - - patterns: - - pattern: policy = "$JSONPOLICY" - - metavariable-pattern: - metavariable: $JSONPOLICY - language: json - patterns: - - pattern-not-inside: '{..., "Effect": "Deny", ...} - - ' - - pattern-either: - - pattern: '{..., "Principal": "*", ...} - - ' - - pattern: '{..., "Principal": [..., "*", ...], ...} - - ' - - pattern: '{..., "Principal": { "AWS": "*" }, ...} - - ' - - pattern: '{..., "Principal": { "AWS": [..., "*", ...] }, ...} - - ' - - patterns: - - pattern-inside: policy = jsonencode(...) - - pattern-not-inside: '{..., Effect = "Deny", ...} - - ' - - pattern-either: - - pattern: '{..., Principal = "*", ...} - - ' - - pattern: '{..., Principal = [..., "*", ...], ...} - - ' - - pattern: '{..., Principal = { AWS = "*" }, ...} - - ' - - pattern: '{..., Principal = { AWS = [..., "*", ...] }, ...} - - ' - message: Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including - anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least - privilege. + - pattern: "resource \"aws_ecr_repository\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"aws_ecr_repository\" $ANYTHING {\n ...\n image_tag_mutability = \"IMMUTABLE\"\n ...\n\ + }\n" + severity: WARNING +- id: terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal + languages: + - hcl + message: Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, + including anonymous users (public access). Instead, limit principals, actions and resources to what you need + according to least privilege. metadata: category: security - technology: - - aws - - terraform + confidence: MEDIUM + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - cwe: - - 'CWE-732: Incorrect Permission Assignment for Critical Resource' references: - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy - https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html - https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html - https://cwe.mitre.org/data/definitions/732.html - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal - shortlink: https://sg.run/nzqb semgrep.dev: rule: + origin: community r_id: 48636 - rv_id: 1263717 rule_id: qNUzov + rv_id: 1263717 + url: + https://semgrep.dev/playground/r/BjTkZ6A/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal version_id: BjTkZ6A - url: https://semgrep.dev/playground/r/BjTkZ6A/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal - origin: community - languages: - - hcl + shortlink: https://sg.run/nzqb + source: + https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal + subcategory: + - vuln + technology: + - aws + - terraform + vulnerability_class: + - Improper Authorization + patterns: + - pattern-inside: "resource \"aws_ecr_repository_policy\" $ANYTHING {\n ...\n}\n" + - pattern-either: + - patterns: + - pattern: policy = "$JSONPOLICY" + - metavariable-pattern: + language: json + metavariable: $JSONPOLICY + patterns: + - pattern-not-inside: "{..., \"Effect\": \"Deny\", ...}\n" + - pattern-either: + - pattern: "{..., \"Principal\": \"*\", ...}\n" + - pattern: "{..., \"Principal\": [..., \"*\", ...], ...}\n" + - pattern: "{..., \"Principal\": { \"AWS\": \"*\" }, ...}\n" + - pattern: "{..., \"Principal\": { \"AWS\": [..., \"*\", ...] }, ...}\n" + - patterns: + - pattern-inside: policy = jsonencode(...) + - pattern-not-inside: "{..., Effect = \"Deny\", ...}\n" + - pattern-either: + - pattern: "{..., Principal = \"*\", ...}\n" + - pattern: "{..., Principal = [..., \"*\", ...], ...}\n" + - pattern: "{..., Principal = { AWS = \"*\" }, ...}\n" + - pattern: "{..., Principal = { AWS = [..., \"*\", ...] }, ...}\n" severity: WARNING - id: terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk - patterns: - - pattern: "resource \"aws_efs_file_system\" $ANYTHING {\n ...\n encrypted = true\n ...\n}\n" - - pattern-not-inside: "resource \"aws_efs_file_system\" $ANYTHING {\n ...\n encrypted = true\n kms_key_id = ...\n ...\n\ - }\n" - message: Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms - of access and rotation. + languages: + - hcl + message: Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in + terms of access and rotation. metadata: category: security - technology: - - terraform - - aws - owasp: - - A03:2017 - Sensitive Data Exposure + confidence: MEDIUM cwe: - 'CWE-320: CWE CATEGORY: Key Management Errors' - references: - - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - audit - likelihood: MEDIUM impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk - shortlink: https://sg.run/Kk07 + likelihood: MEDIUM + owasp: + - A03:2017 - Sensitive Data Exposure + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures semgrep.dev: rule: + origin: community r_id: 17355 - rv_id: 946690 rule_id: gxUJ4n + rv_id: 946690 + url: + https://semgrep.dev/playground/r/2KTYbWy/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk version_id: 2KTYbWy - url: https://semgrep.dev/playground/r/2KTYbWy/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk - origin: community - languages: - - hcl + shortlink: https://sg.run/Kk07 + source: + https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk + subcategory: + - audit + technology: + - terraform + - aws + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: "resource \"aws_efs_file_system\" $ANYTHING {\n ...\n encrypted = true\n ...\n}\n" + - pattern-not-inside: "resource \"aws_efs_file_system\" $ANYTHING {\n ...\n encrypted = true\n kms_key_id = ...\n ...\n\ + }\n" severity: WARNING - id: terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version - pattern: "resource \"aws_elasticsearch_domain\" $ANYTHING {\n ...\n domain_endpoint_options {\n ...\n enforce_https\ - \ = true\n tls_security_policy = \"Policy-Min-TLS-1-0-2019-07\"\n ...\n }\n ...\n}\n" - message: Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set "tls_security_policy" equal - to "Policy-Min-TLS-1-2-2019-07". languages: - terraform - severity: WARNING + message: Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set "tls_security_policy" + equal to "Policy-Min-TLS-1-2-2019-07". metadata: + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - category: security - technology: - - aws - - terraform references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version - shortlink: https://sg.run/PYlq semgrep.dev: rule: + origin: community r_id: 19045 - rv_id: 1263718 rule_id: YGUle7 + rv_id: 1263718 + url: + https://semgrep.dev/playground/r/DkTRbA5/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version version_id: DkTRbA5 - url: https://semgrep.dev/playground/r/DkTRbA5/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version - origin: community + shortlink: https://sg.run/PYlq + source: + https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version + subcategory: + - vuln + technology: + - aws + - terraform + vulnerability_class: + - Cryptographic Issues + pattern: "resource \"aws_elasticsearch_domain\" $ANYTHING {\n ...\n domain_endpoint_options {\n ...\n enforce_https + = true\n tls_security_policy = \"Policy-Min-TLS-1-0-2019-07\"\n ...\n }\n ...\n}\n" + severity: WARNING - id: terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled - patterns: - - pattern-either: - - pattern: "resource \"aws_elasticsearch_domain\" $ANYTHING {\n ...\n node_to_node_encryption {\n ...\n enabled\ - \ = false\n ...\n }\n ...\n}\n" - - pattern: "resource \"aws_elasticsearch_domain\" $ANYTHING {\n ...\n cluster_config {\n ...\n instance_count\ - \ = $COUNT\n ...\n }\n}\n" - - pattern-not-inside: "resource \"aws_elasticsearch_domain\" $ANYTHING {\n ...\n cluster_config {\n ...\n instance_count\ - \ = $COUNT\n ...\n }\n node_to_node_encryption {\n ...\n enabled = true\n ...\n }\n}\n" - - metavariable-comparison: - metavariable: $COUNT - comparison: $COUNT > 1 + languages: + - hcl message: "Ensure all Elasticsearch has node-to-node encryption enabled.\t" metadata: category: security - technology: - - terraform - - aws + confidence: MEDIUM + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-326: Inadequate Encryption Strength' references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + semgrep.dev: + rule: + origin: community + r_id: 17357 + rule_id: 3qU6J7 + rv_id: 1263719 + url: + https://semgrep.dev/playground/r/WrTqK0v/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled + version_id: WrTqK0v + shortlink: https://sg.run/lp3y + source: + https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled subcategory: - vuln - likelihood: LOW + technology: + - terraform + - aws + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern-either: + - pattern: "resource \"aws_elasticsearch_domain\" $ANYTHING {\n ...\n node_to_node_encryption {\n ...\n enabled + = false\n ...\n }\n ...\n}\n" + - pattern: "resource \"aws_elasticsearch_domain\" $ANYTHING {\n ...\n cluster_config {\n ...\n instance_count + = $COUNT\n ...\n }\n}\n" + - pattern-not-inside: "resource \"aws_elasticsearch_domain\" $ANYTHING {\n ...\n cluster_config {\n ...\n instance_count + = $COUNT\n ...\n }\n node_to_node_encryption {\n ...\n enabled = true\n ...\n }\n}\n" + - metavariable-comparison: + comparison: $COUNT > 1 + metavariable: $COUNT + severity: WARNING +- id: terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal + languages: + - hcl + message: 'Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions + on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam:::`.' + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + cwe2021-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled - shortlink: https://sg.run/lp3y + likelihood: MEDIUM + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://cwe.mitre.org/data/definitions/732.html semgrep.dev: rule: - r_id: 17357 - rv_id: 1263719 - rule_id: 3qU6J7 - version_id: WrTqK0v - url: https://semgrep.dev/playground/r/WrTqK0v/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled origin: community - languages: - - hcl - severity: WARNING -- id: terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal + r_id: 17364 + rule_id: AbUeYK + rv_id: 1263723 + url: + https://semgrep.dev/playground/r/l4TJRGB/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal + version_id: l4TJRGB + shortlink: https://sg.run/XN9K + source: https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal + subcategory: + - vuln + technology: + - aws + vulnerability_class: + - Improper Authorization patterns: - pattern-inside: "resource \"aws_glacier_vault\" $ANYTHING {\n ...\n}\n" - pattern: access_policy = "$STATEMENT" - metavariable-pattern: - metavariable: $STATEMENT language: json + metavariable: $STATEMENT patterns: - - pattern-inside: '{..., "Effect": "Allow", ...} - - ' + - pattern-inside: "{..., \"Effect\": \"Allow\", ...}\n" - pattern-either: - - pattern: '"Principal": "*" - - ' - - pattern: '"Principal": {..., "AWS": "*", ...} - - ' - - pattern-inside: '"Principal": {..., "AWS": ..., ...} - - ' - - pattern-regex: '(^\"arn:aws:iam::\*:(.*)\"$) - - ' - message: 'Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions - on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam:::`.' + - pattern: "\"Principal\": \"*\"\n" + - pattern: "\"Principal\": {..., \"AWS\": \"*\", ...}\n" + - pattern-inside: "\"Principal\": {..., \"AWS\": ..., ...}\n" + - pattern-regex: "(^\\\"arn:aws:iam::\\*:(.*)\\\"$)\n" + severity: ERROR +- id: terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin + languages: + - hcl + message: Detected admin access granted in your policy. This means anyone with this policy can perform administrative + actions. Instead, limit actions and resources to what you need according to least privilege. metadata: category: security - technology: - - aws + confidence: MEDIUM + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - cwe: - - 'CWE-732: Incorrect Permission Assignment for Critical Resource' references: - https://cwe.mitre.org/data/definitions/732.html - cwe2021-top25: true + semgrep.dev: + rule: + origin: community + r_id: 17365 + rule_id: BYUzY5 + rv_id: 1263724 + url: + https://semgrep.dev/playground/r/YDTZe9q/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin + version_id: YDTZe9q + shortlink: https://sg.run/jzgY + source: https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin subcategory: - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - aws vulnerability_class: - Improper Authorization - source: https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal - shortlink: https://sg.run/XN9K - semgrep.dev: - rule: - r_id: 17364 - rv_id: 1263723 - rule_id: AbUeYK - version_id: l4TJRGB - url: https://semgrep.dev/playground/r/l4TJRGB/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal - origin: community - languages: - - hcl - severity: ERROR -- id: terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin patterns: - pattern-inside: "resource \"aws_ssoadmin_permission_set_inline_policy\" $ANYTHING {\n ...\n}\n" - pattern: inline_policy = "$STATEMENT" - metavariable-pattern: - metavariable: $STATEMENT language: json + metavariable: $STATEMENT patterns: - - pattern-not-inside: '{..., "Effect": "Deny", ...} - - ' + - pattern-not-inside: "{..., \"Effect\": \"Deny\", ...}\n" - pattern-either: - - pattern: '{..., "Action": [..., "*", ...], "Resource": [..., "*", ...], ...} - - ' - - pattern: '{..., "Action": "*", "Resource": "*", ...} - - ' - - pattern: '{..., "Action": "*", "Resource": [...], ...} - - ' - - pattern: '{..., "Action": [...], "Resource": "*", ...} - - ' - message: Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. - Instead, limit actions and resources to what you need according to least privilege. + - pattern: "{..., \"Action\": [..., \"*\", ...], \"Resource\": [..., \"*\", ...], ...}\n" + - pattern: "{..., \"Action\": \"*\", \"Resource\": \"*\", ...}\n" + - pattern: "{..., \"Action\": \"*\", \"Resource\": [...], ...}\n" + - pattern: "{..., \"Action\": [...], \"Resource\": \"*\", ...}\n" + severity: ERROR +- id: terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy + languages: + - hcl + message: Detected admin access granted in your policy. This means anyone with this policy can perform administrative + actions. Instead, limit actions and resources to what you need according to least privilege. metadata: category: security - technology: - - aws + confidence: MEDIUM + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - cwe: - - 'CWE-732: Incorrect Permission Assignment for Critical Resource' references: - https://cwe.mitre.org/data/definitions/732.html - cwe2021-top25: true + semgrep.dev: + rule: + origin: community + r_id: 17366 + rule_id: DbUx8l + rv_id: 1263725 + url: https://semgrep.dev/playground/r/6xT29Pv/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy + version_id: 6xT29Pv + shortlink: https://sg.run/1zbw + source: https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy subcategory: - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - aws + - terraform vulnerability_class: - Improper Authorization - source: https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin - shortlink: https://sg.run/jzgY - semgrep.dev: - rule: - r_id: 17365 - rv_id: 1263724 - rule_id: BYUzY5 - version_id: YDTZe9q - url: https://semgrep.dev/playground/r/YDTZe9q/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin - origin: community - languages: - - hcl - severity: ERROR -- id: terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy patterns: - pattern-inside: "resource \"aws_iam_policy\" $ANYTHING {\n ...\n}\n" - pattern: policy = "$STATEMENT" - metavariable-pattern: - metavariable: $STATEMENT language: json + metavariable: $STATEMENT patterns: - - pattern-not-inside: '{..., "Effect": "Deny", ...} - - ' + - pattern-not-inside: "{..., \"Effect\": \"Deny\", ...}\n" - pattern-either: - - pattern: '{..., "Action": [..., "*", ...], "Resource": [..., "*", ...], ...} - - ' - - pattern: '{..., "Action": "*", "Resource": "*", ...} - - ' - - pattern: '{..., "Action": "*", "Resource": [...], ...} - - ' - - pattern: '{..., "Action": [...], "Resource": "*", ...} - - ' - message: Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. - Instead, limit actions and resources to what you need according to least privilege. + - pattern: "{..., \"Action\": [..., \"*\", ...], \"Resource\": [..., \"*\", ...], ...}\n" + - pattern: "{..., \"Action\": \"*\", \"Resource\": \"*\", ...}\n" + - pattern: "{..., \"Action\": \"*\", \"Resource\": [...], ...}\n" + - pattern: "{..., \"Action\": [...], \"Resource\": \"*\", ...}\n" + severity: ERROR +- id: terraform.aws.security.aws-insecure-api-gateway-tls-version.aws-insecure-api-gateway-tls-version + languages: + - terraform + message: Detected AWS API Gateway to be using an insecure version of TLS. To fix this issue make sure to set + "security_policy" equal to "TLS_1_2". metadata: category: security - technology: - - aws - - terraform - owasp: - - A05:2021 - Security Misconfiguration - - A02:2025 - Security Misconfiguration + confidence: MEDIUM cwe: - - 'CWE-732: Incorrect Permission Assignment for Critical Resource' - references: - - https://cwe.mitre.org/data/definitions/732.html - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + - 'CWE-326: Inadequate Encryption Strength' impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy - shortlink: https://sg.run/1zbw + likelihood: MEDIUM + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures semgrep.dev: rule: - r_id: 17366 - rv_id: 1263725 - rule_id: DbUx8l - version_id: 6xT29Pv - url: https://semgrep.dev/playground/r/6xT29Pv/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy origin: community - languages: - - hcl - severity: ERROR -- id: terraform.aws.security.aws-insecure-api-gateway-tls-version.aws-insecure-api-gateway-tls-version + r_id: 18818 + rule_id: v8UOle + rv_id: 1263726 + url: + https://semgrep.dev/playground/r/o5TbD8k/terraform.aws.security.aws-insecure-api-gateway-tls-version.aws-insecure-api-gateway-tls-version + version_id: o5TbD8k + shortlink: https://sg.run/p98J + source: + https://semgrep.dev/r/terraform.aws.security.aws-insecure-api-gateway-tls-version.aws-insecure-api-gateway-tls-version + subcategory: + - vuln + technology: + - aws + - terraform + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - pattern: "resource \"aws_api_gateway_domain_name\" $ANYTHING {\n ...\n security_policy = \"...\"\n ...\n}\n" @@ -38912,503 +29955,506 @@ rules: \n ...\n }\n" - pattern-not: "resource \"aws_apigatewayv2_domain_name\" $ANYTHING {\n ...\n domain_name_configuration {\n\ \ ...\n security_policy = \"TLS_1_2\"\n ...\n }\n }\n" - message: Detected AWS API Gateway to be using an insecure version of TLS. To fix this issue make sure to set "security_policy" - equal to "TLS_1_2". - languages: - - terraform severity: WARNING +- id: terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration + languages: + - hcl + message: Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `"true"`. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - category: security - technology: - - aws - - terraform references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + semgrep.dev: + rule: + origin: community + r_id: 17368 + rule_id: 0oUrOj + rv_id: 1263727 + url: + https://semgrep.dev/playground/r/zyTb27A/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration + version_id: zyTb27A + shortlink: https://sg.run/yPYx + source: + https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration subcategory: - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - terraform + - aws vulnerability_class: - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-insecure-api-gateway-tls-version.aws-insecure-api-gateway-tls-version - shortlink: https://sg.run/p98J - semgrep.dev: - rule: - r_id: 18818 - rv_id: 1263726 - rule_id: v8UOle - version_id: o5TbD8k - url: https://semgrep.dev/playground/r/o5TbD8k/terraform.aws.security.aws-insecure-api-gateway-tls-version.aws-insecure-api-gateway-tls-version - origin: community -- id: terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration patterns: - pattern: "resource \"aws_redshift_parameter_group\" $ANYTHING {\n ...\n}\n" - pattern-not-inside: "resource \"aws_redshift_parameter_group\" $ANYTHING {\n ...\n parameter {\n name = \"require_ssl\"\ \n value = \"true\"\n }\n ...\n}\n" - pattern-not-inside: "resource \"aws_redshift_parameter_group\" $ANYTHING {\n ...\n parameter {\n name = \"require_ssl\"\ \n value = true\n }\n ...\n}\n" - message: Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `"true"`. - metadata: - category: security - technology: - - terraform - - aws - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-326: Inadequate Encryption Strength' - references: - - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration - shortlink: https://sg.run/yPYx - semgrep.dev: - rule: - r_id: 17368 - rv_id: 1263727 - rule_id: 0oUrOj - version_id: zyTb27A - url: https://semgrep.dev/playground/r/zyTb27A/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration - origin: community - languages: - - hcl - severity: WARNING -- id: terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted - patterns: - - pattern: "resource \"aws_kinesis_stream\" $ANYTHING {\n ...\n}\n" - - pattern-not: "resource \"aws_kinesis_stream\" $ANYTHING {\n ...\n encryption_type = \"KMS\"\n ...\n}\n" - message: The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer - is compromised. Enable Kinesis stream server-side encryption. + severity: WARNING +- id: terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted languages: - hcl - severity: WARNING + message: The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage + layer is compromised. Enable Kinesis stream server-side encryption. metadata: category: security - technology: - - terraform - - aws + confidence: MEDIUM + cwe: + - 'CWE-311: Missing Encryption of Sensitive Data' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A04:2021 - Insecure Design - A06:2025 - Insecure Design - cwe: - - 'CWE-311: Missing Encryption of Sensitive Data' references: - https://owasp.org/Top10/A04_2021-Insecure_Design - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type - https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html - subcategory: - - audit - likelihood: LOW - impact: HIGH - confidence: MEDIUM rule-origin-note: published from /src/aws-kinesis-stream-unencrypted.yml in None - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted - shortlink: https://sg.run/KZ0L semgrep.dev: rule: + origin: community r_id: 52199 - rv_id: 1263728 rule_id: 8GU72N + rv_id: 1263728 + url: + https://semgrep.dev/playground/r/pZT037O/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted version_id: pZT037O - url: https://semgrep.dev/playground/r/pZT037O/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted - origin: community -- id: terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal + shortlink: https://sg.run/KZ0L + source: https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted + subcategory: + - audit + technology: + - terraform + - aws + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: "resource \"aws_kms_key\" $ANYTHING {\n ...\n}\n" - - pattern: policy = "$STATEMENT" - - metavariable-pattern: - metavariable: $STATEMENT - language: json - patterns: - - pattern-not-inside: '{..., "Effect": "Deny", ...} - - ' - - pattern-either: - - pattern: '{..., "Principal": "*", "Action": "kms:*", "Resource": "*", ...} - - ' - - pattern: '{..., "Principal": [..., "*", ...], "Action": "kms:*", "Resource": "*", ...} - - ' - - pattern: '{..., "Principal": { "AWS": "*" }, "Action": "kms:*", "Resource": "*", ...} - - ' - - pattern: '{..., "Principal": { "AWS": [..., "*", ...] }, "Action": "kms:*", "Resource": "*", ...} - - ' - message: Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative - actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege. + - pattern: "resource \"aws_kinesis_stream\" $ANYTHING {\n ...\n}\n" + - pattern-not: "resource \"aws_kinesis_stream\" $ANYTHING {\n ...\n encryption_type = \"KMS\"\n ...\n}\n" + severity: WARNING +- id: terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal + languages: + - hcl + message: Detected wildcard access granted in your KMS key. This means anyone with this policy can perform + administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to + least privilege. metadata: category: security - technology: - - aws - - terraform - owasp: - - A05:2021 - Security Misconfiguration - - A02:2025 - Security Misconfiguration + confidence: MEDIUM cwe: - 'CWE-732: Incorrect Permission Assignment for Critical Resource' - references: - - https://cwe.mitre.org/data/definitions/732.html cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal - shortlink: https://sg.run/Nwlp + likelihood: MEDIUM + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://cwe.mitre.org/data/definitions/732.html semgrep.dev: rule: + origin: community r_id: 17371 - rv_id: 1263729 rule_id: lBUWPD + rv_id: 1263729 + url: + https://semgrep.dev/playground/r/2KTv2J4/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal version_id: 2KTv2J4 - url: https://semgrep.dev/playground/r/2KTv2J4/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal - origin: community - languages: - - hcl + shortlink: https://sg.run/Nwlp + source: https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal + subcategory: + - vuln + technology: + - aws + - terraform + vulnerability_class: + - Improper Authorization + patterns: + - pattern-inside: "resource \"aws_kms_key\" $ANYTHING {\n ...\n}\n" + - pattern: policy = "$STATEMENT" + - metavariable-pattern: + language: json + metavariable: $STATEMENT + patterns: + - pattern-not-inside: "{..., \"Effect\": \"Deny\", ...}\n" + - pattern-either: + - pattern: "{..., \"Principal\": \"*\", \"Action\": \"kms:*\", \"Resource\": \"*\", ...}\n" + - pattern: "{..., \"Principal\": [..., \"*\", ...], \"Action\": \"kms:*\", \"Resource\": \"*\", ...}\n" + - pattern: "{..., \"Principal\": { \"AWS\": \"*\" }, \"Action\": \"kms:*\", \"Resource\": \"*\", ...}\n" + - pattern: "{..., \"Principal\": { \"AWS\": [..., \"*\", ...] }, \"Action\": \"kms:*\", \"Resource\": \"*\", ...}\n" severity: ERROR - id: terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation - patterns: - - pattern-either: - - pattern: "resource \"aws_kms_key\" $ANYTHING {\n ...\n enable_key_rotation = false\n ...\n}\n" - - pattern: "resource \"aws_kms_key\" $ANYTHING {\n ...\n customer_master_key_spec = \"SYMMETRIC_DEFAULT\"\n enable_key_rotation\ - \ = false\n ...\n}\n" - - pattern: "resource \"aws_kms_key\" $ANYTHING {\n ...\n}\n" - - pattern-not-inside: "resource \"aws_kms_key\" $ANYTHING {\n ...\n enable_key_rotation = true\n ...\n}\n" - - pattern-not-inside: "resource \"aws_kms_key\" $ANYTHING {\n ...\n customer_master_key_spec = \"RSA_2096\"\n ...\n}\n" - message: The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a - `enable_key_rotation`. languages: - hcl - severity: WARNING + message: The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set + a `enable_key_rotation`. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-326: Inadequate Encryption Strength' - technology: - - aws - - terraform - category: security references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation - shortlink: https://sg.run/kz47 semgrep.dev: rule: + origin: community r_id: 17372 - rv_id: 1263730 rule_id: PeU0L3 - version_id: X0Tzy67 + rv_id: 1263730 url: https://semgrep.dev/playground/r/X0Tzy67/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation - origin: community -- id: terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials + version_id: X0Tzy67 + shortlink: https://sg.run/kz47 + source: https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation + subcategory: + - vuln + technology: + - aws + - terraform + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: "resource \"$ANYTING\" $ANYTHING {\n ...\n environment {\n variables = {\n ...\n }\n }\n\ - \ ...\n}\n" - pattern-either: - - pattern-inside: 'AWS_ACCESS_KEY_ID = "$Y" - - ' - - pattern-regex: '(?:root`.' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-250: Execution with Unnecessary Privileges' - category: security - technology: - - aws - references: - - https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A06:2017 - Security Misconfiguration - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role - shortlink: https://sg.run/LXWr + references: + - https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ semgrep.dev: rule: + origin: community r_id: 15139 - rv_id: 1263749 rule_id: 5rUL1P - version_id: LjTkg8D + rv_id: 1263749 url: https://semgrep.dev/playground/r/LjTkg8D/terraform.aws.security.wildcard-assume-role.wildcard-assume-role - origin: community - languages: - - hcl + version_id: LjTkg8D + shortlink: https://sg.run/LXWr + source: https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role + subcategory: + - vuln + technology: + - aws + vulnerability_class: + - Improper Authorization + patterns: + - pattern-inside: "resource \"aws_iam_role\" $NAME {\n ...\n}\n" + - pattern: assume_role_policy = "$STATEMENT" + - metavariable-pattern: + language: json + metavariable: $STATEMENT + patterns: + - pattern-inside: "{..., \"Effect\": \"Allow\", ..., \"Action\": \"sts:AssumeRole\", ...}\n" + - pattern: "\"Principal\": {..., \"AWS\": \"*\", ...}\n" severity: ERROR - id: terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled - message: Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` - block needs to be filled out with the appropriate auth backend settings - patterns: - - pattern: resource - - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n auth_settings {\n ...\n enabled = true\n\ - \ ...\n }\n...\n}\n" - - pattern-either: - - pattern-inside: 'resource "azurerm_app_service" "..." { - - ... - - } - - ' - - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n auth_settings {\n ...\n enabled = false\n\ - \ ...\n }\n...\n}\n" + languages: + - hcl + message: Enabling authentication ensures that all communications in the application are authenticated. The + `auth_settings` block needs to be filled out with the appropriate auth backend settings metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-287: Improper Authentication' - category: security - technology: - - terraform - - azure - references: - - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled - shortlink: https://sg.run/JxYw + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings semgrep.dev: rule: + origin: community r_id: 15102 - rv_id: 1263755 rule_id: 0oU23p + rv_id: 1263755 + url: + https://semgrep.dev/playground/r/PkTR3P8/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled version_id: PkTR3P8 - url: https://semgrep.dev/playground/r/PkTR3P8/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled - origin: community - languages: - - hcl - severity: ERROR -- id: terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2 - message: Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to - your appservice resource block + shortlink: https://sg.run/JxYw + source: + https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled + subcategory: + - vuln + technology: + - terraform + - azure + vulnerability_class: + - Improper Authentication patterns: - pattern: resource - - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n site_config {\n ...\n http2_enabled = true\n\ + - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n auth_settings {\n ...\n enabled = true\n\ \ ...\n }\n...\n}\n" - pattern-either: - - pattern-inside: 'resource "azurerm_app_service" "..." { - - ... - - } - - ' - - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n site_config {\n ...\n http2_enabled = false\n\ + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n}\n" + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n auth_settings {\n ...\n enabled = false\n\ \ ...\n }\n...\n}\n" + severity: ERROR +- id: terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2 + languages: + - hcl + message: Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` + to your appservice resource block metadata: - cwe: - - 'CWE-444: Inconsistent Interpretation of HTTP Requests (''HTTP Request/Response Smuggling'')' category: security - technology: - - terraform - - azure - references: - - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled + confidence: MEDIUM + cwe: + - "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2 - shortlink: https://sg.run/5DkA + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled semgrep.dev: rule: + origin: community r_id: 15103 - rv_id: 1263756 rule_id: KxU7LJ + rv_id: 1263756 + url: + https://semgrep.dev/playground/r/JdTzx98/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2 version_id: JdTzx98 - url: https://semgrep.dev/playground/r/JdTzx98/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2 - origin: community - languages: - - hcl - severity: INFO -- id: terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only - message: By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the - HTTPS Only setting. + shortlink: https://sg.run/5DkA + source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2 + subcategory: + - vuln + technology: + - terraform + - azure + vulnerability_class: + - Improper Validation patterns: - pattern: resource - - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n https_only = true\n...\n}\n" + - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n site_config {\n ...\n http2_enabled = true\n\ + \ ...\n }\n...\n}\n" - pattern-either: - - pattern-inside: 'resource "azurerm_app_service" "..." { - - ... - - } - - ' - - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n https_only = false\n...\n}\n" + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n}\n" + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n site_config {\n ...\n http2_enabled = false\n\ + \ ...\n }\n...\n}\n" + severity: INFO +- id: terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only + languages: + - hcl + message: By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling + the HTTPS Only setting. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' - category: security - technology: - - terraform - - azure - references: - - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only - - https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only - shortlink: https://sg.run/GOKp + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only + - https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https semgrep.dev: rule: + origin: community r_id: 15104 - rv_id: 1263757 rule_id: qNUXwx + rv_id: 1263757 + url: + https://semgrep.dev/playground/r/5PTo1gg/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only version_id: 5PTo1gg - url: https://semgrep.dev/playground/r/5PTo1gg/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only - origin: community - languages: - - hcl - severity: ERROR -- id: terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert - message: Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in - your resource block. + shortlink: https://sg.run/GOKp + source: + https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only + subcategory: + - vuln + technology: + - terraform + - azure + vulnerability_class: + - Mishandled Sensitive Information patterns: - pattern: resource - - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n client_cert_enabled = true\n...\n}\n" + - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n https_only = true\n...\n}\n" - pattern-either: - - pattern-inside: 'resource "azurerm_app_service" "..." { - - ... - - } - - ' - - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n client_cert_enabled = false\n...\n}\n" + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n}\n" + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n https_only = false\n...\n}\n" + severity: ERROR +- id: terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert + languages: + - hcl + message: Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` + in your resource block. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-295: Improper Certificate Validation' - category: security - technology: - - terraform - - azure - references: - - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert - shortlink: https://sg.run/RX1O + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled semgrep.dev: rule: + origin: community r_id: 15105 - rv_id: 1263758 rule_id: lBU8D6 + rv_id: 1263758 + url: + https://semgrep.dev/playground/r/GxTkedE/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert version_id: GxTkedE - url: https://semgrep.dev/playground/r/GxTkedE/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert - origin: community - languages: - - hcl + shortlink: https://sg.run/RX1O + source: + https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert + subcategory: + - vuln + technology: + - terraform + - azure + vulnerability_class: + - Improper Authentication + patterns: + - pattern: resource + - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n client_cert_enabled = true\n...\n}\n" + - pattern-either: + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n}\n" + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n client_cert_enabled = false\n...\n}\n" severity: INFO - id: terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy - message: Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = "1.2"` in your - resource block. - patterns: - - pattern: min_tls_version = $ANYTHING - - pattern-inside: "resource \"azurerm_app_service\" \"$NAME\" {\n ...\n}\n" - - pattern-not-inside: min_tls_version = "1.2" + languages: + - hcl + message: Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = "1.2"` in + your resource block. metadata: + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' - category: security - technology: - - terraform - - azure - references: - - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy - shortlink: https://sg.run/AXRp + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version semgrep.dev: rule: + origin: community r_id: 15106 - rv_id: 1263759 rule_id: YGUDbZ + rv_id: 1263759 + url: + https://semgrep.dev/playground/r/RGT0L4x/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy version_id: RGT0L4x - url: https://semgrep.dev/playground/r/RGT0L4x/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy - origin: community + shortlink: https://sg.run/AXRp + source: + https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy + subcategory: + - vuln + technology: + - terraform + - azure + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: min_tls_version = $ANYTHING + - pattern-inside: "resource \"azurerm_app_service\" \"$NAME\" {\n ...\n}\n" + - pattern-not-inside: min_tls_version = "1.2" + severity: ERROR +- id: + terraform.azure.security.appservice.azure-appservice-detailed-errormessages-enabled.azure-appservice-detailed-errormessages-enabled languages: - hcl - severity: ERROR -- id: terraform.azure.security.appservice.azure-appservice-detailed-errormessages-enabled.azure-appservice-detailed-errormessages-enabled message: Ensure that App service enables detailed error messages - patterns: - - pattern: resource - - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\nlogs {\n ...\n detailed_error_messages_enabled\ - \ = true\n ...\n}\n...\n}\n" - - pattern-inside: 'resource "azurerm_app_service" "..." { - - ... - - } - - ' metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-778: Insufficient Logging' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A10:2017 - Insufficient Logging & Monitoring - A09:2021 - Security Logging and Monitoring Failures - A09:2025 - Security Logging & Alerting Failures - cwe: - - 'CWE-778: Insufficient Logging' - category: security - technology: - - terraform - - azure references: - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insufficient Logging - source: https://semgrep.dev/r/terraform.azure.security.appservice.azure-appservice-detailed-errormessages-enabled.azure-appservice-detailed-errormessages-enabled - shortlink: https://sg.run/pA1g semgrep.dev: rule: + origin: community r_id: 23962 - rv_id: 1263762 rule_id: bwU1Eg + rv_id: 1263762 + url: + https://semgrep.dev/playground/r/DkTRbr5/terraform.azure.security.appservice.azure-appservice-detailed-errormessages-enabled.azure-appservice-detailed-errormessages-enabled version_id: DkTRbr5 - url: https://semgrep.dev/playground/r/DkTRbr5/terraform.azure.security.appservice.azure-appservice-detailed-errormessages-enabled.azure-appservice-detailed-errormessages-enabled - origin: community - languages: - - hcl + shortlink: https://sg.run/pA1g + source: + https://semgrep.dev/r/terraform.azure.security.appservice.azure-appservice-detailed-errormessages-enabled.azure-appservice-detailed-errormessages-enabled + subcategory: + - vuln + technology: + - terraform + - azure + vulnerability_class: + - Insufficient Logging + patterns: + - pattern: resource + - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\nlogs {\n ...\n detailed_error_messages_enabled + = true\n ...\n}\n...\n}\n" + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n}\n" severity: WARNING - id: terraform.azure.security.appservice.azure-appservice-https-only.azure-appservice-https-only + languages: + - hcl message: Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot - patterns: - - pattern: resource - - pattern-not-inside: 'resource "azurerm_app_service" "..." { - - ... - - https_only = true - - ... - - } - - ' - - pattern-inside: 'resource "azurerm_app_service" "..." { - - ... - - } - - ' metadata: - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' - category: security - technology: - - terraform - - azure - references: - - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/terraform.azure.security.appservice.azure-appservice-https-only.azure-appservice-https-only - shortlink: https://sg.run/1g9w + likelihood: LOW + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures semgrep.dev: rule: + origin: community r_id: 23966 - rv_id: 1263766 rule_id: x8UZRP + rv_id: 1263766 + url: + https://semgrep.dev/playground/r/qkTR78q/terraform.azure.security.appservice.azure-appservice-https-only.azure-appservice-https-only version_id: qkTR78q - url: https://semgrep.dev/playground/r/qkTR78q/terraform.azure.security.appservice.azure-appservice-https-only.azure-appservice-https-only - origin: community - languages: - - hcl + shortlink: https://sg.run/1g9w + source: + https://semgrep.dev/r/terraform.azure.security.appservice.azure-appservice-https-only.azure-appservice-https-only + subcategory: + - vuln + technology: + - terraform + - azure + vulnerability_class: + - Mishandled Sensitive Information + patterns: + - pattern: resource + - pattern-not-inside: "resource \"azurerm_app_service\" \"...\" {\n...\nhttps_only = true\n...\n}\n" + - pattern-inside: "resource \"azurerm_app_service\" \"...\" {\n...\n}\n" severity: WARNING - id: terraform.azure.security.appservice.azure-appservice-min-tls-version.azure-appservice-min-tls-version + languages: + - hcl message: Ensure web app is using the latest version of TLS encryption - patterns: - - pattern-either: - - pattern: '"1.0" - - ' - - pattern: '"1.1" - - ' - - pattern-inside: min_tls_version = ... - - pattern-inside: '$RESOURCE "azurerm_app_service" "..." { - - ... - - } - - ' metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-326: Inadequate Encryption Strength' - category: security - technology: - - terraform - - azure references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.azure.security.appservice.azure-appservice-min-tls-version.azure-appservice-min-tls-version - shortlink: https://sg.run/rDwn semgrep.dev: rule: + origin: community r_id: 23969 - rv_id: 1263769 rule_id: v8UNL7 + rv_id: 1263769 + url: + https://semgrep.dev/playground/r/6xT29gv/terraform.azure.security.appservice.azure-appservice-min-tls-version.azure-appservice-min-tls-version version_id: 6xT29gv - url: https://semgrep.dev/playground/r/6xT29gv/terraform.azure.security.appservice.azure-appservice-min-tls-version.azure-appservice-min-tls-version - origin: community - languages: - - hcl + shortlink: https://sg.run/rDwn + source: + https://semgrep.dev/r/terraform.azure.security.appservice.azure-appservice-min-tls-version.azure-appservice-min-tls-version + subcategory: + - audit + technology: + - terraform + - azure + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern-either: + - pattern: "\"1.0\"\n" + - pattern: "\"1.1\"\n" + - pattern-inside: min_tls_version = ... + - pattern-inside: "$RESOURCE \"azurerm_app_service\" \"...\" {\n...\n}\n" severity: WARNING - id: terraform.azure.security.azure-key-no-expiration-date.azure-key-no-expiration-date + languages: + - hcl message: Ensure that the expiration date is set on all keys - patterns: - - pattern: resource - - pattern-not-inside: 'resource "azurerm_key_vault_key" "..." { - - ... - - expiration_date = "..." - - ... - - } - - ' - - pattern-inside: 'resource "azurerm_key_vault_key" "..." { - - ... - - } - - ' metadata: - owasp: - - A03:2017 - Sensitive Data Exposure + category: security + confidence: MEDIUM cwe: - 'CWE-320: CWE CATEGORY: Key Management Errors' - category: security - technology: - - terraform - - azure - references: - - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW impact: LOW - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.azure.security.azure-key-no-expiration-date.azure-key-no-expiration-date - shortlink: https://sg.run/J1vw + likelihood: LOW + owasp: + - A03:2017 - Sensitive Data Exposure + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures semgrep.dev: rule: + origin: community r_id: 23990 - rv_id: 946834 rule_id: 0oUlgp + rv_id: 946834 + url: + https://semgrep.dev/playground/r/pZTNGkl/terraform.azure.security.azure-key-no-expiration-date.azure-key-no-expiration-date version_id: pZTNGkl - url: https://semgrep.dev/playground/r/pZTNGkl/terraform.azure.security.azure-key-no-expiration-date.azure-key-no-expiration-date - origin: community - languages: - - hcl + shortlink: https://sg.run/J1vw + source: https://semgrep.dev/r/terraform.azure.security.azure-key-no-expiration-date.azure-key-no-expiration-date + subcategory: + - vuln + technology: + - terraform + - azure + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: resource + - pattern-not-inside: "resource \"azurerm_key_vault_key\" \"...\" {\n...\nexpiration_date = \"...\"\n...\n}\n" + - pattern-inside: "resource \"azurerm_key_vault_key\" \"...\" {\n...\n}\n" severity: WARNING - id: terraform.azure.security.azure-mssql-service-mintls-version.azure-mssql-service-mintls-version + languages: + - hcl message: Ensure MSSQL is using the latest version of TLS encryption - patterns: - - pattern-either: - - pattern: '"1.0" - - ' - - pattern: '"1.1" - - ' - - pattern-inside: minimum_tls_version = ... - - pattern-inside: '$RESOURCE "azurerm_mssql_server" "..." { - - ... - - } - - ' metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-326: Inadequate Encryption Strength' - category: security - technology: - - terraform - - azure references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.azure.security.azure-mssql-service-mintls-version.azure-mssql-service-mintls-version - shortlink: https://sg.run/B1lW semgrep.dev: rule: + origin: community r_id: 23995 - rv_id: 1263784 rule_id: 6JUJG8 + rv_id: 1263784 + url: + https://semgrep.dev/playground/r/xyTjzeR/terraform.azure.security.azure-mssql-service-mintls-version.azure-mssql-service-mintls-version version_id: xyTjzeR - url: https://semgrep.dev/playground/r/xyTjzeR/terraform.azure.security.azure-mssql-service-mintls-version.azure-mssql-service-mintls-version - origin: community - languages: - - hcl + shortlink: https://sg.run/B1lW + source: + https://semgrep.dev/r/terraform.azure.security.azure-mssql-service-mintls-version.azure-mssql-service-mintls-version + subcategory: + - vuln + technology: + - terraform + - azure + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern-either: + - pattern: "\"1.0\"\n" + - pattern: "\"1.1\"\n" + - pattern-inside: minimum_tls_version = ... + - pattern-inside: "$RESOURCE \"azurerm_mssql_server\" \"...\" {\n...\n}\n" severity: WARNING - id: terraform.azure.security.azure-mysql-encryption-enabled.azure-mysql-encryption-enabled + languages: + - hcl message: Ensure that MySQL server enables infrastructure encryption - patterns: - - pattern: resource - - pattern-inside: 'resource "azurerm_mysql_server" "..." { - - ... - - } - - ' - - pattern-not-inside: 'resource "azurerm_mysql_server" "..." { - - ... - - infrastructure_encryption_enabled = true - - ... - - } - - ' metadata: - owasp: - - A03:2017 - Sensitive Data Exposure + category: security + confidence: MEDIUM cwe: - 'CWE-320: CWE CATEGORY: Key Management Errors' - category: security - technology: - - terraform - - azure - references: - - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.azure.security.azure-mysql-encryption-enabled.azure-mysql-encryption-enabled - shortlink: https://sg.run/Dd6Y + likelihood: LOW + owasp: + - A03:2017 - Sensitive Data Exposure + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures semgrep.dev: rule: + origin: community r_id: 23996 - rv_id: 946840 rule_id: oqUloL + rv_id: 946840 + url: + https://semgrep.dev/playground/r/yeT0vBn/terraform.azure.security.azure-mysql-encryption-enabled.azure-mysql-encryption-enabled version_id: yeT0vBn - url: https://semgrep.dev/playground/r/yeT0vBn/terraform.azure.security.azure-mysql-encryption-enabled.azure-mysql-encryption-enabled - origin: community - languages: - - hcl + shortlink: https://sg.run/Dd6Y + source: https://semgrep.dev/r/terraform.azure.security.azure-mysql-encryption-enabled.azure-mysql-encryption-enabled + subcategory: + - vuln + technology: + - terraform + - azure + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: resource + - pattern-inside: "resource \"azurerm_mysql_server\" \"...\" {\n...\n}\n" + - pattern-not-inside: "resource \"azurerm_mysql_server\" \"...\" {\n...\ninfrastructure_encryption_enabled = true\n...\n\ + }\n" severity: WARNING - id: terraform.azure.security.azure-mysql-mintls-version.azure-mysql-mintls-version + languages: + - hcl message: Ensure MySQL is using the latest version of TLS encryption - patterns: - - pattern-either: - - pattern: '"TLS1_0" - - ' - - pattern: '"TLS1_1" - - ' - - pattern-inside: ssl_minimal_tls_version_enforced = ... - - pattern-inside: '$RESOURCE "azurerm_mysql_server" "..." { - - ... - - } - - ' metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-326: Inadequate Encryption Strength' - category: security - technology: - - terraform - - azure references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.azure.security.azure-mysql-mintls-version.azure-mysql-mintls-version - shortlink: https://sg.run/WR44 semgrep.dev: rule: + origin: community r_id: 23997 - rv_id: 1263785 rule_id: zdU8NN + rv_id: 1263785 + url: + https://semgrep.dev/playground/r/O9TpxWE/terraform.azure.security.azure-mysql-mintls-version.azure-mysql-mintls-version version_id: O9TpxWE - url: https://semgrep.dev/playground/r/O9TpxWE/terraform.azure.security.azure-mysql-mintls-version.azure-mysql-mintls-version - origin: community - languages: - - hcl - severity: WARNING -- id: terraform.azure.security.storage.storage-enforce-https.storage-enforce-https - message: Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in - your resource block. - patterns: - - pattern-not-inside: "resource \"azurerm_storage_account\" \"...\" {\n...\n enable_https_traffic_only = true\n...\n}\n" - - pattern-inside: "resource \"azurerm_storage_account\" \"...\" {\n...\n enable_https_traffic_only = false\n...\n}\n" - metadata: - cwe: - - 'CWE-319: Cleartext Transmission of Sensitive Information' - category: security + shortlink: https://sg.run/WR44 + source: https://semgrep.dev/r/terraform.azure.security.azure-mysql-mintls-version.azure-mysql-mintls-version + subcategory: + - vuln technology: - terraform - azure - references: - - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only - - https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern-either: + - pattern: "\"TLS1_0\"\n" + - pattern: "\"TLS1_1\"\n" + - pattern-inside: ssl_minimal_tls_version_enforced = ... + - pattern-inside: "$RESOURCE \"azurerm_mysql_server\" \"...\" {\n...\n}\n" + severity: WARNING +- id: terraform.azure.security.storage.storage-enforce-https.storage-enforce-https + languages: + - hcl + message: Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` + in your resource block. + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https - shortlink: https://sg.run/0y9v + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only + - https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer semgrep.dev: rule: + origin: community r_id: 15110 - rv_id: 1263805 rule_id: pKUpDA + rv_id: 1263805 + url: + https://semgrep.dev/playground/r/BjTkZ0A/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https version_id: BjTkZ0A - url: https://semgrep.dev/playground/r/BjTkZ0A/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https - origin: community - languages: - - hcl + shortlink: https://sg.run/0y9v + source: https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https + subcategory: + - vuln + technology: + - terraform + - azure + vulnerability_class: + - Mishandled Sensitive Information + patterns: + - pattern-not-inside: "resource \"azurerm_storage_account\" \"...\" {\n...\n enable_https_traffic_only = true\n...\n}\n" + - pattern-inside: "resource \"azurerm_storage_account\" \"...\" {\n...\n enable_https_traffic_only = false\n...\n}\n" severity: WARNING - id: terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy + languages: + - hcl message: 'Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2.' - patterns: - - pattern-either: - - pattern-inside: "resource \"azurerm_storage_account\" \"...\" {\n ...\n min_tls_version = \"$ANYTHING\"\n ...\n}\n" - - pattern-inside: "resource \"azurerm_storage_account\" \"...\" {\n ...\n}\n" - - pattern-not-inside: "resource \"azurerm_storage_account\" \"...\" {\n ...\n min_tls_version = \"TLS1_2\"\n ...\n}\n" metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-326: Inadequate Encryption Strength' - category: security - technology: - - terraform - - azure - references: - - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version - - https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy - shortlink: https://sg.run/KXD7 + references: + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version + - https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version semgrep.dev: rule: + origin: community r_id: 15155 - rv_id: 1263807 rule_id: AbUQdL + rv_id: 1263807 + url: + https://semgrep.dev/playground/r/WrTqKpv/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy version_id: WrTqKpv - url: https://semgrep.dev/playground/r/WrTqKpv/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy - origin: community - languages: - - hcl + shortlink: https://sg.run/KXD7 + source: + https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy + subcategory: + - vuln + technology: + - terraform + - azure + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern-either: + - pattern-inside: "resource \"azurerm_storage_account\" \"...\" {\n ...\n min_tls_version = \"$ANYTHING\"\n ...\n}\n" + - pattern-inside: "resource \"azurerm_storage_account\" \"...\" {\n ...\n}\n" + - pattern-not-inside: "resource \"azurerm_storage_account\" \"...\" {\n ...\n min_tls_version = \"TLS1_2\"\n ...\n}\n" severity: ERROR - id: terraform.gcp.security.gcp-cloud-storage-logging.gcp-cloud-storage-logging - patterns: - - pattern: "resource \"google_storage_bucket\" $ANYTHING {\n ...\n}\n" - - pattern-not-inside: "resource \"google_storage_bucket\" $ANYTHING {\n ...\n logging {\n log_bucket = ...\n } \ - \ \n ...\n}\n" - message: Ensure bucket logs access. languages: - hcl - severity: WARNING + message: Ensure bucket logs access. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-778: Insufficient Logging' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A10:2017 - Insufficient Logging & Monitoring - A09:2021 - Security Logging and Monitoring Failures - A09:2025 - Security Logging & Alerting Failures - cwe: - - 'CWE-778: Insufficient Logging' - technology: - - terraform - - gcp - category: security references: - https://docs.bridgecrew.io/docs/google-cloud-policy-index - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insufficient Logging - source: https://semgrep.dev/r/terraform.gcp.security.gcp-cloud-storage-logging.gcp-cloud-storage-logging - shortlink: https://sg.run/5g5D semgrep.dev: rule: + origin: community r_id: 32303 - rv_id: 1263813 rule_id: gxUrdg + rv_id: 1263813 + url: + https://semgrep.dev/playground/r/JdTzxRN/terraform.gcp.security.gcp-cloud-storage-logging.gcp-cloud-storage-logging version_id: JdTzxRN - url: https://semgrep.dev/playground/r/JdTzxRN/terraform.gcp.security.gcp-cloud-storage-logging.gcp-cloud-storage-logging - origin: community -- id: terraform.gcp.security.gcp-dns-key-specs-rsasha1.gcp-dns-key-specs-rsasha1 + shortlink: https://sg.run/5g5D + source: https://semgrep.dev/r/terraform.gcp.security.gcp-cloud-storage-logging.gcp-cloud-storage-logging + subcategory: + - vuln + technology: + - terraform + - gcp + vulnerability_class: + - Insufficient Logging patterns: - - pattern: resource - - pattern-inside: "resource \"google_dns_managed_zone\" \"...\" {\n...\ndnssec_config {\n ...\n default_key_specs\ - \ {\n ...\n algorithm = \"rsasha1\"\n key_type = \"zoneSigning\"\n ...\n }\n ...\n\ - }\n...\n}\n" - - pattern-inside: "resource \"google_dns_managed_zone\" \"...\" {\n...\ndnssec_config {\n ...\n default_key_specs\ - \ {\n ...\n algorithm = \"rsasha1\"\n key_type = \"keySigning\"\n ...\n }\n ...\n\ - }\n...\n}\n" + - pattern: "resource \"google_storage_bucket\" $ANYTHING {\n ...\n}\n" + - pattern-not-inside: "resource \"google_storage_bucket\" $ANYTHING {\n ...\n logging {\n log_bucket = ...\n } \ + \ \n ...\n}\n" + severity: WARNING +- id: terraform.gcp.security.gcp-dns-key-specs-rsasha1.gcp-dns-key-specs-rsasha1 + languages: + - hcl message: "Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC\t" metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-326: Inadequate Encryption Strength' - category: security - technology: - - terraform - - gcp references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.gcp.security.gcp-dns-key-specs-rsasha1.gcp-dns-key-specs-rsasha1 - shortlink: https://sg.run/bKKW semgrep.dev: rule: + origin: community r_id: 33670 - rv_id: 1263837 rule_id: 7KUZZb + rv_id: 1263837 + url: + https://semgrep.dev/playground/r/bZT53oD/terraform.gcp.security.gcp-dns-key-specs-rsasha1.gcp-dns-key-specs-rsasha1 version_id: bZT53oD - url: https://semgrep.dev/playground/r/bZT53oD/terraform.gcp.security.gcp-dns-key-specs-rsasha1.gcp-dns-key-specs-rsasha1 - origin: community - languages: - - hcl - severity: WARNING -- id: terraform.gcp.security.gcp-sql-database-require-ssl.gcp-sql-database-require-ssl + shortlink: https://sg.run/bKKW + source: https://semgrep.dev/r/terraform.gcp.security.gcp-dns-key-specs-rsasha1.gcp-dns-key-specs-rsasha1 + subcategory: + - vuln + technology: + - terraform + - gcp + vulnerability_class: + - Cryptographic Issues patterns: - pattern: resource - - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n}\n" - - pattern-not-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n\ - \ require_ssl = true\n ...\n }\n ...\n}\n" - - pattern-not-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n\ - \ ssl_mode = ...\n ...\n }\n ...\n}\n" + - pattern-inside: "resource \"google_dns_managed_zone\" \"...\" {\n...\ndnssec_config {\n ...\n default_key_specs + {\n ...\n algorithm = \"rsasha1\"\n key_type = \"zoneSigning\"\n ...\n }\n ...\n\ + }\n...\n}\n" + - pattern-inside: "resource \"google_dns_managed_zone\" \"...\" {\n...\ndnssec_config {\n ...\n default_key_specs + {\n ...\n algorithm = \"rsasha1\"\n key_type = \"keySigning\"\n ...\n }\n ...\n\ + }\n...\n}\n" + severity: WARNING +- id: terraform.gcp.security.gcp-sql-database-require-ssl.gcp-sql-database-require-ssl + languages: + - hcl message: Ensure all Cloud SQL database instance requires all incoming connections to use SSL metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-326: Inadequate Encryption Strength' - category: security - technology: - - terraform - - gcp references: - https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#ipconfiguration - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.gcp.security.gcp-sql-database-require-ssl.gcp-sql-database-require-ssl - shortlink: https://sg.run/W4Yg semgrep.dev: rule: + origin: community r_id: 33709 - rv_id: 1263873 rule_id: v8Uod5 + rv_id: 1263873 + url: + https://semgrep.dev/playground/r/pZT033e/terraform.gcp.security.gcp-sql-database-require-ssl.gcp-sql-database-require-ssl version_id: pZT033e - url: https://semgrep.dev/playground/r/pZT033e/terraform.gcp.security.gcp-sql-database-require-ssl.gcp-sql-database-require-ssl - origin: community - languages: - - hcl - severity: WARNING -- id: terraform.gcp.security.gcp-sql-database-ssl-insecure-value-postgres-mysql.gcp-sql-database-ssl-insecure-value-postgres-mysql + shortlink: https://sg.run/W4Yg + source: https://semgrep.dev/r/terraform.gcp.security.gcp-sql-database-require-ssl.gcp-sql-database-require-ssl + subcategory: + - vuln + technology: + - terraform + - gcp + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n database_version = \"$DB\"\n ...\n\ - }\n" - - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n \ - \ ssl_mode = $VALUE\n ...\n }\n ...\n}\n" + - pattern: resource + - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n}\n" - pattern-not-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n\ - \ ssl_mode = \"TRUSTED_CLIENT_CERTIFICATE_REQUIRED\"\n ...\n }\n ...\n}\n" - - metavariable-regex: - metavariable: $DB - regex: .*(MYSQL|POSTGRES).* - - focus-metavariable: $VALUE - fix: '"TRUSTED_CLIENT_CERTIFICATE_REQUIRED" - - ' - message: Ensure all Cloud SQL database instance require incoming connections to use SSL. To enable this for PostgresSQL - and MySQL, use `ssl_mode="TRUSTED_CLIENT_CERTIFICATE_REQUIRED"`. + \ require_ssl = true\n ...\n }\n ...\n}\n" + - pattern-not-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n\ + \ ssl_mode = ...\n ...\n }\n ...\n}\n" + severity: WARNING +- fix: "\"TRUSTED_CLIENT_CERTIFICATE_REQUIRED\"\n" + id: + terraform.gcp.security.gcp-sql-database-ssl-insecure-value-postgres-mysql.gcp-sql-database-ssl-insecure-value-postgres-mysql + languages: + - hcl + message: Ensure all Cloud SQL database instance require incoming connections to use SSL. To enable this for + PostgresSQL and MySQL, use `ssl_mode="TRUSTED_CLIENT_CERTIFICATE_REQUIRED"`. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-326: Inadequate Encryption Strength' - category: security - technology: - - terraform - - gcp references: - https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#ipconfiguration - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-postgres-mysql.gcp-sql-database-ssl-insecure-value-postgres-mysql - shortlink: https://sg.run/WANR2 semgrep.dev: rule: + origin: community r_id: 153509 - rv_id: 1263874 rule_id: 5rUdGAz + rv_id: 1263874 + url: + https://semgrep.dev/playground/r/2KTv22E/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-postgres-mysql.gcp-sql-database-ssl-insecure-value-postgres-mysql version_id: 2KTv22E - url: https://semgrep.dev/playground/r/2KTv22E/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-postgres-mysql.gcp-sql-database-ssl-insecure-value-postgres-mysql - origin: community - languages: - - hcl - severity: WARNING -- id: terraform.gcp.security.gcp-sql-database-ssl-insecure-value-sqlserver.gcp-sql-database-ssl-insecure-value-sqlserver + shortlink: https://sg.run/WANR2 + source: + https://semgrep.dev/r/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-postgres-mysql.gcp-sql-database-ssl-insecure-value-postgres-mysql + subcategory: + - vuln + technology: + - terraform + - gcp + vulnerability_class: + - Cryptographic Issues patterns: - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n database_version = \"$DB\"\n ...\n\ }\n" - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n \ \ ssl_mode = $VALUE\n ...\n }\n ...\n}\n" - pattern-not-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n\ - \ ssl_mode = \"ENCRYPTED_ONLY\"\n ...\n }\n ...\n}\n" + \ ssl_mode = \"TRUSTED_CLIENT_CERTIFICATE_REQUIRED\"\n ...\n }\n ...\n}\n" - metavariable-regex: metavariable: $DB - regex: .*(SQLSERVER).* + regex: .*(MYSQL|POSTGRES).* - focus-metavariable: $VALUE - fix: '"ENCRYPTED_ONLY" - - ' - message: Ensure all Cloud SQL database instance require incoming connections to use SSL. For SQL Server, `ssl_mode="ENCRYPTED_ONLY"` - is the most secure value that is supported. + severity: WARNING +- fix: "\"ENCRYPTED_ONLY\"\n" + id: terraform.gcp.security.gcp-sql-database-ssl-insecure-value-sqlserver.gcp-sql-database-ssl-insecure-value-sqlserver + languages: + - hcl + message: Ensure all Cloud SQL database instance require incoming connections to use SSL. For SQL Server, + `ssl_mode="ENCRYPTED_ONLY"` is the most secure value that is supported. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-326: Inadequate Encryption Strength' - category: security - technology: - - terraform - - gcp references: - https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#ipconfiguration - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-sqlserver.gcp-sql-database-ssl-insecure-value-sqlserver - shortlink: https://sg.run/0o92j semgrep.dev: rule: + origin: community r_id: 153510 - rv_id: 1263875 rule_id: GdUvX6A + rv_id: 1263875 + url: + https://semgrep.dev/playground/r/X0Tzyyl/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-sqlserver.gcp-sql-database-ssl-insecure-value-sqlserver version_id: X0Tzyyl - url: https://semgrep.dev/playground/r/X0Tzyyl/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-sqlserver.gcp-sql-database-ssl-insecure-value-sqlserver - origin: community - languages: - - hcl + shortlink: https://sg.run/0o92j + source: + https://semgrep.dev/r/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-sqlserver.gcp-sql-database-ssl-insecure-value-sqlserver + subcategory: + - vuln + technology: + - terraform + - gcp + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n database_version = \"$DB\"\n ...\n\ + }\n" + - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n \ + \ ssl_mode = $VALUE\n ...\n }\n ...\n}\n" + - pattern-not-inside: "resource \"google_sql_database_instance\" \"...\" {\n ...\n ip_configuration {\n ...\n\ + \ ssl_mode = \"ENCRYPTED_ONLY\"\n ...\n }\n ...\n}\n" + - metavariable-regex: + metavariable: $DB + regex: .*(SQLSERVER).* + - focus-metavariable: $VALUE severity: WARNING - id: terraform.gcp.security.gcp-sql-public-database.gcp-sql-public-database - patterns: - - pattern: resource - - pattern-either: - - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n...\nip_configuration {\n ...\n authorized_networks\ - \ {\n ...\n value = \"0.0.0.0/0\"\n ...\n }\n ...\n}\n...\n}\n" - - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n...\nip_configuration {\n ...\n dynamic \"authorized_networks\"\ - \ {\n ...\n content {\n ...\n value = \"0.0.0.0/0\"\n ...\n }\n ...\n }\n ...\n}\n...\n\ - }\n" + languages: + - hcl message: Ensure that Cloud SQL database Instances are not open to the world metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-1220: Insufficient Granularity of Access Control' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-1220: Insufficient Granularity of Access Control' - category: security - technology: - - terraform - - gcp references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/terraform.gcp.security.gcp-sql-public-database.gcp-sql-public-database - shortlink: https://sg.run/0Xv5 semgrep.dev: rule: + origin: community r_id: 33710 - rv_id: 1263876 rule_id: d8U7Ll + rv_id: 1263876 + url: + https://semgrep.dev/playground/r/jQTn559/terraform.gcp.security.gcp-sql-public-database.gcp-sql-public-database version_id: jQTn559 - url: https://semgrep.dev/playground/r/jQTn559/terraform.gcp.security.gcp-sql-public-database.gcp-sql-public-database - origin: community - languages: - - hcl + shortlink: https://sg.run/0Xv5 + source: https://semgrep.dev/r/terraform.gcp.security.gcp-sql-public-database.gcp-sql-public-database + subcategory: + - vuln + technology: + - terraform + - gcp + vulnerability_class: + - Other + patterns: + - pattern: resource + - pattern-either: + - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n...\nip_configuration {\n ...\n authorized_networks + {\n ...\n value = \"0.0.0.0/0\"\n ...\n }\n ...\n}\n...\n}\n" + - pattern-inside: "resource \"google_sql_database_instance\" \"...\" {\n...\nip_configuration {\n ...\n dynamic \"authorized_networks\"\ + \ {\n ...\n content {\n ...\n value = \"0.0.0.0/0\"\n ...\n }\n ...\n }\n ...\n}\n...\n\ + }\n" severity: WARNING - id: terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional languages: - hcl message: AWS EC2 Instance allowing use of the IMDSv1 metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' - references: - - https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service - - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options - category: security - technology: - - terraform - - aws - owasp: - - A10:2021 - Server-Side Request Forgery (SSRF) - - A01:2025 - Broken Access Control - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional - shortlink: https://sg.run/J3BQ + likelihood: LOW + owasp: + - A10:2021 - Server-Side Request Forgery (SSRF) + - A01:2025 - Broken Access Control + references: + - https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options semgrep.dev: rule: + origin: community r_id: 11302 - rv_id: 1263884 rule_id: GdU0eA - version_id: w8TRooE + rv_id: 1263884 url: https://semgrep.dev/playground/r/w8TRooE/terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional - origin: community + version_id: w8TRooE + shortlink: https://sg.run/J3BQ + source: https://semgrep.dev/r/terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional + subcategory: + - vuln + technology: + - terraform + - aws + vulnerability_class: + - Server-Side Request Forgery (SSRF) pattern-either: - patterns: - pattern: http_tokens = "optional" - - pattern-inside: 'metadata_options { ... } - - ' + - pattern-inside: "metadata_options { ... }\n" - patterns: - pattern: "resource \"aws_instance\" \"$NAME\" {\n ...\n}\n" - pattern-not: "resource \"aws_instance\" \"$NAME\" {\n ...\n metadata_options {\n ...\n http_tokens = \"required\"\ @@ -40728,838 +31632,601 @@ rules: \n ...\n }\n ...\n}\n" severity: ERROR - id: terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code - pattern-either: - - patterns: - - pattern: password = "..." - - pattern-inside: "resource \"aws_db_instance\" \"...\" {\n ...\n}\n" - - patterns: - - pattern: master_password = "..." - - pattern-inside: "resource \"aws_rds_cluster\" \"...\" {\n ...\n}\n" languages: - hcl - severity: WARNING - message: RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at - runtime, or generate random credentials using the random_password resource. + message: RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials + at runtime, or generate random credentials using the random_password resource. metadata: - references: - - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password - - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password - - https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password + category: security + confidence: MEDIUM cwe: - 'CWE-522: Insufficiently Protected Credentials' - category: security - technology: - - terraform - - aws - - secrets + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code - shortlink: https://sg.run/x4qA + references: + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password + - https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password semgrep.dev: rule: + origin: community r_id: 15830 - rv_id: 1263896 rule_id: OrUl6W + rv_id: 1263896 + url: + https://semgrep.dev/playground/r/gETB77b/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code version_id: gETB77b - url: https://semgrep.dev/playground/r/gETB77b/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code - origin: community + shortlink: https://sg.run/x4qA + source: + https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code + subcategory: + - vuln + technology: + - terraform + - aws + - secrets + vulnerability_class: + - Cryptographic Issues + pattern-either: + - patterns: + - pattern: password = "..." + - pattern-inside: "resource \"aws_db_instance\" \"...\" {\n ...\n}\n" + - patterns: + - pattern: master_password = "..." + - pattern-inside: "resource \"aws_rds_cluster\" \"...\" {\n ...\n}\n" + severity: WARNING - id: terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket - pattern: acl = "public-read-write" languages: - hcl - severity: ERROR message: S3 bucket with public read-write access detected. metadata: - references: - - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl - - https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl + category: security + confidence: MEDIUM cwe: - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' - category: security - technology: - - terraform - - aws - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket - shortlink: https://sg.run/0nok + likelihood: LOW + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl + - https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl semgrep.dev: rule: + origin: community r_id: 9754 - rv_id: 1263900 rule_id: 6JUqvn - version_id: PkTR3y5 + rv_id: 1263900 url: https://semgrep.dev/playground/r/PkTR3y5/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket - origin: community + version_id: PkTR3y5 + shortlink: https://sg.run/0nok + source: https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket + subcategory: + - vuln + technology: + - terraform + - aws + vulnerability_class: + - Mishandled Sensitive Information + pattern: acl = "public-read-write" + severity: ERROR - id: terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket - patterns: - - pattern: a - - pattern: b languages: - hcl - severity: INFO - message: This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration + message: This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See + https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info. metadata: - references: - - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration - - https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html + category: security + confidence: MEDIUM cwe: - 'CWE-311: Missing Encryption of Sensitive Data' - category: security - technology: - - terraform - - aws + deprecated: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A04:2021 - Insecure Design - A06:2025 - Insecure Design - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - deprecated: true - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket - shortlink: https://sg.run/Jezw + references: + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html semgrep.dev: rule: + origin: community r_id: 16202 - rv_id: 1263901 rule_id: 3qU62L + rv_id: 1263901 + url: + https://semgrep.dev/playground/r/JdTzxjN/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket version_id: JdTzxjN - url: https://semgrep.dev/playground/r/JdTzxjN/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket - origin: community + shortlink: https://sg.run/Jezw + source: https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket + subcategory: + - vuln + technology: + - terraform + - aws + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: a + - pattern: b + severity: INFO - id: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust - message: Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from - user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention - mechanism e.g. input validation or sanitization depending on the context. + languages: + - typescript + message: Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes + from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the + appropriate prevention mechanism e.g. input validation or sanitization depending on the context. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - references: - - https://angular.io/api/platform-browser/DomSanitizer - - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - confidence: MEDIUM - category: security - technology: - - angular - - browser - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust - shortlink: https://sg.run/KWxP + references: + - https://angular.io/api/platform-browser/DomSanitizer + - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9755 - rv_id: 1263902 rule_id: oqUzgA + rv_id: 1263902 + url: + https://semgrep.dev/playground/r/5PTo1zk/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust version_id: 5PTo1zk - url: https://semgrep.dev/playground/r/5PTo1zk/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust - origin: community - languages: - - typescript - severity: WARNING + shortlink: https://sg.run/KWxP + source: https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust + subcategory: + - vuln + technology: + - angular + - browser + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: 'function ...({..., $X: string, ...}) { ... } - - ' - - pattern-inside: 'function ...(..., $X: string, ...) { ... } - - ' - - focus-metavariable: $X - pattern-sinks: - - patterns: - - pattern-either: - - pattern: $X.$TRUST($Y) - - focus-metavariable: $Y - - pattern-not: '$X.$TRUST(`...`) - - ' - - pattern-not: '$X.$TRUST("...") - - ' - - metavariable-regex: - metavariable: $TRUST - regex: (bypassSecurityTrustHtml|bypassSecurityTrustStyle|bypassSecurityTrustScript|bypassSecurityTrustUrl|bypassSecurityTrustResourceUrl) pattern-sanitizers: - patterns: - pattern-either: - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import * as $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: '$S = require("underscore.string") - - ... - - ' + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "import * as $S from \"underscore.string\"\n...\n" + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "$S = require(\"underscore.string\")\n...\n" - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from "dompurify" - - ... - - ' - - pattern-inside: 'import { ..., $S,... } from "dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "dompurify" - - ... - - ' - - pattern-inside: '$S = require("dompurify") - - ... - - ' - - pattern-inside: 'import $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: '$S = require("isomorphic-dompurify") - - ... - - ' + - pattern-inside: "import $S from \"dompurify\"\n...\n" + - pattern-inside: "import { ..., $S,... } from \"dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"dompurify\"\n...\n" + - pattern-inside: "$S = require(\"dompurify\")\n...\n" + - pattern-inside: "import $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "$S = require(\"isomorphic-dompurify\")\n...\n" - pattern-either: - patterns: - - pattern-inside: '$VALUE = $S(...) - - ... - - ' + - pattern-inside: "$VALUE = $S(...)\n...\n" - pattern: $VALUE.sanitize(...) - patterns: - - pattern-inside: '$VALUE = $S.sanitize - - ... - - ' + - pattern-inside: "$VALUE = $S.sanitize\n...\n" - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''xss''; - - ... - - ' - - pattern-inside: 'import * as $S from ''xss''; - - ... - - ' - - pattern-inside: '$S = require("xss") - - ... - - ' + - pattern-inside: "import $S from 'xss';\n...\n" + - pattern-inside: "import * as $S from 'xss';\n...\n" + - pattern-inside: "$S = require(\"xss\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''sanitize-html''; - - ... - - ' - - pattern-inside: 'import * as $S from "sanitize-html"; - - ... - - ' - - pattern-inside: '$S = require("sanitize-html") - - ... - - ' + - pattern-inside: "import $S from 'sanitize-html';\n...\n" + - pattern-inside: "import * as $S from \"sanitize-html\";\n...\n" + - pattern-inside: "$S = require(\"sanitize-html\")\n...\n" - pattern: $S(...) - patterns: - pattern: sanitizer.sanitize(...) - pattern-not: sanitizer.sanitize(SecurityContext.NONE, ...); + pattern-sinks: + - patterns: + - pattern-either: + - pattern: $X.$TRUST($Y) + - focus-metavariable: $Y + - pattern-not: "$X.$TRUST(`...`)\n" + - pattern-not: "$X.$TRUST(\"...\")\n" + - metavariable-regex: + metavariable: $TRUST + regex: + (bypassSecurityTrustHtml|bypassSecurityTrustStyle|bypassSecurityTrustScript|bypassSecurityTrustUrl|bypassSecurityTrustResourceUrl) + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "function ...({..., $X: string, ...}) { ... }\n" + - pattern-inside: "function ...(..., $X: string, ...) { ... }\n" + - focus-metavariable: $X + severity: WARNING - id: typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption + languages: + - typescript message: 'Add "encryption: $Y.BucketEncryption.KMS_MANAGED" or "encryption: $Y.BucketEncryption.S3_MANAGED" to the bucket props for Bucket construct $X' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-311: Missing Encryption of Sensitive Data' - category: security - technology: - - AWS-CDK - references: - - https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A04:2021 - Insecure Design - A06:2025 - Insecure Design - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption - shortlink: https://sg.run/eowX + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html semgrep.dev: rule: + origin: community r_id: 15276 - rv_id: 1263903 rule_id: bwU8qz + rv_id: 1263903 + url: + https://semgrep.dev/playground/r/GxTkeRx/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption version_id: GxTkeRx - url: https://semgrep.dev/playground/r/GxTkeRx/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption - origin: community - languages: - - typescript - severity: ERROR + shortlink: https://sg.run/eowX + source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption + subcategory: + - vuln + technology: + - AWS-CDK + vulnerability_class: + - Cryptographic Issues pattern-either: - patterns: - - pattern-inside: 'import {Bucket} from ''@aws-cdk/aws-s3'' - - ... - - ' + - pattern-inside: "import {Bucket} from '@aws-cdk/aws-s3'\n...\n" - pattern: const $X = new Bucket(...) - - pattern-not: 'const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS_MANAGED, ...}) - - ' - - pattern-not: 'const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS, ...}) - - ' - - pattern-not: 'const $X = new Bucket(..., {..., encryption: BucketEncryption.S3_MANAGED, ...}) - - ' - - patterns: - - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-s3'' - - ... - - ' + - pattern-not: "const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS_MANAGED, ...})\n" + - pattern-not: "const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS, ...})\n" + - pattern-not: "const $X = new Bucket(..., {..., encryption: BucketEncryption.S3_MANAGED, ...})\n" + - patterns: + - pattern-inside: "import * as $Y from '@aws-cdk/aws-s3'\n...\n" - pattern: const $X = new $Y.Bucket(...) - - pattern-not: 'const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS_MANAGED, ...}) - - ' - - pattern-not: 'const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS, ...}) - - ' - - pattern-not: 'const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.S3_MANAGED, ...}) - - ' + - pattern-not: "const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS_MANAGED, ...})\n" + - pattern-not: "const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS, ...})\n" + - pattern-not: "const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.S3_MANAGED, ...})\n" + severity: ERROR - id: typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl - message: Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the - property "enforceSSL" should be set to true + languages: + - ts + message: Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - + the property "enforceSSL" should be set to true metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' - category: security - technology: - - AWS-CDK - references: - - https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl - shortlink: https://sg.run/vqBX + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html semgrep.dev: rule: + origin: community r_id: 15277 - rv_id: 1263904 rule_id: NbUN8B + rv_id: 1263904 + url: + https://semgrep.dev/playground/r/RGT0Llg/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl version_id: RGT0Llg - url: https://semgrep.dev/playground/r/RGT0Llg/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl - origin: community - languages: - - ts - severity: ERROR + shortlink: https://sg.run/vqBX + source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl + subcategory: + - vuln + technology: + - AWS-CDK + vulnerability_class: + - Mishandled Sensitive Information pattern-either: - patterns: - - pattern-inside: 'import {Bucket} from ''@aws-cdk/aws-s3''; - - ... - - ' + - pattern-inside: "import {Bucket} from '@aws-cdk/aws-s3';\n...\n" - pattern: const $X = new Bucket(...) - - pattern-not: 'const $X = new Bucket(..., {enforceSSL: true}, ...) - - ' - - patterns: - - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-s3''; - - ... - - ' + - pattern-not: "const $X = new Bucket(..., {enforceSSL: true}, ...)\n" + - patterns: + - pattern-inside: "import * as $Y from '@aws-cdk/aws-s3';\n...\n" - pattern: const $X = new $Y.Bucket(...) - - pattern-not: 'const $X = new $Y.Bucket(..., {..., enforceSSL: true, ...}) - - ' + - pattern-not: "const $X = new $Y.Bucket(..., {..., enforceSSL: true, ...})\n" + severity: ERROR - id: typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue + languages: + - ts message: 'Queue $X is missing encryption at rest. Add "encryption: $Y.QueueEncryption.KMS" or "encryption: $Y.QueueEncryption.KMS_MANAGED" to the queue props to enable encryption at rest for the queue.' metadata: category: security + confidence: MEDIUM cwe: - 'CWE-311: Missing Encryption of Sensitive Data' - technology: - - AWS-CDK - references: - - https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A04:2021 - Insecure Design - A06:2025 - Insecure Design - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue - shortlink: https://sg.run/d23P + references: + - https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html semgrep.dev: rule: + origin: community r_id: 15278 - rv_id: 1263905 rule_id: kxUwqO - version_id: A8Tgd2W - url: https://semgrep.dev/playground/r/A8Tgd2W/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue - origin: community - languages: - - ts - severity: WARNING + rv_id: 1263905 + url: + https://semgrep.dev/playground/r/A8Tgd2W/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue + version_id: A8Tgd2W + shortlink: https://sg.run/d23P + source: + https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue + subcategory: + - vuln + technology: + - AWS-CDK + vulnerability_class: + - Cryptographic Issues pattern-either: - patterns: - - pattern-inside: 'import {Queue} from ''@aws-cdk/aws-sqs'' - - ... - - ' + - pattern-inside: "import {Queue} from '@aws-cdk/aws-sqs'\n...\n" - pattern: const $X = new Queue(...) - - pattern-not: 'const $X = new Queue(..., {..., encryption: QueueEncryption.KMS_MANAGED, ...}) - - ' - - pattern-not: 'const $X = new Queue(..., {..., encryption: QueueEncryption.KMS, ...}) - - ' - - patterns: - - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-sqs'' - - ... - - ' + - pattern-not: "const $X = new Queue(..., {..., encryption: QueueEncryption.KMS_MANAGED, ...})\n" + - pattern-not: "const $X = new Queue(..., {..., encryption: QueueEncryption.KMS, ...})\n" + - patterns: + - pattern-inside: "import * as $Y from '@aws-cdk/aws-sqs'\n...\n" - pattern: const $X = new $Y.Queue(...) - - pattern-not: 'const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS_MANAGED, ...}) - - ' - - pattern-not: 'const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS, ...}) - - ' + - pattern-not: "const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS_MANAGED, ...})\n" + - pattern-not: "const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS, ...})\n" + severity: WARNING - id: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod - message: Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. - Verify if this is intentional. + languages: + - ts + message: Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world + accessible. Verify if this is intentional. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-306: Missing Authentication for Critical Function' - category: security - technology: - - AWS-CDK - references: - - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: HIGH - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod - shortlink: https://sg.run/Z4p7 + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html semgrep.dev: rule: + origin: community r_id: 15279 - rv_id: 1263906 rule_id: wdUjZK + rv_id: 1263906 + url: + https://semgrep.dev/playground/r/BjTkZA7/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod version_id: BjTkZA7 - url: https://semgrep.dev/playground/r/BjTkZA7/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod - origin: community - languages: - - ts - severity: WARNING + shortlink: https://sg.run/Z4p7 + source: + https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod + subcategory: + - vuln + technology: + - AWS-CDK + vulnerability_class: + - Improper Authentication pattern-either: - patterns: - - pattern-inside: 'import {Bucket} from ''@aws-cdk/aws-s3'' - - ... - - ' - - pattern: 'const $X = new Bucket(...) - - ... - - $X.grantPublicAccess(...) - - ' - - patterns: - - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-s3'' - - ... - - ' - - pattern: 'const $X = new $Y.Bucket(...) - - ... - - $X.grantPublicAccess(...) - - ' + - pattern-inside: "import {Bucket} from '@aws-cdk/aws-s3'\n...\n" + - pattern: "const $X = new Bucket(...)\n...\n$X.grantPublicAccess(...)\n" + - patterns: + - pattern-inside: "import * as $Y from '@aws-cdk/aws-s3'\n...\n" + - pattern: "const $X = new $Y.Bucket(...)\n...\n$X.grantPublicAccess(...)\n" + severity: WARNING - id: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public - message: CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically - accessible, including builds prior to the project being public. Ensure this is acceptable for the project. + languages: + - ts + message: CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts + publically accessible, including builds prior to the project being public. Ensure this is acceptable for the + project. metadata: category: security + confidence: MEDIUM cwe: - 'CWE-306: Missing Authentication for Critical Function' - technology: - - AWS-CDK - references: - - https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public - shortlink: https://sg.run/nK7G + likelihood: MEDIUM + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html semgrep.dev: rule: + origin: community r_id: 15280 - rv_id: 1263907 rule_id: x8UxXZ + rv_id: 1263907 + url: + https://semgrep.dev/playground/r/DkTRbj1/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public version_id: DkTRbj1 - url: https://semgrep.dev/playground/r/DkTRbj1/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public - origin: community - languages: - - ts - severity: WARNING + shortlink: https://sg.run/nK7G + source: + https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public + subcategory: + - vuln + technology: + - AWS-CDK + vulnerability_class: + - Improper Authentication pattern-either: - patterns: - - pattern-inside: 'import {Project} from ''@aws-cdk/aws-codebuild'' - - ... - - ' - - pattern: 'const $X = new Project(..., {..., badge: true, ...}) - - ' - - patterns: - - pattern-inside: 'import * as $Y from ''@aws-cdk/aws-codebuild'' - - ... - - ' - - pattern: 'const $X = new $Y.Project(..., {..., badge: true, ...}) - - ' + - pattern-inside: "import {Project} from '@aws-cdk/aws-codebuild'\n...\n" + - pattern: "const $X = new Project(..., {..., badge: true, ...})\n" + - patterns: + - pattern-inside: "import * as $Y from '@aws-cdk/aws-codebuild'\n...\n" + - pattern: "const $X = new $Y.Project(..., {..., badge: true, ...})\n" + severity: WARNING - id: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml - message: Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site - scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using - a sanitization library such as DOMPurify to sanitize your HTML. + languages: + - typescript + - javascript + message: Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to + cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use + dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html - category: security - confidence: MEDIUM - technology: - - react - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml - shortlink: https://sg.run/rAx6 semgrep.dev: rule: + origin: community r_id: 9769 - rv_id: 1263912 rule_id: x8UWvK + rv_id: 1263912 + url: + https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml version_id: l4TJR0v - url: https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml - origin: community - languages: - - typescript - - javascript - severity: WARNING + shortlink: https://sg.run/rAx6 + source: + https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml + subcategory: + - vuln + technology: + - react + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: 'function ...({..., $X, ...}) { ... } - - ' - - pattern-inside: 'function ...(..., $X, ...) { ... } - - ' - - focus-metavariable: $X - - pattern-not-inside: '$F. ... .$SANITIZEUNC(...) - - ' - pattern-sinks: - - patterns: - - focus-metavariable: $X - - pattern-either: - - pattern: '{...,dangerouslySetInnerHTML: {__html: $X},...} - - ' - - pattern: '<$Y ... dangerouslySetInnerHTML={{__html: $X}} /> - - ' - - pattern-not: '<$Y ... dangerouslySetInnerHTML={{__html: "..."}} /> - - ' - - pattern-not: '{...,dangerouslySetInnerHTML:{__html: "..."},...} - - ' - - metavariable-pattern: - patterns: - - pattern-not: '{...} - - ' - metavariable: $X - - pattern-not: '<... {__html: "..."} ...> - - ' - - pattern-not: '<... {__html: `...`} ...> - - ' pattern-sanitizers: - patterns: - pattern-either: - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import * as $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: '$S = require("underscore.string") - - ... - - ' + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "import * as $S from \"underscore.string\"\n...\n" + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "$S = require(\"underscore.string\")\n...\n" - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from "dompurify" - - ... - - ' - - pattern-inside: 'import { ..., $S,... } from "dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "dompurify" - - ... - - ' - - pattern-inside: '$S = require("dompurify") - - ... - - ' - - pattern-inside: 'import $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: '$S = require("isomorphic-dompurify") - - ... - - ' + - pattern-inside: "import $S from \"dompurify\"\n...\n" + - pattern-inside: "import { ..., $S,... } from \"dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"dompurify\"\n...\n" + - pattern-inside: "$S = require(\"dompurify\")\n...\n" + - pattern-inside: "import $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "$S = require(\"isomorphic-dompurify\")\n...\n" - pattern-either: - patterns: - - pattern-inside: '$VALUE = $S(...) - - ... - - ' + - pattern-inside: "$VALUE = $S(...)\n...\n" - pattern: $VALUE.sanitize(...) - patterns: - - pattern-inside: '$VALUE = $S.sanitize - - ... - - ' + - pattern-inside: "$VALUE = $S.sanitize\n...\n" - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''xss''; - - ... - - ' - - pattern-inside: 'import * as $S from ''xss''; - - ... - - ' - - pattern-inside: '$S = require("xss") - - ... - - ' + - pattern-inside: "import $S from 'xss';\n...\n" + - pattern-inside: "import * as $S from 'xss';\n...\n" + - pattern-inside: "$S = require(\"xss\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''sanitize-html''; - - ... - - ' - - pattern-inside: 'import * as $S from "sanitize-html"; - - ... - - ' - - pattern-inside: '$S = require("sanitize-html") - - ... - - ' + - pattern-inside: "import $S from 'sanitize-html';\n...\n" + - pattern-inside: "import * as $S from \"sanitize-html\";\n...\n" + - pattern-inside: "$S = require(\"sanitize-html\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: '$S = new Remarkable() - - ... - - ' + - pattern-inside: "$S = new Remarkable()\n...\n" - pattern: $S.render(...) + pattern-sinks: + - patterns: + - focus-metavariable: $X + - pattern-either: + - pattern: "{...,dangerouslySetInnerHTML: {__html: $X},...}\n" + - pattern: "<$Y ... dangerouslySetInnerHTML={{__html: $X}} />\n" + - pattern-not: "<$Y ... dangerouslySetInnerHTML={{__html: \"...\"}} />\n" + - pattern-not: "{...,dangerouslySetInnerHTML:{__html: \"...\"},...}\n" + - metavariable-pattern: + metavariable: $X + patterns: + - pattern-not: "{...}\n" + - pattern-not: "<... {__html: \"...\"} ...>\n" + - pattern-not: "<... {__html: `...`} ...>\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "function ...({..., $X, ...}) { ... }\n" + - pattern-inside: "function ...(..., $X, ...) { ... }\n" + - focus-metavariable: $X + - pattern-not-inside: "$F. ... .$SANITIZEUNC(...)\n" + severity: WARNING - id: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method - message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) - attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as - DOMPurify to sanitize your HTML. + languages: + - typescript + - javascript + message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting + (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization + library such as DOMPurify to sanitize your HTML. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection @@ -41568,47 +32235,67 @@ rules: - https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln - https://developer.mozilla.org/en-US/docs/Web/API/Document/write - https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML - category: security - confidence: MEDIUM - technology: - - react - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method - shortlink: https://sg.run/E5x8 semgrep.dev: rule: + origin: community r_id: 9781 - rv_id: 1263916 rule_id: QrU68w + rv_id: 1263916 + url: + https://semgrep.dev/playground/r/GxTkeRl/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method version_id: GxTkeRl - url: https://semgrep.dev/playground/r/GxTkeRl/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method - origin: community - languages: - - typescript - - javascript - severity: WARNING + shortlink: https://sg.run/E5x8 + source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method + subcategory: + - vuln + technology: + - react + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: + pattern-sanitizers: - patterns: - pattern-either: - - pattern-inside: 'function ...({..., $X, ...}) { ... } - - ' - - pattern-inside: 'function ...(..., $X, ...) { ... } - - ' - - focus-metavariable: $X + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "import * as $S from \"underscore.string\"\n...\n" + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "$S = require(\"underscore.string\")\n...\n" - pattern-either: - - pattern: $X.$Y - - pattern: $X[...] + - pattern: $S.escapeHTML(...) + - patterns: + - pattern-either: + - pattern-inside: "import $S from \"dompurify\"\n...\n" + - pattern-inside: "import { ..., $S,... } from \"dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"dompurify\"\n...\n" + - pattern-inside: "$S = require(\"dompurify\")\n...\n" + - pattern-inside: "import $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "$S = require(\"isomorphic-dompurify\")\n...\n" + - pattern-either: + - patterns: + - pattern-inside: "$VALUE = $S(...)\n...\n" + - pattern: $VALUE.sanitize(...) + - patterns: + - pattern-inside: "$VALUE = $S.sanitize\n...\n" + - pattern: $S(...) + - pattern: $S.sanitize(...) + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: "import $S from 'xss';\n...\n" + - pattern-inside: "import * as $S from 'xss';\n...\n" + - pattern-inside: "$S = require(\"xss\")\n...\n" + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: "import $S from 'sanitize-html';\n...\n" + - pattern-inside: "import * as $S from \"sanitize-html\";\n...\n" + - pattern-inside: "$S = require(\"sanitize-html\")\n...\n" + - pattern: $S(...) + - patterns: + - pattern-either: + - pattern-inside: "$S = new Remarkable()\n...\n" + - pattern: $S.render(...) pattern-sinks: - patterns: - pattern-either: @@ -41626,216 +32313,109 @@ rules: metavariable: $HTML regex: (insertAdjacentHTML) - focus-metavariable: $SINK + pattern-sources: + - patterns: + - pattern-either: + - pattern-inside: "function ...({..., $X, ...}) { ... }\n" + - pattern-inside: "function ...(..., $X, ...) { ... }\n" + - focus-metavariable: $X + - pattern-either: + - pattern: $X.$Y + - pattern: $X[...] + severity: WARNING +- id: typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property + languages: + - typescript + - javascript + message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting + (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization + library such as DOMPurify to sanitize your HTML. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A07:2017 - Cross-Site Scripting (XSS) + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html + semgrep.dev: + rule: + origin: community + r_id: 9782 + rule_id: 3qUBl4 + rv_id: 1263917 + url: + https://semgrep.dev/playground/r/RGT0Lln/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property + version_id: RGT0Lln + shortlink: https://sg.run/70Zv + source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property + subcategory: + - vuln + technology: + - react + vulnerability_class: + - Cross-Site-Scripting (XSS) + mode: taint pattern-sanitizers: - patterns: - pattern-either: - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import * as $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: '$S = require("underscore.string") - - ... - - ' + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "import * as $S from \"underscore.string\"\n...\n" + - pattern-inside: "import $S from \"underscore.string\"\n...\n" + - pattern-inside: "$S = require(\"underscore.string\")\n...\n" - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from "dompurify" - - ... - - ' - - pattern-inside: 'import { ..., $S,... } from "dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "dompurify" - - ... - - ' - - pattern-inside: '$S = require("dompurify") - - ... - - ' - - pattern-inside: 'import $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: '$S = require("isomorphic-dompurify") - - ... - - ' + - pattern-inside: "import $S from \"dompurify\"\n...\n" + - pattern-inside: "import { ..., $S,... } from \"dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"dompurify\"\n...\n" + - pattern-inside: "$S = require(\"dompurify\")\n...\n" + - pattern-inside: "import $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "import * as $S from \"isomorphic-dompurify\"\n...\n" + - pattern-inside: "$S = require(\"isomorphic-dompurify\")\n...\n" - pattern-either: - patterns: - - pattern-inside: '$VALUE = $S(...) - - ... - - ' + - pattern-inside: "$VALUE = $S(...)\n...\n" - pattern: $VALUE.sanitize(...) - patterns: - - pattern-inside: '$VALUE = $S.sanitize - - ... - - ' + - pattern-inside: "$VALUE = $S.sanitize\n...\n" - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''xss''; - - ... - - ' - - pattern-inside: 'import * as $S from ''xss''; - - ... - - ' - - pattern-inside: '$S = require("xss") - - ... - - ' + - pattern-inside: "import $S from 'xss';\n...\n" + - pattern-inside: "import * as $S from 'xss';\n...\n" + - pattern-inside: "$S = require(\"xss\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: 'import $S from ''sanitize-html''; - - ... - - ' - - pattern-inside: 'import * as $S from "sanitize-html"; - - ... - - ' - - pattern-inside: '$S = require("sanitize-html") - - ... - - ' + - pattern-inside: "import $S from 'sanitize-html';\n...\n" + - pattern-inside: "import * as $S from \"sanitize-html\";\n...\n" + - pattern-inside: "$S = require(\"sanitize-html\")\n...\n" - pattern: $S(...) - patterns: - pattern-either: - - pattern-inside: '$S = new Remarkable() - - ... - - ' + - pattern-inside: "$S = new Remarkable()\n...\n" - pattern: $S.render(...) -- id: typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property - message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) - attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as - DOMPurify to sanitize your HTML. - metadata: - cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' - owasp: - - A07:2017 - Cross-Site Scripting (XSS) - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html - category: security - confidence: MEDIUM - technology: - - react - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property - shortlink: https://sg.run/70Zv - semgrep.dev: - rule: - r_id: 9782 - rv_id: 1263917 - rule_id: 3qUBl4 - version_id: RGT0Lln - url: https://semgrep.dev/playground/r/RGT0Lln/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property - origin: community - languages: - - typescript - - javascript - severity: WARNING - mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern-inside: 'function ...({..., $X, ...}) { ... } - - ' - - pattern-inside: 'function ...(..., $X, ...) { ... } - - ' - - focus-metavariable: $X - - pattern-either: - - pattern: $X.$Y - - pattern: $X[...] pattern-sinks: - patterns: - pattern-either: - - pattern-inside: '$BODY = $REACT.useRef(...) - - ... - - ' - - pattern-inside: '$BODY = useRef(...) - - ... - - ' - - pattern-inside: '$BODY = findDOMNode(...) - - ... - - ' - - pattern-inside: '$BODY = createRef(...) - - ... - - ' - - pattern-inside: '$BODY = $REACT.findDOMNode(...) - - ... - - ' - - pattern-inside: '$BODY = $REACT.createRef(...) - - ... - - ' + - pattern-inside: "$BODY = $REACT.useRef(...)\n...\n" + - pattern-inside: "$BODY = useRef(...)\n...\n" + - pattern-inside: "$BODY = findDOMNode(...)\n...\n" + - pattern-inside: "$BODY = createRef(...)\n...\n" + - pattern-inside: "$BODY = $REACT.findDOMNode(...)\n...\n" + - pattern-inside: "$BODY = $REACT.createRef(...)\n...\n" - pattern-either: - pattern: "$BODY. ... .$HTML = $SINK \n" - pattern: "$BODY.$HTML = $SINK \n" @@ -41850,261 +32430,116 @@ rules: metavariable: $HTML regex: (innerHTML|outerHTML) - focus-metavariable: $SINK - pattern-sanitizers: - - patterns: - - pattern-either: - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import * as $S from "underscore.string" - - ... - - ' - - pattern-inside: 'import $S from "underscore.string" - - ... - - ' - - pattern-inside: '$S = require("underscore.string") - - ... - - ' - - pattern-either: - - pattern: $S.escapeHTML(...) - - patterns: - - pattern-either: - - pattern-inside: 'import $S from "dompurify" - - ... - - ' - - pattern-inside: 'import { ..., $S,... } from "dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "dompurify" - - ... - - ' - - pattern-inside: '$S = require("dompurify") - - ... - - ' - - pattern-inside: 'import $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: 'import * as $S from "isomorphic-dompurify" - - ... - - ' - - pattern-inside: '$S = require("isomorphic-dompurify") - - ... - - ' - - pattern-either: - - patterns: - - pattern-inside: '$VALUE = $S(...) - - ... - - ' - - pattern: $VALUE.sanitize(...) - - patterns: - - pattern-inside: '$VALUE = $S.sanitize - - ... - - ' - - pattern: $S(...) - - pattern: $S.sanitize(...) - - pattern: $S(...) - - patterns: - - pattern-either: - - pattern-inside: 'import $S from ''xss''; - - ... - - ' - - pattern-inside: 'import * as $S from ''xss''; - - ... - - ' - - pattern-inside: '$S = require("xss") - - ... - - ' - - pattern: $S(...) + pattern-sources: - patterns: - pattern-either: - - pattern-inside: 'import $S from ''sanitize-html''; - - ... - - ' - - pattern-inside: 'import * as $S from "sanitize-html"; - - ... - - ' - - pattern-inside: '$S = require("sanitize-html") - - ... - - ' - - pattern: $S(...) - - patterns: + - pattern-inside: "function ...({..., $X, ...}) { ... }\n" + - pattern-inside: "function ...(..., $X, ...) { ... }\n" + - focus-metavariable: $X - pattern-either: - - pattern-inside: '$S = new Remarkable() - - ... - - ' - - pattern: $S.render(...) + - pattern: $X.$Y + - pattern: $X[...] + severity: WARNING - id: typescript.react.security.react-insecure-request.react-insecure-request + languages: + - typescript + - javascript message: Unencrypted request over HTTP detected. metadata: - vulnerability: Insecure Transport + category: security + confidence: MEDIUM + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-319: Cleartext Transmission of Sensitive Information' references: - https://www.npmjs.com/package/axios - category: security - technology: - - react - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request - shortlink: https://sg.run/1n0b semgrep.dev: rule: + origin: community r_id: 9766 - rv_id: 1263918 rule_id: NbUA3O + rv_id: 1263918 + url: + https://semgrep.dev/playground/r/A8Tgd2p/typescript.react.security.react-insecure-request.react-insecure-request version_id: A8Tgd2p - url: https://semgrep.dev/playground/r/A8Tgd2p/typescript.react.security.react-insecure-request.react-insecure-request - origin: community - languages: - - typescript - - javascript - severity: ERROR + shortlink: https://sg.run/1n0b + source: https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request + subcategory: + - vuln + technology: + - react + vulnerability: Insecure Transport + vulnerability_class: + - Mishandled Sensitive Information patterns: - pattern-either: - patterns: - pattern-either: - - pattern-inside: 'import $AXIOS from ''axios''; - - ... - - $AXIOS.$METHOD(...) - - ' - - pattern-inside: '$AXIOS = require(''axios''); - - ... - - $AXIOS.$METHOD(...) - - ' + - pattern-inside: "import $AXIOS from 'axios';\n...\n$AXIOS.$METHOD(...)\n" + - pattern-inside: "$AXIOS = require('axios');\n...\n$AXIOS.$METHOD(...)\n" - pattern: $AXIOS.$VERB("$URL",...) - metavariable-regex: metavariable: $VERB regex: ^(get|post|delete|head|patch|put|options) - patterns: - pattern-either: - - pattern-inside: 'import $AXIOS from ''axios''; - - ... - - $AXIOS(...) - - ' - - pattern-inside: '$AXIOS = require(''axios''); - - ... - - $AXIOS(...) - - ' + - pattern-inside: "import $AXIOS from 'axios';\n...\n$AXIOS(...)\n" + - pattern-inside: "$AXIOS = require('axios');\n...\n$AXIOS(...)\n" - pattern-either: - pattern: '$AXIOS({url: "$URL"}, ...)' - - pattern: '$OPTS = {url: "$URL"} - - ... - - $AXIOS($OPTS, ...) - - ' + - pattern: "$OPTS = {url: \"$URL\"}\n...\n$AXIOS($OPTS, ...)\n" - pattern: fetch("$URL", ...) - metavariable-regex: metavariable: $URL regex: ^([Hh][Tt][Tt][Pp]:\/\/(?!localhost).*) + severity: ERROR - id: yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection - message: Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the - parameters to env variables instead. languages: - yaml + message: Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert + the parameters to env variables instead. metadata: category: security + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 – Injection - confidence: MEDIUM - likelihood: MEDIUM - impact: HIGH - subcategory: - - vuln references: - https://github.com/argoproj/argo-workflows/issues/5061 - https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370 + semgrep.dev: + rule: + origin: community + r_id: 40768 + rule_id: 10U0zW + rv_id: 1151472 + url: + https://semgrep.dev/playground/r/xyTp17z/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection + version_id: xyTp17z + shortlink: https://sg.run/yqeZ + source: + https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection + subcategory: + - vuln technology: - ci - argo - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection - Command Injection - source: https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection - shortlink: https://sg.run/yqeZ - semgrep.dev: - rule: - r_id: 40768 - rv_id: 1151472 - rule_id: 10U0zW - version_id: xyTp17z - url: https://semgrep.dev/playground/r/xyTp17z/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection - origin: community - severity: ERROR patterns: - - pattern-inside: 'apiVersion: $VERSION - - ... - - ' + - pattern-inside: "apiVersion: $VERSION\n...\n" - metavariable-regex: metavariable: $VERSION regex: (argoproj.io.*) @@ -42113,7 +32548,8 @@ rules: - pattern-inside: "command:\n ...\n - $LANG\n ...\n...\nsource:\n $SCRIPT\n" - metavariable-regex: metavariable: $LANG - regex: .*(sh|bash|ksh|csh|tcsh|zsh|python|python3|node|perl|ruby|php|lua|awk|sed|powershell|fish|dash|R|grooby|scala|clj|elixir|coffee|dart|haskell|ocaml).* + regex: + .*(sh|bash|ksh|csh|tcsh|zsh|python|python3|node|perl|ruby|php|lua|awk|sed|powershell|fish|dash|R|grooby|scala|clj|elixir|coffee|dart|haskell|ocaml).* - metavariable-pattern: metavariable: $SCRIPT pattern-either: @@ -42126,29 +32562,30 @@ rules: - pattern-inside: "containerSet:\n ...\n containers:\n - ...\n command: $LANG\n ...\n args: $PARAM\n" - metavariable-regex: metavariable: $LANG - regex: .*(sh|bash|ksh|csh|tcsh|zsh|python|python3|node|perl|ruby|php|lua|awk|sed|powershell|fish|dash|R|grooby|scala|clj|elixir|coffee|dart|haskell|ocaml).* + regex: + .*(sh|bash|ksh|csh|tcsh|zsh|python|python3|node|perl|ruby|php|lua|awk|sed|powershell|fish|dash|R|grooby|scala|clj|elixir|coffee|dart|haskell|ocaml).* - metavariable-pattern: metavariable: $PARAM pattern-either: - pattern-regex: (.*{{.*inputs.parameters.*}}.*) - pattern-regex: (.*{{.*workflow.parameters.*}}.*) - focus-metavariable: $PARAM -- id: yaml.docker-compose.security.privileged-service.privileged-service - patterns: - - pattern-inside: "version: ...\n...\nservices:\n ...\n $SERVICE:\n ...\n privileged: $TRUE\n" - - focus-metavariable: $TRUE - - metavariable-regex: - metavariable: $TRUE - regex: (true) - fix: 'false - - ' - message: Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities - on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the - 'privileged' key to disable this capability. + severity: ERROR +- fix: "false\n" + id: yaml.docker-compose.security.privileged-service.privileged-service + languages: + - yaml + message: Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root + capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security + concerns. Remove the 'privileged' key to disable this capability. metadata: + category: security + confidence: HIGH cwe: - 'CWE-250: Execution with Unnecessary Privileges' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A06:2017 - Security Misconfiguration - A05:2021 - Security Misconfiguration @@ -42156,114 +32593,116 @@ rules: references: - https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html - https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/ - category: security - technology: - - docker-compose - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service - shortlink: https://sg.run/AlX0 semgrep.dev: rule: + origin: community r_id: 10006 - rv_id: 1263922 rule_id: DbUW17 - version_id: 0bTKzXZ + rv_id: 1263922 url: https://semgrep.dev/playground/r/0bTKzXZ/yaml.docker-compose.security.privileged-service.privileged-service - origin: community - languages: - - yaml + version_id: 0bTKzXZ + shortlink: https://sg.run/AlX0 + source: https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service + subcategory: + - vuln + technology: + - docker-compose + vulnerability_class: + - Improper Authorization + patterns: + - pattern-inside: "version: ...\n...\nservices:\n ...\n $SERVICE:\n ...\n privileged: $TRUE\n" + - focus-metavariable: $TRUE + - metavariable-regex: + metavariable: $TRUE + regex: (true) severity: WARNING - id: yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands languages: - yaml - severity: WARNING - message: The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` - and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified - by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the - system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen - code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files - for more information. + message: The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the + `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment + variables being modified by an attacker. Depending on the use of the environment variable, this could enable an + attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code + execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use + Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more + information. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-749: Exposed Dangerous Method or Function' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: A06:2017 - Security Misconfiguration references: - https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/ - https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w - https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files - category: security - technology: - - github-actions - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Dangerous Method or Function - source: https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands - shortlink: https://sg.run/qq78 semgrep.dev: rule: + origin: community r_id: 13412 - rv_id: 947039 rule_id: EwUQ9x + rv_id: 947039 + url: + https://semgrep.dev/playground/r/jQTzq34/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands version_id: jQTzq34 - url: https://semgrep.dev/playground/r/jQTzq34/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands - origin: community + shortlink: https://sg.run/qq78 + source: https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands + subcategory: + - vuln + technology: + - github-actions + vulnerability_class: + - Dangerous Method or Function patterns: - pattern-either: - patterns: - pattern-inside: '{env: ...}' - pattern: 'ACTIONS_ALLOW_UNSECURE_COMMANDS: true' + severity: WARNING - id: yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor languages: - yaml message: The Shai-hulud backdoor creates a purposefully vulnerable github action with the name `discussion.yaml`. - paths: - include: - - '**/.github/workflows/discussion.yaml' metadata: category: security + confidence: HIGH cwe: - 'CWE-509: Replicating Malicious Code (Virus or Worm)' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - technology: - - github-actions - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source_rule_url: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack references: - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains - source: https://semgrep.dev/r/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor - shortlink: https://sg.run/JdYPZ semgrep.dev: rule: + origin: community r_id: 238946 - rv_id: 1263927 rule_id: 7KUDRPj + rv_id: 1263927 + url: + https://semgrep.dev/playground/r/6xT29ol/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor version_id: 6xT29ol - url: https://semgrep.dev/playground/r/6xT29ol/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor - origin: community + shortlink: https://sg.run/JdYPZ + source: https://semgrep.dev/r/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor + source_rule_url: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack + subcategory: + - vuln + technology: + - github-actions + vulnerability_class: + - Command Injection + paths: + include: + - '**/.github/workflows/discussion.yaml' patterns: - pattern-inside: 'steps: [...]' - pattern-inside: "- run: ...\n ...\n" @@ -42298,43 +32737,45 @@ rules: - id: yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell languages: - yaml - message: A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | bash" - install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in - your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it. + message: A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | + bash" install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute + arbitrary code in your CI runner. Consider downloading the file first, verifying its checksum or signature, and then + executing it. metadata: category: security + confidence: HIGH cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A03:2025 - Injection references: - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions - https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ + semgrep.dev: + rule: + origin: community + r_id: 309392 + rule_id: x8UAgrE + rv_id: 1443456 + url: + https://semgrep.dev/playground/r/9lT3zYb/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell + version_id: 9lT3zYb + shortlink: https://sg.run/GR8K1 + source: https://semgrep.dev/r/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell + subcategory: + - vuln technology: - github-actions - bash - curl - cwe2021-top25: true - cwe2022-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection - source: https://semgrep.dev/r/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell - shortlink: https://sg.run/GR8K1 - semgrep.dev: - rule: - r_id: 309392 - rv_id: 1443456 - rule_id: x8UAgrE - version_id: 9lT3zYb - url: https://semgrep.dev/playground/r/9lT3zYb/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell - origin: community patterns: - pattern-inside: 'steps: [...]' - pattern-inside: "- run: ...\n ...\n" @@ -42358,101 +32799,107 @@ rules: `env:` so the secret is only available where it is actually needed.' metadata: category: security + confidence: MEDIUM cwe: - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-secrets - https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow - technology: - - github-actions - subcategory: - - audit - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret - shortlink: https://sg.run/Rrn12 semgrep.dev: rule: + origin: community r_id: 309393 - rv_id: 1443457 rule_id: OrUnq7z + rv_id: 1443457 + url: + https://semgrep.dev/playground/r/yeTqX9r/yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret version_id: yeTqX9r - url: https://semgrep.dev/playground/r/yeTqX9r/yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret - origin: community + shortlink: https://sg.run/Rrn12 + source: https://semgrep.dev/r/yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret + subcategory: + - audit + technology: + - github-actions + vulnerability_class: + - Improper Authorization patterns: - pattern-inside: "env:\n ...\n" - pattern-regex: \$\{\{\s*secrets\. - pattern-not-inside: 'jobs: ...' severity: WARNING - id: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag + languages: + - yaml message: 'GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.' - severity: WARNING - languages: - - yaml metadata: category: security + confidence: HIGH cwe: - 'CWE-1357: Reliance on Insufficiently Trustworthy Component' - 'CWE-353: Missing Support for Integrity Check' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software and Data Integrity Failures references: - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions - technology: - - github-actions - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - - Other - source: https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag - shortlink: https://sg.run/2LgAL semgrep.dev: rule: + origin: community r_id: 288863 - rv_id: 1413422 rule_id: GdUxYDx + rv_id: 1413422 + url: + https://semgrep.dev/playground/r/xyTRDAd/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag version_id: xyTRDAd - url: https://semgrep.dev/playground/r/xyTRDAd/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag - origin: community + shortlink: https://sg.run/2LgAL + source: + https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag + subcategory: + - vuln + technology: + - github-actions + vulnerability_class: + - Cryptographic Issues + - Other patterns: - pattern-inside: '{steps: ...}' - - pattern: 'uses: "$ACTION" - - ' + - pattern: "uses: \"$ACTION\"\n" - metavariable-pattern: - metavariable: $ACTION language: generic + metavariable: $ACTION patterns: - pattern-not-regex: ^\./ - pattern-not-regex: ^docker:// - pattern-not-regex: '@[0-9a-f]{40}(\s|$)' + severity: WARNING - id: yaml.github-actions.security.github-script-injection.github-script-injection languages: - yaml - message: 'Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`''s `script:` step + message: "Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes - the environment variable, like this: "$ENVVAR".' + the environment variable, like this: \"$ENVVAR\"." metadata: category: security + confidence: HIGH cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2021 - Injection - A05:2025 - Injection @@ -42460,34 +32907,26 @@ rules: - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections - https://securitylab.github.com/research/github-actions-untrusted-input/ - https://github.com/actions/github-script - technology: - - github-actions - cwe2022-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection - shortlink: https://sg.run/g1G0 semgrep.dev: rule: + origin: community r_id: 31441 - rv_id: 1501843 rule_id: OrUQvK + rv_id: 1501843 + url: + https://semgrep.dev/playground/r/e1TboJK/yaml.github-actions.security.github-script-injection.github-script-injection version_id: e1TboJK - url: https://semgrep.dev/playground/r/e1TboJK/yaml.github-actions.security.github-script-injection.github-script-injection - origin: community + shortlink: https://sg.run/g1G0 + source: https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection + subcategory: + - vuln + technology: + - github-actions + vulnerability_class: + - Code Injection patterns: - pattern-inside: 'steps: [...]' - - pattern-inside: 'uses: $ACTION - - ... - - ' + - pattern-inside: "uses: $ACTION\n...\n" - pattern-inside: "with:\n ...\n script: ...\n ...\n" - pattern: 'script: $SHELL' - metavariable-regex: @@ -42571,59 +33010,53 @@ rules: - id: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout languages: - yaml - message: This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. - When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all - repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming - PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You - may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let - an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or - dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from - the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ - for additional mitigations. + message: This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull + request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes + access to all repository secrets. Normally, this is safe because the Action only runs code from the target + repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code + for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to + repository secrets, which would let an attacker steal repository secrets. This normally happens by running build + scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit + your workflow file to make sure no code from the incoming PR is executed. Please see + https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations. metadata: category: security + confidence: HIGH + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software and Data Integrity Failures - cwe: - - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' references: - https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ - https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target - https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md - technology: - - github-actions - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout - shortlink: https://sg.run/jkdn semgrep.dev: rule: + origin: community r_id: 13365 - rv_id: 1413423 rule_id: d8Ulkd + rv_id: 1413423 + url: + https://semgrep.dev/playground/r/O9TQ2nX/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout version_id: O9TQ2nX - url: https://semgrep.dev/playground/r/O9TQ2nX/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout - origin: community + shortlink: https://sg.run/jkdn + source: + https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout + subcategory: + - vuln + technology: + - github-actions + vulnerability_class: + - Other patterns: - pattern-either: - pattern-inside: "on:\n ...\n pull_request_target: ...\n ...\n...\n" - - pattern-inside: 'on: [..., pull_request_target, ...] - - ... - - ' - - pattern-inside: 'on: pull_request_target - - ... - - ' + - pattern-inside: "on: [..., pull_request_target, ...]\n...\n" + - pattern-inside: "on: pull_request_target\n...\n" - pattern-inside: "jobs:\n ...\n $JOBNAME:\n ...\n steps:\n ...\n" - pattern: "...\nuses: \"$ACTION\"\nwith:\n ...\n ref: $EXPR\n" - metavariable-regex: @@ -42648,8 +33081,14 @@ rules: variable, like this: "$ENVVAR".' metadata: category: security + confidence: HIGH cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -42657,28 +33096,23 @@ rules: references: - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections - https://securitylab.github.com/research/github-actions-untrusted-input/ - technology: - - github-actions - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection - shortlink: https://sg.run/pkzk semgrep.dev: rule: + origin: community r_id: 13162 - rv_id: 1501844 rule_id: v8UjQj + rv_id: 1501844 + url: + https://semgrep.dev/playground/r/vdTowy6/yaml.github-actions.security.run-shell-injection.run-shell-injection version_id: vdTowy6 - url: https://semgrep.dev/playground/r/vdTowy6/yaml.github-actions.security.run-shell-injection.run-shell-injection - origin: community + shortlink: https://sg.run/pkzk + source: https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection + subcategory: + - vuln + technology: + - github-actions + vulnerability_class: + - Command Injection patterns: - pattern-inside: 'steps: [...]' - pattern-inside: "- run: ...\n ...\n" @@ -42761,84 +33195,87 @@ rules: - id: yaml.github-actions.security.secrets-inherit.secrets-inherit languages: - yaml - severity: ERROR - message: 'This workflow uses `secrets: inherit` to pass all of the calling workflow''s secrets to a reusable workflow. This + message: "This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` - map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`.' + map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`." metadata: category: security + confidence: HIGH cwe: - 'CWE-250: Execution with Unnecessary Privileges' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow - https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions - technology: - - github-actions - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/yaml.github-actions.security.secrets-inherit.secrets-inherit - shortlink: https://sg.run/X2PZB semgrep.dev: rule: + origin: community r_id: 288864 - rv_id: 1413424 rule_id: ReUQnKg - version_id: e1T42L1 + rv_id: 1413424 url: https://semgrep.dev/playground/r/e1T42L1/yaml.github-actions.security.secrets-inherit.secrets-inherit - origin: community + version_id: e1T42L1 + shortlink: https://sg.run/X2PZB + source: https://semgrep.dev/r/yaml.github-actions.security.secrets-inherit.secrets-inherit + subcategory: + - vuln + technology: + - github-actions + vulnerability_class: + - Improper Authorization patterns: - pattern-inside: "jobs:\n ...\n" - pattern: 'secrets: inherit' + severity: ERROR - id: yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout languages: - yaml - message: This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When - using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository - secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, - by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently - executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository - secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts - (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please - see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations. + message: This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. + When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all + repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the + incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the + action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, + which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm + build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to + make sure no code from the incoming PR is executed. Please see + https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations. metadata: category: security - owasp: A01:2017 - Injection + confidence: MEDIUM cwe: 'CWE-913: Improper Control of Dynamically-Managed Code Resources' - likelihood: MEDIUM impact: MEDIUM - confidence: MEDIUM - subcategory: - - vuln + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: A01:2017 - Injection references: - https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ - https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md - https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability + semgrep.dev: + rule: + origin: community + r_id: 35494 + rule_id: 4bU8E4 + rv_id: 947046 + url: + https://semgrep.dev/playground/r/kbTYRwl/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout + version_id: kbTYRwl + shortlink: https://sg.run/A0p6 + source: + https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout + subcategory: + - vuln technology: - github-actions - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection - source: https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout - shortlink: https://sg.run/A0p6 - semgrep.dev: - rule: - r_id: 35494 - rv_id: 947046 - rule_id: 4bU8E4 - version_id: kbTYRwl - url: https://semgrep.dev/playground/r/kbTYRwl/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout - origin: community patterns: - pattern-inside: "on:\n ...\n workflow_run: ...\n ...\n...\n" - pattern-inside: "jobs:\n ...\n $JOBNAME:\n ...\n steps:\n ...\n" @@ -42852,31 +33289,84 @@ rules: patterns: - pattern: ${{ github.event.workflow_run ... }} severity: WARNING -- id: yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext +- fix: "securityContext:\n allowPrivilegeEscalation: false\n$NAME\n" + id: + yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext + languages: + - yaml + message: In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, + certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege + escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a + `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This + will prevent the container from running any privileged processes and limit the impact of any potential attacks. By + adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are + more secure and less vulnerable to privilege escalation attacks. + metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A05:2021 - Security Misconfiguration + - A06:2017 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation + - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + - https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt + - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag + semgrep.dev: + rule: + origin: community + r_id: 47276 + rule_id: WAU5J6 + rv_id: 1263931 + url: + https://semgrep.dev/playground/r/2KTv2j8/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext + version_id: 2KTv2j8 + shortlink: https://sg.run/eleR + source: + https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext + subcategory: + - vuln + technology: + - kubernetes + vulnerability_class: + - Improper Authorization patterns: - pattern-inside: "containers:\n ...\n" - pattern-inside: "- $NAME: $CONTAINER\n ...\n" - - pattern: 'image: ... - - ... - - ' + - pattern: "image: ...\n...\n" - pattern-not: "image: ...\n...\nsecurityContext:\n ...\n" - metavariable-regex: metavariable: $NAME regex: name - focus-metavariable: $NAME - fix: "securityContext:\n allowPrivilegeEscalation: false\n$NAME\n" - message: In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain - container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation - and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container - in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running - any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes - pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation - attacks. + severity: WARNING +- fix: "false\n" + id: yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true + languages: + - yaml + message: In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, + certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform + privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a + `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This + will prevent the container from running any privileged processes and limit the impact of any potential attacks. In + the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to + privelege escalation attacks. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2021 - Security Misconfiguration - A06:2017 - Security Misconfiguration @@ -42886,62 +33376,55 @@ rules: - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag - category: security - technology: - - kubernetes - cwe2021-top25: true + semgrep.dev: + rule: + origin: community + r_id: 47277 + rule_id: 0oUkqQ + rv_id: 1263932 + url: + https://semgrep.dev/playground/r/X0Tzyqr/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true + version_id: X0Tzyqr + shortlink: https://sg.run/vw3W + source: + https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true subcategory: - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - kubernetes vulnerability_class: - Improper Authorization - source: https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext - shortlink: https://sg.run/eleR - semgrep.dev: - rule: - r_id: 47276 - rv_id: 1263931 - rule_id: WAU5J6 - version_id: 2KTv2j8 - url: https://semgrep.dev/playground/r/2KTv2j8/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext - origin: community - languages: - - yaml - severity: WARNING -- id: yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true patterns: - pattern-inside: "containers:\n ...\n" - pattern-inside: "- name: $CONTAINER\n ...\n" - - pattern-inside: 'image: ... - - ... - - ' + - pattern-inside: "image: ...\n...\n" - pattern-inside: "securityContext:\n ...\n" - - pattern: 'allowPrivilegeEscalation: $TRUE - - ' + - pattern: "allowPrivilegeEscalation: $TRUE\n" - metavariable-pattern: metavariable: $TRUE - pattern: 'true - - ' + pattern: "true\n" - focus-metavariable: $TRUE - fix: 'false - - ' - message: In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain - container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation - and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container - in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running - any privileged processes and limit the impact of any potential attacks. In the container `$CONTAINER` this parameter - is set to `true` which makes this container much more vulnerable to privelege escalation attacks. + severity: WARNING +- fix: "securityContext:\n allowPrivilegeEscalation: false #\n" + id: yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation + languages: + - yaml + message: In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, + certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege + escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a + `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This + will prevent the container from running any privileged processes and limit the impact of any potential attacks. By + adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your + containerized applications are more secure and less vulnerable to privilege escalation attacks. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2021 - Security Misconfiguration - A06:2017 - Security Misconfiguration @@ -42951,157 +33434,127 @@ rules: - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag - category: security - technology: - - kubernetes - cwe2021-top25: true + semgrep.dev: + rule: + origin: community + r_id: 10057 + rule_id: 6JUqEO + rv_id: 1263933 + url: + https://semgrep.dev/playground/r/jQTn527/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation + version_id: jQTn527 + shortlink: https://sg.run/ljp6 + source: https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation subcategory: - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - kubernetes vulnerability_class: - Improper Authorization - source: https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true - shortlink: https://sg.run/vw3W - semgrep.dev: - rule: - r_id: 47277 - rv_id: 1263932 - rule_id: 0oUkqQ - version_id: X0Tzyqr - url: https://semgrep.dev/playground/r/X0Tzyqr/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true - origin: community - languages: - - yaml - severity: WARNING -- id: yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation patterns: - pattern-inside: "containers:\n ...\n" - pattern-inside: "- name: $CONTAINER\n ...\n" - - pattern: 'image: ... - - ... - - ' + - pattern: "image: ...\n...\n" - pattern-inside: "image: ...\n...\n$SC:\n ...\n" - metavariable-regex: metavariable: $SC regex: ^(securityContext)$ - pattern-not-inside: "image: ...\n...\nsecurityContext:\n ...\n allowPrivilegeEscalation: $VAL\n" - focus-metavariable: $SC - fix: "securityContext:\n allowPrivilegeEscalation: false #\n" - message: In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain - container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation - and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container - in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running - any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter - to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable - to privilege escalation attacks. + severity: WARNING +- id: yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions + languages: + - yaml + message: 'Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions + to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources + attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. ' metadata: + category: security + confidence: HIGH cwe: - - 'CWE-732: Incorrect Permission Assignment for Critical Resource' + - 'CWE-269: Improper Privilege Management' + cwe2021-top25: false + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2021 - Security Misconfiguration - A06:2017 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation - - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - - https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt - - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag - category: security - technology: - - kubernetes - cwe2021-top25: true + - https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole + - https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice + - https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups + semgrep.dev: + rule: + origin: community + r_id: 73474 + rule_id: GdUR2A + rv_id: 1263935 + url: + https://semgrep.dev/playground/r/9lT4bw7/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions + version_id: 9lT4bw7 + shortlink: https://sg.run/x6Dz + source: + https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions subcategory: - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - kubernetes vulnerability_class: - Improper Authorization - source: https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation - shortlink: https://sg.run/ljp6 - semgrep.dev: - rule: - r_id: 10057 - rv_id: 1263933 - rule_id: 6JUqEO - version_id: jQTn527 - url: https://semgrep.dev/playground/r/jQTn527/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation - origin: community - languages: - - yaml - severity: WARNING -- id: yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions patterns: - - pattern: '"*" - - ' - - pattern-inside: 'resources: $A - - ... - - ' - - pattern-inside: 'verbs: $A - - ... - - ' + - pattern: "\"*\"\n" + - pattern-inside: "resources: $A\n...\n" + - pattern-inside: "verbs: $A\n...\n" - pattern-inside: "- apiGroups: [\"\"]\n ...\n" - - pattern-inside: 'apiVersion: rbac.authorization.k8s.io/v1 - - ... - - ' - - pattern-inside: 'kind: ClusterRole - - ... - - ' - message: 'Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions - to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources - attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. ' + - pattern-inside: "apiVersion: rbac.authorization.k8s.io/v1\n...\n" + - pattern-inside: "kind: ClusterRole\n...\n" + severity: WARNING +- fix: "true\n" + id: yaml.kubernetes.security.run-as-non-root-unsafe-value.run-as-non-root-unsafe-value languages: - yaml - severity: WARNING + message: When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent + privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as + the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's + recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This + will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential + attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your + containerized applications are more secure and less vulnerable to privilege escalation attacks. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-269: Improper Privilege Management' + - 'CWE-250: Execution with Unnecessary Privileges' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2021 - Security Misconfiguration - A06:2017 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - - https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole - - https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice - - https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups - category: security + - https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/ + - https://kubernetes.io/docs/concepts/policy/pod-security-policy/ + - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user + semgrep.dev: + rule: + origin: community + r_id: 26096 + rule_id: L1UAxy + rv_id: 1263939 + url: + https://semgrep.dev/playground/r/NdTzyj8/yaml.kubernetes.security.run-as-non-root-unsafe-value.run-as-non-root-unsafe-value + version_id: NdTzyj8 + shortlink: https://sg.run/D9No + source: https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root-unsafe-value.run-as-non-root-unsafe-value + subcategory: + - audit technology: - kubernetes - cwe2021-top25: false - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization - source: https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions - shortlink: https://sg.run/x6Dz - semgrep.dev: - rule: - r_id: 73474 - rv_id: 1263935 - rule_id: GdUR2A - version_id: 9lT4bw7 - url: https://semgrep.dev/playground/r/9lT4bw7/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions - origin: community -- id: yaml.kubernetes.security.run-as-non-root-unsafe-value.run-as-non-root-unsafe-value patterns: - pattern-either: - pattern: "spec:\n ...\n securityContext:\n ...\n runAsNonRoot: $VALUE\n" @@ -43110,122 +33563,68 @@ rules: - pattern: "image: ...\n...\nsecurityContext:\n ...\n runAsNonRoot: $VALUE\n" - metavariable-pattern: metavariable: $VALUE - pattern: 'false - - ' + pattern: "false\n" - focus-metavariable: $VALUE - fix: 'true - - ' - message: When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege - escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, - which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add - a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container - runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` - to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure - and less vulnerable to privilege escalation attacks. - metadata: - references: - - https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/ - - https://kubernetes.io/docs/concepts/policy/pod-security-policy/ - - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user - cwe: - - 'CWE-250: Execution with Unnecessary Privileges' - owasp: - - A05:2021 - Security Misconfiguration - - A06:2017 - Security Misconfiguration - - A02:2025 - Security Misconfiguration - category: security - technology: - - kubernetes - subcategory: - - audit - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root-unsafe-value.run-as-non-root-unsafe-value - shortlink: https://sg.run/D9No - semgrep.dev: - rule: - r_id: 26096 - rv_id: 1263939 - rule_id: L1UAxy - version_id: NdTzyj8 - url: https://semgrep.dev/playground/r/NdTzyj8/yaml.kubernetes.security.run-as-non-root-unsafe-value.run-as-non-root-unsafe-value - origin: community - languages: - - yaml severity: INFO - id: yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled - patterns: - - pattern-inside: "containers:\n ...\n" - - pattern: "image: ...\n...\nsecurityContext:\n ...\n seccompProfile: unconfined\n" - message: 'Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove - ''seccompProfile: unconfined'' to prevent this.' + languages: + - yaml + message: "Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove + 'seccompProfile: unconfined' to prevent this." metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-284: Improper Access Control' - references: - - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp - - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - category: security - technology: - - kubernetes + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled - shortlink: https://sg.run/6rgY + references: + - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp + - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ semgrep.dev: rule: + origin: community r_id: 10059 - rv_id: 1263941 rule_id: zdUynw + rv_id: 1263941 + url: + https://semgrep.dev/playground/r/w8TRoL3/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled version_id: w8TRoL3 - url: https://semgrep.dev/playground/r/w8TRoL3/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled - origin: community - languages: - - yaml + shortlink: https://sg.run/6rgY + source: https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled + subcategory: + - vuln + technology: + - kubernetes + vulnerability_class: + - Improper Authorization + patterns: + - pattern-inside: "containers:\n ...\n" + - pattern: "image: ...\n...\nsecurityContext:\n ...\n seccompProfile: unconfined\n" severity: WARNING - id: yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file - patterns: - - pattern: '$KEY: $VALUE - - ' - - pattern-inside: 'data: ... - - ' - - pattern-inside: 'kind: Secret - - ... - - ' - - metavariable-regex: - metavariable: $VALUE - regex: (?i)^[aA-zZ0-9+/]+={0,2}$ - - metavariable-analysis: - analyzer: entropy - metavariable: $VALUE + languages: + - yaml message: 'Secrets ($VALUE) should not be stored in infrastructure as code files. Use an alternative such as Bitnami Sealed Secrets or KSOPS to encrypt Kubernetes Secrets. ' metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-798: Use of Hard-coded Credentials' - category: security - technology: - - kubernetes + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures references: - https://kubernetes.io/docs/concepts/configuration/secret/ - https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR_Kubernetes_Hardening_Guidance_1.1_20220315.PDF @@ -43234,131 +33633,125 @@ rules: - https://github.com/bitnami-labs/sealed-secrets - https://www.cncf.io/blog/2022/01/25/secrets-management-essential-when-using-kubernetes/ - https://blog.oddbit.com/post/2021-03-09-getting-started-with-ksops/ - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file - shortlink: https://sg.run/KyL6 semgrep.dev: rule: + origin: community r_id: 20055 - rv_id: 1263942 rule_id: YGUYEb + rv_id: 1263942 + url: + https://semgrep.dev/playground/r/xyTjz5B/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file version_id: xyTjz5B - url: https://semgrep.dev/playground/r/xyTjz5B/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file - origin: community - languages: - - yaml + shortlink: https://sg.run/KyL6 + source: https://semgrep.dev/r/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file + subcategory: + - vuln + technology: + - kubernetes + vulnerability_class: + - Hard-coded Secrets + patterns: + - pattern: "$KEY: $VALUE\n" + - pattern-inside: "data: ...\n" + - pattern-inside: "kind: Secret\n...\n" + - metavariable-regex: + metavariable: $VALUE + regex: (?i)^[aA-zZ0-9+/]+={0,2}$ + - metavariable-analysis: + analyzer: entropy + metavariable: $VALUE severity: WARNING - id: yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster - pattern: "cluster:\n ...\n insecure-skip-tls-verify: true\n" - message: 'Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections - insecure. Remove the ''insecure-skip-tls-verify: true'' key to secure communication.' + languages: + - yaml + message: "Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections + insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication." metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' - references: - - https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster - category: security - technology: - - kubernetes + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster - shortlink: https://sg.run/okyn + references: + - https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster semgrep.dev: rule: + origin: community r_id: 10116 - rv_id: 1263943 rule_id: zdUyWx + rv_id: 1263943 + url: + https://semgrep.dev/playground/r/O9Tpxbo/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster version_id: O9Tpxbo - url: https://semgrep.dev/playground/r/O9Tpxbo/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster - origin: community - languages: - - yaml + shortlink: https://sg.run/okyn + source: https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster + subcategory: + - vuln + technology: + - kubernetes + vulnerability_class: + - Mishandled Sensitive Information + pattern: "cluster:\n ...\n insecure-skip-tls-verify: true\n" severity: WARNING - id: yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service - pattern: "spec:\n ...\n insecureSkipTLSVerify: true\n" - message: 'Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections - insecure. Remove the ''insecureSkipTLSVerify: true'' key to secure communication.' + languages: + - yaml + message: "Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections + insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication." metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' - references: - - https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io - category: security - technology: - - kubernetes + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service - shortlink: https://sg.run/zk10 + references: + - https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io semgrep.dev: rule: + origin: community r_id: 10117 - rv_id: 1263944 rule_id: pKUGXr + rv_id: 1263944 + url: + https://semgrep.dev/playground/r/e1TyjnR/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service version_id: e1TyjnR - url: https://semgrep.dev/playground/r/e1TyjnR/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service - origin: community - languages: - - yaml + shortlink: https://sg.run/zk10 + source: https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service + subcategory: + - vuln + technology: + - kubernetes + vulnerability_class: + - Mishandled Sensitive Information + pattern: "spec:\n ...\n insecureSkipTLSVerify: true\n" severity: WARNING - id: yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false languages: - yaml - message: 'Found ''x-openai-isConsequential: false'' in a state-changing HTTP method: $METHOD $PATH. This Action configuration - will enable the ''Always Allow'' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk - of a user selecting the ''Always Allow'' button is that the agent could perform unintended actions on behalf of the user. - When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider - the trade-off between security and user friction and then make a risk-based decision about this function.' - severity: WARNING - pattern-either: - - pattern-inside: "post:\n ...\n x-openai-isConsequential: false\n" - - pattern-inside: "put:\n ...\n x-openai-isConsequential: false\n" - - pattern-inside: "patch:\n ...\n x-openai-isConsequential: false\n" - - pattern-inside: "delete:\n ...\n x-openai-isConsequential: false\n" + message: "Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration + will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of + a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When + working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider + the trade-off between security and user friction and then make a risk-based decision about this function." metadata: category: security - subcategory: - - audit - technology: - - openapi - - openai - likelihood: HIGH - impact: HIGH confidence: HIGH - cwe: 'CWE-441: Unintended Proxy or Intermediary (''Confused Deputy'')' + cwe: "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A04:2021 Insecure Design - LLM08:2023 - Excessive Agency @@ -43366,47 +33759,43 @@ rules: - https://platform.openai.com/docs/actions/consequential-flag - https://owasp.org/Top10/A04_2021-Insecure_Design/ - https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false - shortlink: https://sg.run/x8EEP semgrep.dev: rule: + origin: community r_id: 146574 - rv_id: 947071 rule_id: yyURooD + rv_id: 947071 + url: + https://semgrep.dev/playground/r/WrTEZN8/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false version_id: WrTEZN8 - url: https://semgrep.dev/playground/r/WrTEZN8/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false - origin: community + shortlink: https://sg.run/x8EEP + source: + https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false + subcategory: + - audit + technology: + - openapi + - openai + vulnerability_class: + - Server-Side Request Forgery (SSRF) + pattern-either: + - pattern-inside: "post:\n ...\n x-openai-isConsequential: false\n" + - pattern-inside: "put:\n ...\n x-openai-isConsequential: false\n" + - pattern-inside: "patch:\n ...\n x-openai-isConsequential: false\n" + - pattern-inside: "delete:\n ...\n x-openai-isConsequential: false\n" + severity: WARNING - id: yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication languages: - yaml - message: Basic authentication is considered weak and should be avoided. Use a different authentication scheme, such of - OAuth2, OpenID Connect, or mTLS. - severity: ERROR - patterns: - - pattern-inside: "openapi: $VERSION\n...\ncomponents:\n ...\n securitySchemes:\n ...\n $SCHEME:\n ...\n" - - metavariable-regex: - metavariable: $VERSION - regex: 3.* - - pattern: 'type: http - - ... - - scheme: basic - - ' + message: Basic authentication is considered weak and should be avoided. Use a different authentication scheme, such + of OAuth2, OpenID Connect, or mTLS. metadata: category: security - subcategory: - - vuln - technology: - - openapi - likelihood: MEDIUM - impact: HIGH confidence: HIGH cwe: 'CWE-287: Improper Authentication' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A04:2021 Insecure Design - A07:2021 Identification and Authentication Failures @@ -43414,16 +33803,27 @@ rules: - https://cwe.mitre.org/data/definitions/287.html - https://owasp.org/Top10/A04_2021-Insecure_Design/ - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/ - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication - shortlink: https://sg.run/v8wNW semgrep.dev: rule: + origin: community r_id: 133077 - rv_id: 947072 rule_id: zdUKgEX + rv_id: 947072 + url: + https://semgrep.dev/playground/r/0bT1ErG/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication version_id: 0bT1ErG - url: https://semgrep.dev/playground/r/0bT1ErG/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication - origin: community + shortlink: https://sg.run/v8wNW + source: https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication + subcategory: + - vuln + technology: + - openapi + vulnerability_class: + - Improper Authentication + patterns: + - pattern-inside: "openapi: $VERSION\n...\ncomponents:\n ...\n securitySchemes:\n ...\n $SCHEME:\n ...\n" + - metavariable-regex: + metavariable: $VERSION + regex: 3.* + - pattern: "type: http\n...\nscheme: basic\n" + severity: ERROR diff --git a/.semgrep/registry/package-managers.yaml b/.semgrep/registry/package-managers.yaml index 1088b85..a828597 100644 --- a/.semgrep/registry/package-managers.yaml +++ b/.semgrep/registry/package-managers.yaml @@ -5,6 +5,45 @@ # (the semgrep-registry-update workflow does this on a schedule). rules: - id: package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age + languages: + - generic + message: 'This bunfig.toml does not set a minimum release age or sets it too low. Newly published packages can be malicious + or unstable. Add `minimumReleaseAge = 604800` under the `[install]` section to wait 7 days before resolving newly published + package versions. Added in: v1.3 Reference: https://bun.sh/docs/runtime/bunfig' + metadata: + category: security + confidence: HIGH + cwe: + - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A08:2021 - Software and Data Integrity Failures + references: + - https://bun.sh/docs/runtime/bunfig + semgrep.dev: + rule: + origin: community + r_id: 291646 + rule_id: oqUyJOb + rv_id: 1423385 + url: + https://semgrep.dev/playground/r/BjTyRe5/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age + version_id: BjTyRe5 + shortlink: https://sg.run/JqPrR + source: https://semgrep.dev/r/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age + subcategory: + - audit + technology: + - bun + - javascript + vulnerability_class: + - Insecure Configuration + paths: + include: + - '**/bunfig.toml' + - '**/.bunfig.toml' pattern-either: - patterns: - pattern-regex: (?ms)\[install\](?P[^\[]*?)(?=\[|\z) @@ -16,54 +55,54 @@ rules: - pattern-regex: minimumReleaseAge\s*=\s*\d+ - pattern-regex: =\s*(?P\d+) - metavariable-comparison: - metavariable: $AGE comparison: int($AGE) < 604800 + metavariable: $AGE - focus-metavariable: $AGE - patterns: - pattern-regex: (?m)minimumReleaseAge[ \t]*=[ \t]*(?P[^\s\d][^\n]*) - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)minimumReleaseAge\s*=\s*$ - message: 'This bunfig.toml does not set a minimum release age or sets it too low. Newly published packages can be malicious - or unstable. Add `minimumReleaseAge = 604800` under the `[install]` section to wait 7 days before resolving newly published - package versions. Added in: v1.3 Reference: https://bun.sh/docs/runtime/bunfig' - languages: - - generic severity: MEDIUM - paths: - include: - - '**/bunfig.toml' - - '**/.bunfig.toml' +- id: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + languages: + - yaml + message: 'This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. + Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before + proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown' metadata: category: security - technology: - - bun - - javascript + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://bun.sh/docs/runtime/bunfig - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age - shortlink: https://sg.run/JqPrR + - https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown semgrep.dev: rule: - r_id: 291646 - rv_id: 1423385 - rule_id: oqUyJOb - version_id: BjTyRe5 - url: https://semgrep.dev/playground/r/BjTyRe5/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age origin: community -- id: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + r_id: 291647 + rule_id: zdUArOL + rv_id: 1423386 + url: + https://semgrep.dev/playground/r/DkTwEGl/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + version_id: DkTwEGl + shortlink: https://sg.run/5WvGK + source: https://semgrep.dev/r/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown + subcategory: + - audit + technology: + - dependabot + vulnerability_class: + - Insecure Configuration + paths: + include: + - '**/.github/dependabot.yml' + - '**/.github/dependabot.yaml' pattern-either: - patterns: - pattern-inside: "updates:\n ...\n" @@ -73,8 +112,8 @@ rules: - pattern-inside: "updates:\n ...\n" - pattern-regex: default-days\s*:\s*(?P\d+) - metavariable-comparison: - metavariable: $DAYS comparison: int($DAYS) < 7 + metavariable: $DAYS - focus-metavariable: $DAYS - patterns: - pattern-inside: "updates:\n ...\n" @@ -83,45 +122,47 @@ rules: metavariable: $DAYS regex: ^\D - focus-metavariable: $DAYS - message: 'This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. - Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before - proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown' - languages: - - yaml severity: MEDIUM - paths: - include: - - '**/.github/dependabot.yml' - - '**/.github/dependabot.yaml' +- id: package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + languages: + - generic + message: 'This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or + unstable. Add `min-release-age = 7` to wait 7 days before resolving newly published package versions. Added in: v11.10 + Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/' metadata: category: security - technology: - - dependabot + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown - shortlink: https://sg.run/5WvGK + - https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/ + - https://github.com/npm/cli/pull/8965 semgrep.dev: rule: - r_id: 291647 - rv_id: 1423386 - rule_id: zdUArOL - version_id: DkTwEGl - url: https://semgrep.dev/playground/r/DkTwEGl/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown origin: community -- id: package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + r_id: 291648 + rule_id: pKU6A82 + rv_id: 1423387 + url: + https://semgrep.dev/playground/r/WrT7LdL/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + version_id: WrT7LdL + shortlink: https://sg.run/GRo1z + source: https://semgrep.dev/r/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age + subcategory: + - audit + technology: + - npm + - javascript + vulnerability_class: + - Insecure Configuration + paths: + include: + - '**/.npmrc' pattern-either: - patterns: - pattern-regex: (?:(?:^---\n)(?:[^\n]*\n)|^)(?P(?:(?!\n---)[\s\S])*\S(?:(?!\n---)[\s\S])*) @@ -131,186 +172,181 @@ rules: - pattern-regex: min-release-age\s*=\s*\d+ - pattern-regex: =\s*(?P\d+) - metavariable-comparison: - metavariable: $AGE comparison: int($AGE) < 7 + metavariable: $AGE - focus-metavariable: $AGE - patterns: - pattern-regex: (?m)min-release-age[ \t]*=[ \t]*(?P[^\s\d][^\n]*) - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)min-release-age\s*=\s*$ - message: 'This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or - unstable. Add `min-release-age = 7` to wait 7 days before resolving newly published package versions. Added in: v11.10 - Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/' - languages: - - generic severity: MEDIUM - paths: - include: - - '**/.npmrc' +- id: package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age + languages: + - yaml + message: 'This pnpm workspace configuration does not set a minimum release age. Newly published packages can be malicious + or unstable. Add `minimumReleaseAge: 10080` (minutes) to wait at least seven days before installing newly published package + versions. Added in: v10.16.0 Reference: https://pnpm.io/settings#minimumreleaseage' metadata: category: security - technology: - - npm - - javascript + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/ - - https://github.com/npm/cli/pull/8965 - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age - shortlink: https://sg.run/GRo1z + - https://pnpm.io/settings#minimumreleaseage semgrep.dev: rule: - r_id: 291648 - rv_id: 1423387 - rule_id: pKU6A82 - version_id: WrT7LdL - url: https://semgrep.dev/playground/r/WrT7LdL/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age origin: community -- id: package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age - message: 'This pnpm workspace configuration does not set a minimum release age. Newly published packages can be malicious - or unstable. Add `minimumReleaseAge: 10080` (minutes) to wait at least seven days before installing newly published package - versions. Added in: v10.16.0 Reference: https://pnpm.io/settings#minimumreleaseage' - languages: - - yaml - severity: MEDIUM + r_id: 291650 + rule_id: X5Uwn1n + rv_id: 1423389 + url: + https://semgrep.dev/playground/r/K3TgxrW/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age + version_id: K3TgxrW + shortlink: https://sg.run/Aj0o0 + source: https://semgrep.dev/r/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age + subcategory: + - audit + technology: + - pnpm + vulnerability_class: + - Insecure Configuration paths: include: - '**/pnpm-workspace.yaml' pattern-either: - patterns: - - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) + - pattern-regex: + (?ms)(?:\A|^---$\n)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) - focus-metavariable: $TARGET - patterns: - pattern-regex: ^\s*minimumReleaseAge\s*:\s*(?P\d+) - metavariable-comparison: - metavariable: $AGE comparison: int($AGE) < 10080 + metavariable: $AGE - focus-metavariable: $AGE - patterns: - - pattern: 'minimumReleaseAge: $AGE - - ' + - pattern: "minimumReleaseAge: $AGE\n" - metavariable-regex: metavariable: $AGE regex: ^\D - focus-metavariable: $AGE - patterns: - pattern-regex: (?m)^\s*minimumReleaseAge\s*:\s*$ + severity: MEDIUM +- id: package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + languages: + - json + message: 'This Renovate configuration does not set a minimum release age. Newly published packages can be malicious or unstable. + Add `"minimumReleaseAge": "7 days"` within a `packageRules` entry to wait 7 days before proposing updates to newly published + package versions. Set `"minimumReleaseAge": false` to set an exception for minimal release age for the package rule. Added + in: v42' metadata: category: security - technology: - - pnpm + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://pnpm.io/settings#minimumreleaseage - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age - shortlink: https://sg.run/Aj0o0 + - https://docs.renovatebot.com/configuration-options/#minimumreleaseage semgrep.dev: rule: - r_id: 291650 - rv_id: 1423389 - rule_id: X5Uwn1n - version_id: K3TgxrW - url: https://semgrep.dev/playground/r/K3TgxrW/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age origin: community -- id: package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + r_id: 291652 + rule_id: 10UbQrX + rv_id: 1443454 + url: + https://semgrep.dev/playground/r/jQT1KAX/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + version_id: jQT1KAX + shortlink: https://sg.run/D8l2q + source: + https://semgrep.dev/r/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age + subcategory: + - audit + technology: + - renovate + vulnerability_class: + - Insecure Configuration + paths: + include: + - '**/renovate.json' + - '**/renovate.json5' + - '**/.renovaterc' + - '**/.renovaterc.json' + - '**/.renovaterc.json5' pattern-either: - patterns: - pattern-inside: "\"packageRules\": [\n ...\n]\n" - pattern-either: - - pattern: '{ ..., "matchPackageNames": [...], ... } - - ' - - pattern: '{ ..., "matchPackagePatterns": [...], ... } - - ' - - pattern: '{ ..., "matchDepTypes": [...], ... } - - ' + - pattern: "{ ..., \"matchPackageNames\": [...], ... }\n" + - pattern: "{ ..., \"matchPackagePatterns\": [...], ... }\n" + - pattern: "{ ..., \"matchDepTypes\": [...], ... }\n" - pattern-not: "{\n ...,\n \"minimumReleaseAge\": $AGE,\n ...\n}\n" - pattern-not: "{\n ...,\n \"minimumReleaseAge\": false,\n ...\n}\n" - patterns: - pattern-inside: "\"packageRules\": [\n ...\n]\n" - pattern-regex: '"minimumReleaseAge":\s*"(?P\d+) days?"' - metavariable-comparison: - metavariable: $AGE comparison: int($AGE) < 7 + metavariable: $AGE - focus-metavariable: $AGE - patterns: - pattern-inside: "\"packageRules\": [\n ...\n]\n" - - pattern: '"minimumReleaseAge": "$AGE" - - ' + - pattern: "\"minimumReleaseAge\": \"$AGE\"\n" - metavariable-regex: metavariable: $AGE regex: ^(?!\d+ days?$) - focus-metavariable: $AGE - message: 'This Renovate configuration does not set a minimum release age. Newly published packages can be malicious or unstable. - Add `"minimumReleaseAge": "7 days"` within a `packageRules` entry to wait 7 days before proposing updates to newly published - package versions. Set `"minimumReleaseAge": false` to set an exception for minimal release age for the package rule. Added - in: v42' - languages: - - json severity: MEDIUM - paths: - include: - - '**/renovate.json' - - '**/renovate.json5' - - '**/.renovaterc' - - '**/.renovaterc.json' - - '**/.renovaterc.json5' +- id: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + languages: + - generic + message: 'This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious + or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package + versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns' metadata: category: security - technology: - - renovate + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://docs.renovatebot.com/configuration-options/#minimumreleaseage - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age - shortlink: https://sg.run/D8l2q + - https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns semgrep.dev: rule: - r_id: 291652 - rv_id: 1443454 - rule_id: 10UbQrX - version_id: jQT1KAX - url: https://semgrep.dev/playground/r/jQT1KAX/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age origin: community -- id: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + r_id: 291653 + rule_id: 9AUo6vE + rv_id: 1501839 + url: + https://semgrep.dev/playground/r/kbT3B1J/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + version_id: kbT3B1J + shortlink: https://sg.run/WeY0Z + source: https://semgrep.dev/r/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown + subcategory: + - audit + technology: + - uv + - python + vulnerability_class: + - Insecure Configuration + paths: + include: + - '**/pyproject.toml' + - '**/uv.toml' pattern-either: - patterns: - pattern-regex: (?ms)\[tool\.uv\](?P[^\[]*?)(?=\[|\z) @@ -321,64 +357,66 @@ rules: - patterns: - pattern-regex: exclude-newer\s*=\s*"(?P\d+)\s*d(?:ays?)?" - metavariable-comparison: - metavariable: $DAYS comparison: int($DAYS) < 7 + metavariable: $DAYS - focus-metavariable: $DAYS - patterns: - pattern-regex: exclude-newer\s*=\s*"(?P[^"]+)" - metavariable-regex: metavariable: $VAL - regex: (?i)^(?!\d+\s*d(?:ays?)?\b)(?!\d+\s*(?:weeks?|wks?|w|months?|mos?|mo|years?|yrs?|y)\b)(?!P[^Tt]*[WMY])(?!P(?:[7-9]|[1-9]\d+)D\b) + regex: + (?i)^(?!\d+\s*d(?:ays?)?\b)(?!\d+\s*(?:weeks?|wks?|w|months?|mos?|mo|years?|yrs?|y)\b)(?!P[^Tt]*[WMY])(?!P(?:[7-9]|[1-9]\d+)D\b) - focus-metavariable: $VAL - message: 'This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious - or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package - versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns' - languages: - - generic severity: MEDIUM - paths: - include: - - '**/pyproject.toml' - - '**/uv.toml' +- id: package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + languages: + - yaml + message: 'This .yarnrc.yml does not set a minimal age gate or sets it too low. Newly published packages can be malicious + or unstable. Add `npmMinimalAgeGate: "7d"` to wait 7 days before resolving newly published package versions. Added in: + 4.10 Reference: https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate' metadata: category: security - technology: - - uv - - python + confidence: HIGH cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration references: - - https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown - shortlink: https://sg.run/WeY0Z + - https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate semgrep.dev: rule: - r_id: 291653 - rv_id: 1501839 - rule_id: 9AUo6vE - version_id: kbT3B1J - url: https://semgrep.dev/playground/r/kbT3B1J/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown origin: community -- id: package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + r_id: 291654 + rule_id: yyUBeEz + rv_id: 1423393 + url: + https://semgrep.dev/playground/r/JdTnXlj/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + version_id: JdTnXlj + shortlink: https://sg.run/0gvNq + source: https://semgrep.dev/r/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate + subcategory: + - audit + technology: + - yarn + - javascript + vulnerability_class: + - Insecure Configuration + paths: + include: + - '**/.yarnrc.yml' pattern-either: - patterns: - - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?P^(?:nodeLinker|yarnPath|enableGlobalCache|npmScopes|npmRegistryServer)\s*:)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) + - pattern-regex: + (?ms)(?:\A|^---$\n)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?P^(?:nodeLinker|yarnPath|enableGlobalCache|npmScopes|npmRegistryServer)\s*:)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) - focus-metavariable: $TARGET - patterns: - pattern-regex: (?m)npmMinimalAgeGate\s*:\s*['"]?(?P\d+)d['"]? - metavariable-comparison: - metavariable: $DAYS comparison: int($DAYS) < 7 + metavariable: $DAYS - focus-metavariable: $DAYS - patterns: - pattern-regex: (?m)npmMinimalAgeGate[ \t]*:[ \t]*(?P\S+) @@ -388,41 +426,4 @@ rules: - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)^npmMinimalAgeGate\s*:\s*$ - message: 'This .yarnrc.yml does not set a minimal age gate or sets it too low. Newly published packages can be malicious - or unstable. Add `npmMinimalAgeGate: "7d"` to wait 7 days before resolving newly published package versions. Added in: - 4.10 Reference: https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate' - languages: - - yaml severity: MEDIUM - paths: - include: - - '**/.yarnrc.yml' - metadata: - category: security - technology: - - yarn - - javascript - cwe: - - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' - owasp: - - A08:2021 - Software and Data Integrity Failures - confidence: HIGH - likelihood: LOW - impact: HIGH - subcategory: - - audit - vulnerability_class: - - Insecure Configuration - references: - - https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate - shortlink: https://sg.run/0gvNq - semgrep.dev: - rule: - r_id: 291654 - rv_id: 1423393 - rule_id: yyUBeEz - version_id: JdTnXlj - url: https://semgrep.dev/playground/r/JdTnXlj/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate - origin: community diff --git a/.semgrep/registry/python.yaml b/.semgrep/registry/python.yaml index ea9a7e9..453e5ef 100644 --- a/.semgrep/registry/python.yaml +++ b/.semgrep/registry/python.yaml @@ -5,11 +5,52 @@ # (the semgrep-registry-update workflow does this on a schedule). rules: - id: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + languages: + - python + message: Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be + controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it + is not controllable by an external resource. You may consider using 'shlex.escape()'. + metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec + - https://docs.python.org/3/library/shlex.html + semgrep.dev: + rule: + origin: community + r_id: 18260 + rule_id: EwUrX8 + rv_id: 1263331 + url: + https://semgrep.dev/playground/r/rxTAKgo/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + version_id: rxTAKgo + shortlink: https://sg.run/oyv0 + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" pattern-sinks: - patterns: - focus-metavariable: $CMD @@ -21,57 +62,61 @@ rules: - pattern: asyncio.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) - pattern: asyncio.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) - pattern: asyncio.subprocess.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) - - pattern: asyncio.subprocess.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) - message: Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled - by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable - by an external resource. You may consider using 'shlex.escape()'. + - pattern: asyncio.subprocess.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], + ...) + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR +- id: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + languages: + - python + message: Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data + can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to + ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' - references: - - https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec - - https://docs.python.org/3/library/shlex.html category: security - technology: - - python - cwe2022-top25: true + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec - shortlink: https://sg.run/oyv0 + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec + - https://docs.python.org/3/library/shlex.html semgrep.dev: rule: - r_id: 18260 - rv_id: 1263331 - rule_id: EwUrX8 - version_id: rxTAKgo - url: https://semgrep.dev/playground/r/rxTAKgo/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec origin: community - languages: - - python - severity: ERROR -- id: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + r_id: 18261 + rule_id: 7KUxXg + rv_id: 1263332 + url: + https://semgrep.dev/playground/r/bZT53Ww/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + version_id: bZT53Ww + shortlink: https://sg.run/z14d + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec + subcategory: + - vuln + technology: + - python + - aws-lambda + vulnerability_class: + - Command Injection mode: taint - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" pattern-sinks: - patterns: - focus-metavariable: $CMD @@ -80,57 +125,59 @@ rules: - pattern: $LOOP.subprocess_exec($PROTOCOL, [$CMD, ...], ...) - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) - message: Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can - be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it - is not controllable by an external resource. You may consider using 'shlex.escape()'. + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR +- id: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell + languages: + - python + message: Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled + by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not + controllable by an external resource. You may consider using 'shlex.escape()'. metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' references: - - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec + - https://docs.python.org/3/library/asyncio-subprocess.html - https://docs.python.org/3/library/shlex.html - category: security + semgrep.dev: + rule: + origin: community + r_id: 18262 + rule_id: L1UEl7 + rv_id: 1263333 + url: + https://semgrep.dev/playground/r/NdTzyWA/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell + version_id: NdTzyWA + shortlink: https://sg.run/p9vZ + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell + subcategory: + - vuln technology: - python - aws-lambda - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection - source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec - shortlink: https://sg.run/z14d - semgrep.dev: - rule: - r_id: 18261 - rv_id: 1263332 - rule_id: 7KUxXg - version_id: bZT53Ww - url: https://semgrep.dev/playground/r/bZT53Ww/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec - origin: community - languages: - - python - severity: ERROR -- id: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell mode: taint - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" pattern-sinks: - patterns: - focus-metavariable: $CMD @@ -138,101 +185,58 @@ rules: - pattern: $LOOP.subprocess_shell($PROTOCOL, $CMD) - pattern: asyncio.subprocess.create_subprocess_shell($CMD, ...) - pattern: asyncio.create_subprocess_shell($CMD, ...) - message: Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by - a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable - by an external resource. You may consider using 'shlex.escape()'. + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR +- id: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process + languages: + - python + message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach + this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' - references: - - https://docs.python.org/3/library/asyncio-subprocess.html - - https://docs.python.org/3/library/shlex.html category: security - technology: - - python - - aws-lambda - cwe2022-top25: true + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell - shortlink: https://sg.run/p9vZ - semgrep.dev: - rule: - r_id: 18262 - rv_id: 1263333 - rule_id: L1UEl7 - version_id: NdTzyWA - url: https://semgrep.dev/playground/r/NdTzyWA/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell - origin: community - languages: - - python - severity: ERROR -- id: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process - mode: taint - message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this - function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. - metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' - category: security - technology: - - python - - aws-lambda references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process - shortlink: https://sg.run/2AjL semgrep.dev: rule: + origin: community r_id: 18263 - rv_id: 1263334 rule_id: 8GUGBq + rv_id: 1263334 + url: + https://semgrep.dev/playground/r/kbTzGv8/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process version_id: kbTzGv8 - url: https://semgrep.dev/playground/r/kbTzGv8/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process - origin: community - languages: - - python - severity: ERROR - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" + shortlink: https://sg.run/2AjL + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + subcategory: + - vuln + technology: + - python + - aws-lambda + vulnerability_class: + - Command Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $CMD @@ -241,7 +245,8 @@ rules: - pattern: os.$METHOD($MODE, $CMD, ...) - metavariable-regex: metavariable: $METHOD - regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) + regex: + (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) - patterns: - pattern-inside: os.$METHOD($MODE, $BASH, ["-c", $CMD,...],...) - metavariable-regex: @@ -258,116 +263,120 @@ rules: - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR - id: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use - mode: taint - message: Detected subprocess function with argument tainted by an `event` object. If this data can be controlled by a malicious - actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. - Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the - command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for - this purpose. - metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + languages: + - python + message: Detected subprocess function with argument tainted by an `event` object. If this data can be controlled by a + malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is + secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means + you have to split the command string into an array of strings for the command and its arguments. You may consider + using 'shlex.split()' for this purpose. + metadata: asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' - references: - - https://docs.python.org/3/library/subprocess.html - - https://docs.python.org/3/library/shlex.html category: security - technology: - - python - - aws-lambda - cwe2022-top25: true + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use - shortlink: https://sg.run/XZ7B + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.python.org/3/library/subprocess.html + - https://docs.python.org/3/library/shlex.html semgrep.dev: rule: + origin: community r_id: 18264 - rv_id: 1263335 rule_id: gxUyn1 + rv_id: 1263335 + url: + https://semgrep.dev/playground/r/w8TRogj/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use version_id: w8TRogj - url: https://semgrep.dev/playground/r/w8TRogj/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use - origin: community - languages: - - python - severity: ERROR - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" - pattern-sinks: - - patterns: - - pattern: subprocess.$FUNC(..., shell=True, ...) + shortlink: https://sg.run/XZ7B + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use + subcategory: + - vuln + technology: + - python + - aws-lambda + vulnerability_class: + - Command Injection + mode: taint pattern-sanitizers: - pattern: shlex.split(...) - pattern: pipes.quote(...) - pattern: shlex.quote(...) + pattern-sinks: + - patterns: + - pattern: subprocess.$FUNC(..., shell=True, ...) + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR - id: python.aws-lambda.security.dangerous-system-call.dangerous-system-call - mode: taint - message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this - function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier - to use without accidentally exposing a command injection vulnerability. + languages: + - python + message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach + this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, + which is easier to use without accidentally exposing a command injection vulnerability. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.2.4 Dyanmic Code Execution Features - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' category: security - technology: - - python - references: - - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call - shortlink: https://sg.run/jDvN + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection semgrep.dev: rule: + origin: community r_id: 18265 - rv_id: 1263336 rule_id: QrUkg6 + rv_id: 1263336 + url: + https://semgrep.dev/playground/r/xyTjzbG/python.aws-lambda.security.dangerous-system-call.dangerous-system-call version_id: xyTjzbG - url: https://semgrep.dev/playground/r/xyTjzbG/python.aws-lambda.security.dangerous-system-call.dangerous-system-call - origin: community - languages: - - python - severity: ERROR - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" + shortlink: https://sg.run/jDvN + source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $CMD @@ -377,51 +386,53 @@ rules: - pattern: os.popen2($CMD,...) - pattern: os.popen3($CMD,...) - pattern: os.popen4($CMD,...) + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" + severity: ERROR - id: python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection - mode: taint + languages: + - python + message: Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the + variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from + `$EVENT` directly to DynamoDB client. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-943: Improper Neutralization of Special Elements in Data Query Logic' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - category: security - technology: - - python - - boto3 - - aws-lambda - - dynamodb references: - https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection - shortlink: https://sg.run/jjrl semgrep.dev: rule: + origin: community r_id: 21321 - rv_id: 946088 rule_id: KxUJ2B + rv_id: 946088 + url: + https://semgrep.dev/playground/r/9lTy1rQ/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection version_id: 9lTy1rQ - url: https://semgrep.dev/playground/r/9lTy1rQ/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection - origin: community - message: Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable - is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly - to DynamoDB client. - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" + shortlink: https://sg.run/jjrl + source: https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection + subcategory: + - vuln + technology: + - python + - boto3 + - aws-lambda + - dynamodb + vulnerability_class: + - Improper Validation + mode: taint pattern-sanitizers: - patterns: - - pattern: '{...} - - ' + - pattern: "{...}\n" pattern-sinks: - patterns: - focus-metavariable: $SINK @@ -430,65 +441,55 @@ rules: - pattern: $TABLE.query(..., QueryFilter = $SINK, ...) - pattern-either: - patterns: - - pattern-inside: '$TABLE = $DB.Table(...) - - ... - - ' - - pattern-inside: '$DB = boto3.resource(''dynamodb'', ...) - - ... - - ' - - pattern-inside: '$TABLE = boto3.client(''dynamodb'', ...) - - ... - - ' + - pattern-inside: "$TABLE = $DB.Table(...)\n...\n" + - pattern-inside: "$DB = boto3.resource('dynamodb', ...)\n...\n" + - pattern-inside: "$TABLE = boto3.client('dynamodb', ...)\n...\n" + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" severity: ERROR - languages: - - python - id: python.aws-lambda.security.mysql-sqli.mysql-sqli languages: - python - message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + message: "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', (''active''))`' - mode: taint + instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`" metadata: - references: - - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html - - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - mysql - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli - shortlink: https://sg.run/1RjG + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html + - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html semgrep.dev: rule: + origin: community r_id: 18266 - rv_id: 1263337 rule_id: 3qU3eE - version_id: O9TpxLJ + rv_id: 1263337 url: https://semgrep.dev/playground/r/O9TpxLJ/python.aws-lambda.security.mysql-sqli.mysql-sqli - origin: community + version_id: O9TpxLJ + shortlink: https://sg.run/1RjG + source: https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli + subcategory: + - vuln + technology: + - aws-lambda + - mysql + vulnerability_class: + - SQL Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $QUERY @@ -496,16 +497,8 @@ rules: - pattern: $CURSOR.execute($QUERY,...) - pattern: $CURSOR.executemany($QUERY,...) - pattern-either: - - pattern-inside: 'import mysql - - ... - - ' - - pattern-inside: 'import mysql.cursors - - ... - - ' + - pattern-inside: "import mysql\n...\n" + - pattern-inside: "import mysql.cursors\n...\n" pattern-sources: - patterns: - pattern: event @@ -514,46 +507,46 @@ rules: - id: python.aws-lambda.security.psycopg-sqli.psycopg-sqli languages: - python - message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + message: "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', ''active'')`' - mode: taint + instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`" metadata: - references: - - https://www.psycopg.org/docs/cursor.html#cursor.execute - - https://www.psycopg.org/docs/cursor.html#cursor.executemany - - https://www.psycopg.org/docs/cursor.html#cursor.mogrify category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - psycopg - - psycopg2 - cwe2022-top25: true - cwe2021-top25: true + references: + - https://www.psycopg.org/docs/cursor.html#cursor.execute + - https://www.psycopg.org/docs/cursor.html#cursor.executemany + - https://www.psycopg.org/docs/cursor.html#cursor.mogrify + semgrep.dev: + rule: + origin: community + r_id: 18267 + rule_id: 4bUQG1 + rv_id: 1263338 + url: https://semgrep.dev/playground/r/e1TyjPZ/python.aws-lambda.security.psycopg-sqli.psycopg-sqli + version_id: e1TyjPZ + shortlink: https://sg.run/9L8r + source: https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli subcategory: - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - aws-lambda + - psycopg + - psycopg2 vulnerability_class: - SQL Injection - source: https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli - shortlink: https://sg.run/9L8r - semgrep.dev: - rule: - r_id: 18267 - rv_id: 1263338 - rule_id: 4bUQG1 - version_id: e1TyjPZ - url: https://semgrep.dev/playground/r/e1TyjPZ/python.aws-lambda.security.psycopg-sqli.psycopg-sqli - origin: community + mode: taint pattern-sinks: - patterns: - focus-metavariable: $QUERY @@ -561,11 +554,7 @@ rules: - pattern: $CURSOR.execute($QUERY,...) - pattern: $CURSOR.executemany($QUERY,...) - pattern: $CURSOR.mogrify($QUERY,...) - - pattern-inside: 'import psycopg2 - - ... - - ' + - pattern-inside: "import psycopg2\n...\n" pattern-sources: - patterns: - pattern: event @@ -574,52 +563,48 @@ rules: - id: python.aws-lambda.security.pymssql-sqli.pymssql-sqli languages: - python - message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + message: "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', ''active'')`' - mode: taint + instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`" metadata: - references: - - https://pypi.org/project/pymssql/ category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - pymssql - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli - shortlink: https://sg.run/yXvP + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://pypi.org/project/pymssql/ semgrep.dev: rule: + origin: community r_id: 18268 - rv_id: 1263339 rule_id: PeUxO0 - version_id: vdT06bG + rv_id: 1263339 url: https://semgrep.dev/playground/r/vdT06bG/python.aws-lambda.security.pymssql-sqli.pymssql-sqli - origin: community + version_id: vdT06bG + shortlink: https://sg.run/yXvP + source: https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli + subcategory: + - vuln + technology: + - aws-lambda + - pymssql + vulnerability_class: + - SQL Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern: $CURSOR.execute($QUERY,...) - - pattern-inside: 'import pymssql - - ... - - ' + - pattern-inside: "import pymssql\n...\n" pattern-sources: - patterns: - pattern: event @@ -628,58 +613,50 @@ rules: - id: python.aws-lambda.security.pymysql-sqli.pymysql-sqli languages: - python - message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + message: "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', (''active''))`' - mode: taint + instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`" metadata: - references: - - https://pypi.org/project/PyMySQL/#id4 category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - pymysql - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli - shortlink: https://sg.run/reve + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://pypi.org/project/PyMySQL/#id4 semgrep.dev: rule: + origin: community r_id: 18269 - rv_id: 1263340 rule_id: JDUlel - version_id: d6TyxNA + rv_id: 1263340 url: https://semgrep.dev/playground/r/d6TyxNA/python.aws-lambda.security.pymysql-sqli.pymysql-sqli - origin: community + version_id: d6TyxNA + shortlink: https://sg.run/reve + source: https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli + subcategory: + - vuln + technology: + - aws-lambda + - pymysql + vulnerability_class: + - SQL Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern: $CURSOR.execute($QUERY,...) - pattern-either: - - pattern-inside: 'import pymysql - - ... - - ' - - pattern-inside: 'import pymysql.cursors - - ... - - ' + - pattern-inside: "import pymysql\n...\n" + - pattern-inside: "import pymysql.cursors\n...\n" pattern-sources: - patterns: - pattern: event @@ -688,203 +665,194 @@ rules: - id: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli languages: - python - message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is + message: "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements - instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = ?'', ''active'')`' - mode: taint + instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`" metadata: - references: - - https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - - sqlalchemy - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli - shortlink: https://sg.run/b48W + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute semgrep.dev: rule: + origin: community r_id: 18270 - rv_id: 1263341 rule_id: 5rUy3N - version_id: ZRTKARp + rv_id: 1263341 url: https://semgrep.dev/playground/r/ZRTKARp/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli - origin: community + version_id: ZRTKARp + shortlink: https://sg.run/b48W + source: https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli + subcategory: + - vuln + technology: + - aws-lambda + - sqlalchemy + vulnerability_class: + - SQL Injection + mode: taint pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern: $CURSOR.execute($QUERY,...) - - pattern-inside: 'import sqlalchemy - - ... - - ' + - pattern-inside: "import sqlalchemy\n...\n" pattern-sources: - patterns: - pattern: event - pattern-inside: "def $HANDLER(event, context):\n ...\n" severity: WARNING - id: python.aws-lambda.security.tainted-code-exec.tainted-code-exec - mode: taint - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" - pattern-sinks: - - patterns: - - pattern-either: - - pattern: eval($CODE, ...) - - pattern: exec($CODE, ...) - message: Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can - be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable - by external sources. + languages: + - python + message: Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content + can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not + definable by external sources. metadata: - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' - owasp: - - A03:2021 - Injection - - A05:2025 - Injection asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.2.4 Dyanmic Code Execution Features - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' category: security - technology: - - python - references: - - https://owasp.org/Top10/A03_2021-Injection - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM confidence: MEDIUM + cwe: + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec - shortlink: https://sg.run/Ng7y + likelihood: MEDIUM + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/Top10/A03_2021-Injection semgrep.dev: rule: + origin: community r_id: 18271 - rv_id: 1263342 rule_id: GdUDJP - version_id: nWT2LD2 + rv_id: 1263342 url: https://semgrep.dev/playground/r/nWT2LD2/python.aws-lambda.security.tainted-code-exec.tainted-code-exec - origin: community - languages: - - python - severity: WARNING -- id: python.aws-lambda.security.tainted-html-response.tainted-html-response + version_id: nWT2LD2 + shortlink: https://sg.run/Ng7y + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: eval($CODE, ...) + - pattern: exec($CODE, ...) pattern-sources: - patterns: - pattern: event - pattern-inside: "def $HANDLER(event, context):\n ...\n" - pattern-sinks: - - patterns: - - pattern: $BODY - - pattern-inside: '{..., "headers": {..., "Content-Type": "text/html", ...}, "body": $BODY, ... } - - ' - message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering - HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers - steal sensitive user data. + severity: WARNING +- id: python.aws-lambda.security.tainted-html-response.tainted-html-response + languages: + - python + message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of + rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could + let attackers steal sensitive user data. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - aws-lambda references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response - shortlink: https://sg.run/k9vP semgrep.dev: rule: + origin: community r_id: 18272 - rv_id: 1263343 rule_id: ReUKrk + rv_id: 1263343 + url: + https://semgrep.dev/playground/r/ExTEx5o/python.aws-lambda.security.tainted-html-response.tainted-html-response version_id: ExTEx5o - url: https://semgrep.dev/playground/r/ExTEx5o/python.aws-lambda.security.tainted-html-response.tainted-html-response - origin: community - languages: - - python + shortlink: https://sg.run/k9vP + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - Cross-Site-Scripting (XSS) + mode: taint + pattern-sinks: + - patterns: + - pattern: $BODY + - pattern-inside: "{..., \"headers\": {..., \"Content-Type\": \"text/html\", ...}, \"body\": $BODY, ... }\n" + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" severity: WARNING - id: python.aws-lambda.security.tainted-html-string.tainted-html-string languages: - python - severity: WARNING - message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods - of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could - let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use - templates which will safely render HTML instead. + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure + methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, + which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered + safely. Otherwise, use templates which will safely render HTML instead. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - aws-lambda references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string - shortlink: https://sg.run/8zNy semgrep.dev: rule: + origin: community r_id: 18484 - rv_id: 1263344 rule_id: JDUlwy - version_id: 7ZTE36K + rv_id: 1263344 url: https://semgrep.dev/playground/r/7ZTE36K/python.aws-lambda.security.tainted-html-string.tainted-html-string - origin: community + version_id: 7ZTE36K + shortlink: https://sg.run/8zNy + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - patterns: - - pattern: event - - pattern-inside: "def $HANDLER(event, context):\n ...\n" pattern-sinks: - patterns: - pattern-either: @@ -895,193 +863,180 @@ rules: - pattern: '"$HTMLSTR" + ...' - pattern: f"$HTMLSTR{...}..." - patterns: - - pattern-inside: '$HTML = "$HTMLSTR" - - ... - - ' + - pattern-inside: "$HTML = \"$HTMLSTR\"\n...\n" - pattern-either: - pattern: $HTML % ... - pattern: $HTML.format(...) - pattern: $HTML + ... - metavariable-pattern: - metavariable: $HTMLSTR language: generic + metavariable: $HTMLSTR pattern: <$TAG ... - - pattern-not-inside: 'print(...) - - ' -- id: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization - mode: taint + - pattern-not-inside: "print(...)\n" pattern-sources: - patterns: - pattern: event - pattern-inside: "def $HANDLER(event, context):\n ...\n" - pattern-sinks: - - patterns: - - focus-metavariable: $SINK - - pattern-either: - - pattern: pickle.load($SINK,...) - - pattern: pickle.loads($SINK,...) - - pattern: _pickle.load($SINK,...) - - pattern: _pickle.loads($SINK,...) - - pattern: cPickle.load($SINK,...) - - pattern: cPickle.loads($SINK,...) - - pattern: dill.load($SINK,...) - - pattern: dill.loads($SINK,...) - - pattern: shelve.open($SINK,...) - message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized - data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar - text-based serialization format. + severity: WARNING +- id: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization + languages: + - python + message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the + serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON + or a similar text-based serialization format. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - cwe: - - 'CWE-502: Deserialization of Untrusted Data' references: - https://docs.python.org/3/library/pickle.html - https://davidhamann.de/2020/04/05/exploiting-python-pickle/ - category: security - technology: - - python - - aws-lambda - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization - shortlink: https://sg.run/JbjW semgrep.dev: rule: + origin: community r_id: 21602 - rv_id: 1263345 rule_id: JDUDQg + rv_id: 1263345 + url: + https://semgrep.dev/playground/r/LjTkgd9/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization version_id: LjTkgd9 - url: https://semgrep.dev/playground/r/LjTkgd9/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization - origin: community - languages: - - python + shortlink: https://sg.run/JbjW + source: + https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization + subcategory: + - vuln + technology: + - python + - aws-lambda + vulnerability_class: + - 'Insecure Deserialization ' + mode: taint + pattern-sinks: + - patterns: + - focus-metavariable: $SINK + - pattern-either: + - pattern: pickle.load($SINK,...) + - pattern: pickle.loads($SINK,...) + - pattern: _pickle.load($SINK,...) + - pattern: _pickle.loads($SINK,...) + - pattern: cPickle.load($SINK,...) + - pattern: cPickle.loads($SINK,...) + - pattern: dill.load($SINK,...) + - pattern: dill.loads($SINK,...) + - pattern: shelve.open($SINK,...) + pattern-sources: + - patterns: + - pattern: event + - pattern-inside: "def $HANDLER(event, context):\n ...\n" severity: WARNING - id: python.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - python - message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction - could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the - database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider - using an object-relational mapper (ORM) such as Sequelize which will protect your queries. + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual + construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify + contents of the database. Instead, use a parameterized query which is available by default in most database engines. + Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. metadata: - references: - - https://owasp.org/www-community/attacks/SQL_Injection category: security - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - technology: - - aws-lambda - cwe2022-top25: true + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/wXvA + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://owasp.org/www-community/attacks/SQL_Injection semgrep.dev: rule: + origin: community r_id: 18273 - rv_id: 1263346 rule_id: AbU3LX - version_id: 8KT5ron + rv_id: 1263346 url: https://semgrep.dev/playground/r/8KT5ron/python.aws-lambda.security.tainted-sql-string.tainted-sql-string - origin: community + version_id: 8KT5ron + shortlink: https://sg.run/wXvA + source: https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - aws-lambda + vulnerability_class: + - SQL Injection mode: taint pattern-sinks: - patterns: - pattern-either: - - pattern: '"$SQLSTR" + ... - - ' - - pattern: '"$SQLSTR" % ... - - ' - - pattern: '"$SQLSTR".format(...) - - ' - - pattern: 'f"$SQLSTR{...}..." - - ' + - pattern: "\"$SQLSTR\" + ...\n" + - pattern: "\"$SQLSTR\" % ...\n" + - pattern: "\"$SQLSTR\".format(...)\n" + - pattern: "f\"$SQLSTR{...}...\"\n" - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*= - - pattern-not-inside: 'print(...) - - ' + - pattern-not-inside: "print(...)\n" pattern-sources: - patterns: - pattern: event - pattern-inside: "def $HANDLER(event, context):\n ...\n" severity: ERROR - id: python.boto3.security.hardcoded-token.hardcoded-token - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + languages: + - python + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-798: Use of Hard-coded Credentials' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - https://bento.dev/checks/boto3/hardcoded-access-token/ - https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/ - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures - category: security - technology: - - boto3 - - secrets - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token - shortlink: https://sg.run/LwQ6 semgrep.dev: rule: + origin: community r_id: 9439 - rv_id: 1263347 rule_id: 5rUOwK - version_id: gETB78n + rv_id: 1263347 url: https://semgrep.dev/playground/r/gETB78n/python.boto3.security.hardcoded-token.hardcoded-token - origin: community - languages: - - python - severity: WARNING + version_id: gETB78n + shortlink: https://sg.run/LwQ6 + source: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token + subcategory: + - vuln + technology: + - boto3 + - secrets + vulnerability_class: + - Hard-coded Secrets mode: taint - pattern-sources: - - pattern: '"..." - - ' pattern-sinks: - patterns: - pattern-either: @@ -1098,92 +1053,100 @@ rules: - pattern-regex: ^AKI - pattern-regex: ^[A-Za-z0-9/+=]+$ - metavariable-analysis: - metavariable: $VALUE analyzer: entropy + metavariable: $VALUE + pattern-sources: + - pattern: "\"...\"\n" + severity: WARNING - id: python.cryptography.security.empty-aes-key.empty-aes-key - message: Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may - allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption. - patterns: - - pattern: AES.new("",...) languages: - python - severity: WARNING + message: Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and + may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES + encryption. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - 'CWE-310: Cryptographic Issues' - references: - - https://cwe.mitre.org/data/definitions/327.html - - https://cwe.mitre.org/data/definitions/310.html - category: security - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - owasp: A6:2017 misconfiguration functional-categories: - crypto::search::key-length::pycrypto - crypto::search::key-length::pycryptodome - technology: - - python - - pycrypto - - pycryptodome + impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key - shortlink: https://sg.run/zQ9G + likelihood: MEDIUM + owasp: A6:2017 misconfiguration + references: + - https://cwe.mitre.org/data/definitions/327.html + - https://cwe.mitre.org/data/definitions/310.html semgrep.dev: rule: + origin: community r_id: 44817 - rv_id: 946105 rule_id: OrUADK - version_id: 8KTKjRg + rv_id: 946105 url: https://semgrep.dev/playground/r/8KTKjRg/python.cryptography.security.empty-aes-key.empty-aes-key - origin: community -- id: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 - message: ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output. Its use is strongly - discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` - package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, - keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. + version_id: 8KTKjRg + shortlink: https://sg.run/zQ9G + source: https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key + subcategory: + - vuln + technology: + - python + - pycrypto + - pycryptodome + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: AES.new("",...) + severity: WARNING +- fix: AES + id: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 + languages: + - python + message: ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output. Its use is + strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With + the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode + with a 128-bit key. Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES + algorithm instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + bandit-code: B304 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers - category: security - technology: - - cryptography - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::symmetric-algorithm::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 - shortlink: https://sg.run/xoZL semgrep.dev: rule: + origin: community r_id: 33630 - rv_id: 1263348 rule_id: KxU8gK + rv_id: 1263348 + url: + https://semgrep.dev/playground/r/QkTGq3Q/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 version_id: QkTGq3Q - url: https://semgrep.dev/playground/r/QkTGq3Q/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/xoZL + source: + https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$ARC4($KEY) - pattern-inside: cryptography.hazmat.primitives.ciphers.Cipher(...) @@ -1191,467 +1154,465 @@ rules: metavariable: $ARC4 regex: ^(ARC4)$ - focus-metavariable: $ARC4 - fix: AES -- id: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish - message: Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak - keys. The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` - package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, - keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. + severity: WARNING +- fix: AES + id: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish + languages: + - python + message: Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using + weak keys. The author has recommended that users of Blowfish move to newer algorithms such as AES. With the + `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a + 128-bit key. Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm + instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + bandit-code: B304 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers - https://tools.ietf.org/html/rfc5469 - category: security - technology: - - cryptography - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::symmetric-algorithm::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish - shortlink: https://sg.run/OdzL semgrep.dev: rule: + origin: community r_id: 33631 - rv_id: 1263349 rule_id: qNULvO + rv_id: 1263349 + url: + https://semgrep.dev/playground/r/3ZT4XK7/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish version_id: 3ZT4XK7 - url: https://semgrep.dev/playground/r/3ZT4XK7/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/OdzL + source: + https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$BLOWFISH($KEY) - metavariable-regex: metavariable: $BLOWFISH regex: ^(Blowfish)$ - focus-metavariable: $BLOWFISH - fix: AES -- id: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea - message: IDEA (International Data Encryption Algorithm) is a block cipher created in 1991. It is an optional component - of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys. It is recommended that you do not - use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package - it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, - keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. + severity: WARNING +- fix: AES + id: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea + languages: + - python + message: IDEA (International Data Encryption Algorithm) is a block cipher created in 1991. It is an optional + component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys. It is recommended + that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the + `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a + 128-bit key. Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm + instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + bandit-code: B304 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://tools.ietf.org/html/rfc5469 - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA - category: security - technology: - - cryptography - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::symmetric-algorithm::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea - shortlink: https://sg.run/3xyK semgrep.dev: rule: + origin: community r_id: 9443 - rv_id: 1263350 rule_id: BYUNPg + rv_id: 1263350 + url: + https://semgrep.dev/playground/r/44TEjNJ/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea version_id: 44TEjNJ - url: https://semgrep.dev/playground/r/44TEjNJ/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/3xyK + source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$IDEA($KEY) - metavariable-regex: metavariable: $IDEA regex: ^(IDEA)$ - focus-metavariable: $IDEA - fix: AES -- id: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb - message: ECB (Electronic Code Book) is the simplest mode of operation for block ciphers. Each block of data is encrypted - in the same way. This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave - significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM. + severity: WARNING +- fix: cryptography.hazmat.primitives.ciphers.modes.GCM($IV) + id: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb + languages: + - python + message: ECB (Electronic Code Book) is the simplest mode of operation for block ciphers. Each block of data is + encrypted in the same way. This means identical plaintext blocks will always result in identical ciphertext blocks, + which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as + GCM. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L101 + bandit-code: B305 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::mode::cryptography + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B305 references: - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes - https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption - category: security - technology: - - cryptography - subcategory: - - audit - likelihood: LOW - impact: LOW - confidence: MEDIUM - functional-categories: - - crypto::search::mode::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb - shortlink: https://sg.run/4xr5 semgrep.dev: rule: + origin: community r_id: 9444 - rv_id: 1263351 rule_id: DbUp5g + rv_id: 1263351 + url: + https://semgrep.dev/playground/r/PkTR3w7/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb version_id: PkTR3w7 - url: https://semgrep.dev/playground/r/PkTR3w7/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb - origin: community + shortlink: https://sg.run/4xr5 + source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L101 + subcategory: + - audit + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues + pattern: cryptography.hazmat.primitives.ciphers.modes.ECB($IV) severity: WARNING +- fix: SHA256 + id: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 languages: - python - pattern: cryptography.hazmat.primitives.ciphers.modes.ECB($IV) - fix: cryptography.hazmat.primitives.ciphers.modes.GCM($IV) -- id: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 - message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use SHA256 or SHA3 instead. + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + bandit-code: B303 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B303 references: - https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5 - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - cryptography - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::symmetric-algorithm::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 - shortlink: https://sg.run/eY88 semgrep.dev: rule: + origin: community r_id: 33632 - rv_id: 1263352 rule_id: lBUopp + rv_id: 1263352 + url: + https://semgrep.dev/playground/r/JdTzxww/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 version_id: JdTzxww - url: https://semgrep.dev/playground/r/JdTzxww/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/eY88 + source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - pattern: cryptography.hazmat.primitives.hashes.$MD5() - metavariable-regex: metavariable: $MD5 regex: ^(MD5)$ - focus-metavariable: $MD5 - fix: SHA256 -- id: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 - patterns: - - pattern: cryptography.hazmat.primitives.hashes.$SHA(...) - - metavariable-pattern: - metavariable: $SHA - pattern: 'SHA1 - - ' - - focus-metavariable: $SHA - fix: 'SHA256 - - ' - message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not - suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + severity: WARNING +- fix: "SHA256\n" + id: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + languages: + - python + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore + not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + bandit-code: B303 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B303 references: - https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1 - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - cryptography - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::symmetric-algorithm::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 - shortlink: https://sg.run/J9Qy semgrep.dev: rule: + origin: community r_id: 9446 - rv_id: 1263353 rule_id: 0oU5dN + rv_id: 1263353 + url: + https://semgrep.dev/playground/r/5PTo1l0/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 version_id: 5PTo1l0 - url: https://semgrep.dev/playground/r/5PTo1l0/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 - origin: community + shortlink: https://sg.run/J9Qy + source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: cryptography.hazmat.primitives.hashes.$SHA(...) + - metavariable-pattern: + metavariable: $SHA + pattern: "SHA1\n" + - focus-metavariable: $SHA severity: WARNING +- fix: "2048\n" + id: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size languages: - python -- id: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size - patterns: - - pattern-either: - - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(..., key_size=$SIZE, ...) - - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key($SIZE, ...) - - metavariable-comparison: - metavariable: $SIZE - comparison: $SIZE < 2048 - - focus-metavariable: $SIZE - fix: '2048 - - ' message: Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::key-length::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/ - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf - category: security - technology: - - cryptography - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::key-length::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size - shortlink: https://sg.run/5Qb0 semgrep.dev: rule: + origin: community r_id: 9447 - rv_id: 1263354 rule_id: KxUb0x + rv_id: 1263354 + url: + https://semgrep.dev/playground/r/GxTkeOK/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size version_id: GxTkeOK - url: https://semgrep.dev/playground/r/GxTkeOK/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size - origin: community - languages: - - python - severity: WARNING -- id: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size + shortlink: https://sg.run/5Qb0 + source: https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...) - - pattern: cryptography.hazmat.primitives.asymmetric.ec.$SIZE - - metavariable-pattern: + - pattern-either: + - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(..., key_size=$SIZE, ...) + - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key($SIZE, ...) + - metavariable-comparison: + comparison: $SIZE < 2048 metavariable: $SIZE - pattern-either: - - pattern: SECP192R1 - - pattern: SECT163K1 - - pattern: SECT163R2 - focus-metavariable: $SIZE - fix: 'SECP256R1 - - ' - message: Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'. + severity: WARNING +- fix: "SECP256R1\n" + id: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size + languages: + - python + message: Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use + 'ec.SECP256R1'. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::key-length::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves - category: security - technology: - - cryptography - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::key-length::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size - shortlink: https://sg.run/GeQq semgrep.dev: rule: + origin: community r_id: 9448 - rv_id: 1263355 rule_id: qNUjZ3 + rv_id: 1263355 + url: + https://semgrep.dev/playground/r/RGT0LW6/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size version_id: RGT0LW6 - url: https://semgrep.dev/playground/r/RGT0LW6/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size - origin: community - languages: - - python - severity: WARNING -- id: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size + shortlink: https://sg.run/GeQq + source: https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + subcategory: + - audit + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-either: - - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(..., key_size=$SIZE, ...) - - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key($EXP, $SIZE, ...) - - metavariable-comparison: + - pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...) + - pattern: cryptography.hazmat.primitives.asymmetric.ec.$SIZE + - metavariable-pattern: metavariable: $SIZE - comparison: $SIZE < 2048 + pattern-either: + - pattern: SECP192R1 + - pattern: SECT163K1 + - pattern: SECT163R2 - focus-metavariable: $SIZE - fix: '2048 - - ' + severity: WARNING +- fix: "2048\n" + id: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size + languages: + - python message: Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::key-length::cryptography + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/ - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf - category: security - technology: - - cryptography - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - functional-categories: - - crypto::search::key-length::cryptography - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size - shortlink: https://sg.run/RoQq semgrep.dev: rule: + origin: community r_id: 9449 - rv_id: 1263356 rule_id: lBU9jn + rv_id: 1263356 + url: + https://semgrep.dev/playground/r/A8TgdPK/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size version_id: A8TgdPK - url: https://semgrep.dev/playground/r/A8TgdPK/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size - origin: community - languages: - - python + shortlink: https://sg.run/RoQq + source: https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + subcategory: + - audit + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern-either: + - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(..., key_size=$SIZE, ...) + - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key($EXP, $SIZE, ...) + - metavariable-comparison: + comparison: $SIZE < 2048 + metavariable: $SIZE + - focus-metavariable: $SIZE severity: WARNING - id: python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication - message: 'An encryption mode of operation is being used without proper message authentication. This can potentially result - in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ' languages: - python - severity: ERROR + message: 'An encryption mode of operation is being used without proper message authentication. This can potentially result + in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ' metadata: category: security - technology: - - cryptography + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication - shortlink: https://sg.run/N9JL semgrep.dev: rule: + origin: community r_id: 31871 - rv_id: 1263357 rule_id: lBUpNZ + rv_id: 1263357 + url: + https://semgrep.dev/playground/r/BjTkZj5/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication version_id: BjTkZj5 - url: https://semgrep.dev/playground/r/BjTkZj5/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication - origin: community + shortlink: https://sg.run/N9JL + source: + https://semgrep.dev/r/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication + subcategory: + - audit + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - patterns: - - pattern: 'Cipher(..., $HAZMAT_MODE(...),...) - - ' - - pattern-not-inside: 'Cipher(..., $HAZMAT_MODE(...),...) - - ... - - HMAC(...) - - ' - - pattern-not-inside: 'Cipher(..., $HAZMAT_MODE(...),...) - - ... - - hmac.HMAC(...) - - ' + - pattern: "Cipher(..., $HAZMAT_MODE(...),...)\n" + - pattern-not-inside: "Cipher(..., $HAZMAT_MODE(...),...)\n...\nHMAC(...)\n" + - pattern-not-inside: "Cipher(..., $HAZMAT_MODE(...),...)\n...\nhmac.HMAC(...)\n" - metavariable-pattern: metavariable: $HAZMAT_MODE patterns: @@ -1660,118 +1621,98 @@ rules: - pattern: modes.CBC - pattern: modes.CFB - pattern: modes.OFB -- id: python.distributed.security.require-encryption - patterns: - - pattern: 'distributed.security.Security(..., require_encryption=$VAL, ...) - - ' - - metavariable-pattern: - metavariable: $VAL - pattern: 'False - - ' - - focus-metavariable: $VAL - fix: 'True - - ' - message: Initializing a security context for Dask (`distributed`) without "require_encryption" keyword argument may silently - fail to provide security. - severity: WARNING + severity: ERROR +- fix: "True\n" + id: python.distributed.security.require-encryption + languages: + - python + message: Initializing a security context for Dask (`distributed`) without "require_encryption" keyword argument may + silently fail to provide security. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters - category: security - technology: - - distributed - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.distributed.security.require-encryption - shortlink: https://sg.run/AvQ2 semgrep.dev: rule: + origin: community r_id: 9450 - rv_id: 1263358 rule_id: YGURy0 - version_id: DkTRbol + rv_id: 1263358 url: https://semgrep.dev/playground/r/DkTRbol/python.distributed.security.require-encryption - origin: community + version_id: DkTRbol + shortlink: https://sg.run/AvQ2 + source: https://semgrep.dev/r/python.distributed.security.require-encryption + subcategory: + - vuln + technology: + - distributed + vulnerability_class: + - Mishandled Sensitive Information + patterns: + - pattern: "distributed.security.Security(..., require_encryption=$VAL, ...)\n" + - metavariable-pattern: + metavariable: $VAL + pattern: "False\n" + - focus-metavariable: $VAL + severity: WARNING +- id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization languages: - python -- id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization + message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or + `yaml`, which are known to lead to remote code execution vulnerabilities. metadata: - owasp: - - A08:2017 - Insecure Deserialization - - A08:2021 - Software and Data Integrity Failures - - A08:2025 - Software or Data Integrity Failures + category: security + confidence: MEDIUM cwe: - 'CWE-502: Deserialization of Untrusted Data' - references: - - https://docs.python.org/3/library/pickle.html - category: security - technology: - - django - cwe2022-top25: true cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization - shortlink: https://sg.run/9oyr + likelihood: MEDIUM + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + - A08:2025 - Software or Data Integrity Failures + references: + - https://docs.python.org/3/library/pickle.html semgrep.dev: rule: + origin: community r_id: 9467 - rv_id: 1409400 rule_id: OrU3e6 + rv_id: 1409400 + url: + https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization version_id: GxTlb9e - url: https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization - origin: community - message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, - which are known to lead to remote code execution vulnerabilities. - languages: - - python - severity: ERROR + shortlink: https://sg.run/9oyr + source: + https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization + subcategory: + - vuln + technology: + - django + vulnerability_class: + - 'Insecure Deserialization ' mode: taint - pattern-sources: - - pattern-either: - - patterns: - - pattern-inside: "def $INSIDE(..., $PARAM, ...):\n ...\n" - - pattern-either: - - pattern: request.$REQFUNC(...) - - pattern: request.$REQFUNC.get(...) - - pattern: request.$REQFUNC[...] pattern-sinks: - pattern-either: - patterns: - pattern-either: - - pattern: 'pickle.$PICKLEFUNC(...) - - ' - - pattern: '_pickle.$PICKLEFUNC(...) - - ' - - pattern: 'cPickle.$PICKLEFUNC(...) - - ' - - pattern: 'shelve.$PICKLEFUNC(...) - - ' + - pattern: "pickle.$PICKLEFUNC(...)\n" + - pattern: "_pickle.$PICKLEFUNC(...)\n" + - pattern: "cPickle.$PICKLEFUNC(...)\n" + - pattern: "shelve.$PICKLEFUNC(...)\n" - metavariable-regex: metavariable: $PICKLEFUNC regex: dumps|dump|load|loads @@ -1789,556 +1730,266 @@ rules: - metavariable-regex: metavariable: $YAMLFUNC regex: dump|dump_all|load|load_all -- id: python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid - patterns: - - pattern-inside: "def $FUNC(request, ...):\n ...\n" - - pattern-inside: "if $FORM.is_valid():\n ...\n" + pattern-sources: - pattern-either: - - pattern: request.POST[...] - - pattern: request.POST.get(...) - message: Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized - data + - patterns: + - pattern-inside: "def $INSIDE(..., $PARAM, ...):\n ...\n" + - pattern-either: + - pattern: request.$REQFUNC(...) + - pattern: request.$REQFUNC.get(...) + - pattern: request.$REQFUNC[...] + severity: ERROR +- id: python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid languages: - python - severity: WARNING + message: Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access + sanitized data metadata: category: security + confidence: MEDIUM cwe: 'CWE-20: Improper Input Validation' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM references: - https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data - confidence: MEDIUM - likelihood: MEDIUM - impact: MEDIUM + semgrep.dev: + rule: + origin: community + r_id: 73472 + rule_id: JDUjqx + rv_id: 946161 + url: + https://semgrep.dev/playground/r/DkTNpEJ/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid + version_id: DkTNpEJ + shortlink: https://sg.run/kJn7 + source: + https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid subcategory: - audit technology: - django - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Validation - source: https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid - shortlink: https://sg.run/kJn7 - semgrep.dev: - rule: - r_id: 73472 - rv_id: 946161 - rule_id: JDUjqx - version_id: DkTNpEJ - url: https://semgrep.dev/playground/r/DkTNpEJ/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid - origin: community + patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-inside: "if $FORM.is_valid():\n ...\n" + - pattern-either: + - pattern: request.POST[...] + - pattern: request.POST.get(...) + severity: WARNING - id: python.django.security.hashids-with-django-secret.hashids-with-django-secret languages: - python - message: The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, - the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through - the HashIDs. + message: The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient + HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by + attackers, through the HashIDs. metadata: category: security - subcategory: - - vuln + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A02:2021 – Cryptographic Failures references: - https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY - http://carnage.github.io/2015/08/cryptanalysis-of-hashids - technology: - - django - likelihood: LOW - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret - shortlink: https://sg.run/bxeZ semgrep.dev: rule: + origin: community r_id: 72426 - rv_id: 946163 rule_id: 0oUXqy + rv_id: 946163 + url: + https://semgrep.dev/playground/r/0bT15nn/python.django.security.hashids-with-django-secret.hashids-with-django-secret version_id: 0bT15nn - url: https://semgrep.dev/playground/r/0bT15nn/python.django.security.hashids-with-django-secret.hashids-with-django-secret - origin: community + shortlink: https://sg.run/bxeZ + source: https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: hashids.Hashids(..., salt=django.conf.settings.SECRET_KEY, ...) - pattern: hashids.Hashids(django.conf.settings.SECRET_KEY, ...) severity: ERROR - id: python.django.security.injection.code.user-eval-format-string.user-eval-format-string - message: Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote - code. See https://owasp.org/www-community/attacks/Code_Injection for more information. + languages: + - python + message: Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute + remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html - category: security - technology: - - django - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string - shortlink: https://sg.run/4x2z semgrep.dev: rule: + origin: community r_id: 9500 - rv_id: 1263383 rule_id: BYUNw9 + rv_id: 1263383 + url: + https://semgrep.dev/playground/r/vdT06xG/python.django.security.injection.code.user-eval-format-string.user-eval-format-string version_id: vdT06xG - url: https://semgrep.dev/playground/r/vdT06xG/python.django.security.injection.code.user-eval-format-string.user-eval-format-string - origin: community + shortlink: https://sg.run/4x2z + source: https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Code Injection patterns: - pattern-inside: "def $F(...):\n ...\n" - pattern-either: - pattern: eval(..., $STR % request.$W.get(...), ...) - - pattern: '$V = request.$W.get(...) - - ... - - eval(..., $STR % $V, ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - $S = $STR % $V - - ... - - eval(..., $S, ...) - - ' + - pattern: "$V = request.$W.get(...)\n...\neval(..., $STR % $V, ...)\n" + - pattern: "$V = request.$W.get(...)\n...\n$S = $STR % $V\n...\neval(..., $S, ...)\n" - pattern: eval(..., "..." % request.$W(...), ...) - - pattern: '$V = request.$W(...) - - ... - - eval(..., $STR % $V, ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - $S = $STR % $V - - ... - - eval(..., $S, ...) - - ' + - pattern: "$V = request.$W(...)\n...\neval(..., $STR % $V, ...)\n" + - pattern: "$V = request.$W(...)\n...\n$S = $STR % $V\n...\neval(..., $S, ...)\n" - pattern: eval(..., $STR % request.$W[...], ...) - - pattern: '$V = request.$W[...] - - ... - - eval(..., $STR % $V, ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - $S = $STR % $V - - ... - - eval(..., $S, ...) - - ' + - pattern: "$V = request.$W[...]\n...\neval(..., $STR % $V, ...)\n" + - pattern: "$V = request.$W[...]\n...\n$S = $STR % $V\n...\neval(..., $S, ...)\n" - pattern: eval(..., $STR.format(..., request.$W.get(...), ...), ...) - - pattern: '$V = request.$W.get(...) - - ... - - eval(..., $STR.format(..., $V, ...), ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - $S = $STR.format(..., $V, ...) - - ... - - eval(..., $S, ...) - - ' + - pattern: "$V = request.$W.get(...)\n...\neval(..., $STR.format(..., $V, ...), ...)\n" + - pattern: "$V = request.$W.get(...)\n...\n$S = $STR.format(..., $V, ...)\n...\neval(..., $S, ...)\n" - pattern: eval(..., $STR.format(..., request.$W(...), ...), ...) - - pattern: '$V = request.$W(...) - - ... - - eval(..., $STR.format(..., $V, ...), ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - $S = $STR.format(..., $V, ...) - - ... - - eval(..., $S, ...) - - ' + - pattern: "$V = request.$W(...)\n...\neval(..., $STR.format(..., $V, ...), ...)\n" + - pattern: "$V = request.$W(...)\n...\n$S = $STR.format(..., $V, ...)\n...\neval(..., $S, ...)\n" - pattern: eval(..., $STR.format(..., request.$W[...], ...), ...) - - pattern: '$V = request.$W[...] - - ... - - eval(..., $STR.format(..., $V, ...), ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - $S = $STR.format(..., $V, ...) - - ... - - eval(..., $S, ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - eval(..., f"...{$V}...", ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - $S = f"...{$V}..." - - ... - - eval(..., $S, ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - eval(..., f"...{$V}...", ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - $S = f"...{$V}..." - - ... - - eval(..., $S, ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - eval(..., f"...{$V}...", ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - $S = f"...{$V}..." - - ... - - eval(..., $S, ...) - - ' - languages: - - python + - pattern: "$V = request.$W[...]\n...\neval(..., $STR.format(..., $V, ...), ...)\n" + - pattern: "$V = request.$W[...]\n...\n$S = $STR.format(..., $V, ...)\n...\neval(..., $S, ...)\n" + - pattern: "$V = request.$W.get(...)\n...\neval(..., f\"...{$V}...\", ...)\n" + - pattern: "$V = request.$W.get(...)\n...\n$S = f\"...{$V}...\"\n...\neval(..., $S, ...)\n" + - pattern: "$V = request.$W(...)\n...\neval(..., f\"...{$V}...\", ...)\n" + - pattern: "$V = request.$W(...)\n...\n$S = f\"...{$V}...\"\n...\neval(..., $S, ...)\n" + - pattern: "$V = request.$W[...]\n...\neval(..., f\"...{$V}...\", ...)\n" + - pattern: "$V = request.$W[...]\n...\n$S = f\"...{$V}...\"\n...\neval(..., $S, ...)\n" severity: WARNING - id: python.django.security.injection.code.user-eval.user-eval - message: Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary - remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific - functionality you need. + languages: + - python + message: Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute + arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library + for the specific functionality you need. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html - https://owasp.org/www-community/attacks/Code_Injection - category: security - technology: - - django - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval - shortlink: https://sg.run/PJDW semgrep.dev: rule: + origin: community r_id: 9501 - rv_id: 1263384 rule_id: DbUpDQ - version_id: d6Tyx2A + rv_id: 1263384 url: https://semgrep.dev/playground/r/d6Tyx2A/python.django.security.injection.code.user-eval.user-eval - origin: community + version_id: d6Tyx2A + shortlink: https://sg.run/PJDW + source: https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Code Injection patterns: - pattern-inside: "def $F(...):\n ...\n" - pattern-either: - pattern: eval(..., request.$W.get(...), ...) - - pattern: '$V = request.$W.get(...) - - ... - - eval(..., $V, ...) - - ' + - pattern: "$V = request.$W.get(...)\n...\neval(..., $V, ...)\n" - pattern: eval(..., request.$W(...), ...) - - pattern: '$V = request.$W(...) - - ... - - eval(..., $V, ...) - - ' + - pattern: "$V = request.$W(...)\n...\neval(..., $V, ...)\n" - pattern: eval(..., request.$W[...], ...) - - pattern: '$V = request.$W[...] - - ... - - eval(..., $V, ...) - - ' - languages: - - python + - pattern: "$V = request.$W[...]\n...\neval(..., $V, ...)\n" severity: WARNING - id: python.django.security.injection.code.user-exec-format-string.user-exec-format-string - message: Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary - remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific - functionality you need. + languages: + - python + message: Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute + arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library + for the specific functionality you need. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - django references: - https://owasp.org/www-community/attacks/Code_Injection - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string - shortlink: https://sg.run/J9JW semgrep.dev: rule: + origin: community r_id: 9502 - rv_id: 1263385 rule_id: WAUovx + rv_id: 1263385 + url: + https://semgrep.dev/playground/r/ZRTKA1p/python.django.security.injection.code.user-exec-format-string.user-exec-format-string version_id: ZRTKA1p - url: https://semgrep.dev/playground/r/ZRTKA1p/python.django.security.injection.code.user-exec-format-string.user-exec-format-string - origin: community + shortlink: https://sg.run/J9JW + source: https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Code Injection patterns: - pattern-inside: "def $F(...):\n ...\n" - pattern-either: - pattern: exec(..., $STR % request.$W.get(...), ...) - - pattern: '$V = request.$W.get(...) - - ... - - exec(..., $STR % $V, ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - $S = $STR % $V - - ... - - exec(..., $S, ...) - - ' + - pattern: "$V = request.$W.get(...)\n...\nexec(..., $STR % $V, ...)\n" + - pattern: "$V = request.$W.get(...)\n...\n$S = $STR % $V\n...\nexec(..., $S, ...)\n" - pattern: exec(..., "..." % request.$W(...), ...) - - pattern: '$V = request.$W(...) - - ... - - exec(..., $STR % $V, ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - $S = $STR % $V - - ... - - exec(..., $S, ...) - - ' + - pattern: "$V = request.$W(...)\n...\nexec(..., $STR % $V, ...)\n" + - pattern: "$V = request.$W(...)\n...\n$S = $STR % $V\n...\nexec(..., $S, ...)\n" - pattern: exec(..., $STR % request.$W[...], ...) - - pattern: '$V = request.$W[...] - - ... - - exec(..., $STR % $V, ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - $S = $STR % $V - - ... - - exec(..., $S, ...) - - ' + - pattern: "$V = request.$W[...]\n...\nexec(..., $STR % $V, ...)\n" + - pattern: "$V = request.$W[...]\n...\n$S = $STR % $V\n...\nexec(..., $S, ...)\n" - pattern: exec(..., $STR.format(..., request.$W.get(...), ...), ...) - - pattern: '$V = request.$W.get(...) - - ... - - exec(..., $STR.format(..., $V, ...), ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - $S = $STR.format(..., $V, ...) - - ... - - exec(..., $S, ...) - - ' + - pattern: "$V = request.$W.get(...)\n...\nexec(..., $STR.format(..., $V, ...), ...)\n" + - pattern: "$V = request.$W.get(...)\n...\n$S = $STR.format(..., $V, ...)\n...\nexec(..., $S, ...)\n" - pattern: exec(..., $STR.format(..., request.$W(...), ...), ...) - - pattern: '$V = request.$W(...) - - ... - - exec(..., $STR.format(..., $V, ...), ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - $S = $STR.format(..., $V, ...) - - ... - - exec(..., $S, ...) - - ' + - pattern: "$V = request.$W(...)\n...\nexec(..., $STR.format(..., $V, ...), ...)\n" + - pattern: "$V = request.$W(...)\n...\n$S = $STR.format(..., $V, ...)\n...\nexec(..., $S, ...)\n" - pattern: exec(..., $STR.format(..., request.$W[...], ...), ...) - - pattern: '$V = request.$W[...] - - ... - - exec(..., $STR.format(..., $V, ...), ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - $S = $STR.format(..., $V, ...) - - ... - - exec(..., $S, ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - exec(..., f"...{$V}...", ...) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - $S = f"...{$V}..." - - ... - - exec(..., $S, ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - exec(..., f"...{$V}...", ...) - - ' - - pattern: '$V = request.$W(...) - - ... - - $S = f"...{$V}..." - - ... - - exec(..., $S, ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - exec(..., f"...{$V}...", ...) - - ' - - pattern: '$V = request.$W[...] - - ... - - $S = f"...{$V}..." - - ... - - exec(..., $S, ...) - - ' + - pattern: "$V = request.$W[...]\n...\nexec(..., $STR.format(..., $V, ...), ...)\n" + - pattern: "$V = request.$W[...]\n...\n$S = $STR.format(..., $V, ...)\n...\nexec(..., $S, ...)\n" + - pattern: "$V = request.$W.get(...)\n...\nexec(..., f\"...{$V}...\", ...)\n" + - pattern: "$V = request.$W.get(...)\n...\n$S = f\"...{$V}...\"\n...\nexec(..., $S, ...)\n" + - pattern: "$V = request.$W(...)\n...\nexec(..., f\"...{$V}...\", ...)\n" + - pattern: "$V = request.$W(...)\n...\n$S = f\"...{$V}...\"\n...\nexec(..., $S, ...)\n" + - pattern: "$V = request.$W[...]\n...\nexec(..., f\"...{$V}...\", ...)\n" + - pattern: "$V = request.$W[...]\n...\n$S = f\"...{$V}...\"\n...\nexec(..., $S, ...)\n" - pattern: exec(..., base64.decodestring($S.format(..., request.$W.get(...), ...), ...), ...) - pattern: exec(..., base64.decodestring($S % request.$W.get(...), ...), ...) - pattern: exec(..., base64.decodestring(f"...{request.$W.get(...)}...", ...), ...) @@ -2347,291 +1998,117 @@ rules: - pattern: exec(..., base64.decodestring(bytes($S % request.$W.get(...), ...), ...), ...) - pattern: exec(..., base64.decodestring(bytes(f"...{request.$W.get(...)}...", ...), ...), ...) - pattern: exec(..., base64.decodestring(bytes(request.$W.get(...), ...), ...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - exec(..., base64.decodestring($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = base64.decodestring($DATA, ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = base64.decodestring(bytes($DATA, ...), ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - exec(..., base64.decodestring($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = base64.decodestring($DATA, ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = base64.decodestring(bytes($DATA, ...), ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - exec(..., base64.decodestring($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = base64.decodestring($DATA, ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = base64.decodestring(bytes($DATA, ...), ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - exec(..., base64.decodestring($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = base64.decodestring($DATA, ...) - - ... - - exec(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - exec(..., base64.decodestring(bytes($DATA, ...), ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = base64.decodestring(bytes($DATA, ...), ...) - - ... - - exec(..., $INTERM, ...) - - ' - languages: - - python + - pattern: "$DATA = request.$W.get(...)\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, ...)\n" severity: WARNING - id: python.django.security.injection.code.user-exec.user-exec - message: Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary - remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific - functionality you need. + languages: + - python + message: Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute + arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library + for the specific functionality you need. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - django references: - https://owasp.org/www-community/attacks/Code_Injection - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec - shortlink: https://sg.run/5Q3X semgrep.dev: rule: + origin: community r_id: 9503 - rv_id: 1263386 rule_id: 0oU5AW - version_id: nWT2LA2 + rv_id: 1263386 url: https://semgrep.dev/playground/r/nWT2LA2/python.django.security.injection.code.user-exec.user-exec - origin: community + version_id: nWT2LA2 + shortlink: https://sg.run/5Q3X + source: https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Code Injection patterns: - pattern-inside: "def $F(...):\n ...\n" - pattern-either: - pattern: exec(..., request.$W.get(...), ...) - - pattern: '$V = request.$W.get(...) - - ... - - exec(..., $V, ...) - - ' + - pattern: "$V = request.$W.get(...)\n...\nexec(..., $V, ...)\n" - pattern: exec(..., request.$W(...), ...) - - pattern: '$V = request.$W(...) - - ... - - exec(..., $V, ...) - - ' + - pattern: "$V = request.$W(...)\n...\nexec(..., $V, ...)\n" - pattern: exec(..., request.$W[...], ...) - - pattern: '$V = request.$W[...] - - ... - - exec(..., $V, ...) - - ' - - pattern: 'loop = asyncio.get_running_loop() - - ... - - await loop.run_in_executor(None, exec, request.$W[...]) - - ' - - pattern: '$V = request.$W[...] - - ... - - loop = asyncio.get_running_loop() - - ... - - await loop.run_in_executor(None, exec, $V) - - ' - - pattern: 'loop = asyncio.get_running_loop() - - ... - - await loop.run_in_executor(None, exec, request.$W.get(...)) - - ' - - pattern: '$V = request.$W.get(...) - - ... - - loop = asyncio.get_running_loop() - - ... - - await loop.run_in_executor(None, exec, $V) - - ' - languages: - - python + - pattern: "$V = request.$W[...]\n...\nexec(..., $V, ...)\n" + - pattern: "loop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, request.$W[...])\n" + - pattern: "$V = request.$W[...]\n...\nloop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, + $V)\n" + - pattern: "loop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, request.$W.get(...))\n" + - pattern: "$V = request.$W.get(...)\n...\nloop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, + $V)\n" severity: WARNING - id: python.django.security.injection.command.command-injection-os-system.command-injection-os-system - message: Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this - must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection - for more information. + languages: + - python + message: Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If + this must be done, use the 'subprocess' module instead and pass the arguments as a list. See + https://owasp.org/www-community/attacks/Command_Injection for more information. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/www-community/attacks/Command_Injection - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system - shortlink: https://sg.run/Gen2 semgrep.dev: rule: + origin: community r_id: 9504 - rv_id: 1263387 rule_id: KxUbp2 + rv_id: 1263387 + url: + https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system version_id: ExTExPo - url: https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system - origin: community - languages: - - python - severity: ERROR + shortlink: https://sg.run/Gen2 + source: + https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Command Injection patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -2639,96 +2116,16 @@ rules: - pattern: os.system(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: os.system(..., $S % request.$W.get(...), ...) - pattern: os.system(..., f"...{request.$W.get(...)}...", ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - os.system(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - os.system(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - os.system(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - os.system(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - os.system(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - os.system(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nos.system(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nos.system(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nos.system(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nos.system(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n" - pattern: $A = os.system(..., request.$W.get(...), ...) - pattern: $A = os.system(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: $A = os.system(..., $S % request.$W.get(...), ...) @@ -2741,96 +2138,16 @@ rules: - pattern: os.system(..., $S.format(..., request.$W(...), ...), ...) - pattern: os.system(..., $S % request.$W(...), ...) - pattern: os.system(..., f"...{request.$W(...)}...", ...) - - pattern: '$DATA = request.$W(...) - - ... - - os.system(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - os.system(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - os.system(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - os.system(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - os.system(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - os.system(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nos.system(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nos.system(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nos.system(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nos.system(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n" - pattern: $A = os.system(..., request.$W(...), ...) - pattern: $A = os.system(..., $S.format(..., request.$W(...), ...), ...) - pattern: $A = os.system(..., $S % request.$W(...), ...) @@ -2843,96 +2160,16 @@ rules: - pattern: os.system(..., $S.format(..., request.$W[...], ...), ...) - pattern: os.system(..., $S % request.$W[...], ...) - pattern: os.system(..., f"...{request.$W[...]}...", ...) - - pattern: '$DATA = request.$W[...] - - ... - - os.system(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - os.system(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - os.system(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - os.system(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - os.system(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - os.system(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nos.system(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nos.system(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nos.system(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nos.system(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n" - pattern: $A = os.system(..., request.$W[...], ...) - pattern: $A = os.system(..., $S.format(..., request.$W[...], ...), ...) - pattern: $A = os.system(..., $S % request.$W[...], ...) @@ -2945,96 +2182,16 @@ rules: - pattern: os.system(..., $S.format(..., request.$W, ...), ...) - pattern: os.system(..., $S % request.$W, ...) - pattern: os.system(..., f"...{request.$W}...", ...) - - pattern: '$DATA = request.$W - - ... - - os.system(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - os.system(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - os.system(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - os.system(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - os.system(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - os.system(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - os.system(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nos.system(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nos.system(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nos.system(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nos.system(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n" - pattern: $A = os.system(..., request.$W, ...) - pattern: $A = os.system(..., $S.format(..., request.$W, ...), ...) - pattern: $A = os.system(..., $S % request.$W, ...) @@ -3043,21 +2200,55 @@ rules: - pattern: return os.system(..., $S.format(..., request.$W, ...), ...) - pattern: return os.system(..., $S % request.$W, ...) - pattern: return os.system(..., f"...{request.$W}...", ...) + severity: ERROR - id: python.django.security.injection.command.subprocess-injection.subprocess-injection languages: - python + message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection + vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them + to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the + command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a + dictionary to allowlist a set of commands. + metadata: + category: security + confidence: HIGH + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 31144 + rule_id: EwUepx + rv_id: 1263388 + url: + https://semgrep.dev/playground/r/7ZTE3qK/python.django.security.injection.command.subprocess-injection.subprocess-injection + version_id: 7ZTE3qK + shortlink: https://sg.run/49BE + source: https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true - pattern-sources: + pattern-sanitizers: - patterns: - - pattern-inside: "def $FUNC(..., $REQUEST, ...):\n ...\n" - - focus-metavariable: $REQUEST - - metavariable-pattern: - metavariable: $REQUEST - patterns: - - pattern: request - - pattern-not-inside: request.build_absolute_uri + - pattern: $DICT[$KEY] + - focus-metavariable: $KEY pattern-sinks: - patterns: - pattern-either: @@ -3065,13 +2256,7 @@ rules: - pattern: subprocess.$FUNC(...) - pattern-not: subprocess.$FUNC("...", ...) - pattern-not: subprocess.$FUNC(["...", ...], ...) - - pattern-not-inside: '$CMD = ["...", ...] - - ... - - subprocess.$FUNC($CMD, ...) - - ' + - pattern-not-inside: "$CMD = [\"...\", ...]\n...\nsubprocess.$FUNC($CMD, ...)\n" - patterns: - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...) - metavariable-regex: @@ -3082,61 +2267,32 @@ rules: - metavariable-regex: metavariable: $INTERPRETER regex: ^(python|python\d)$ - pattern-sanitizers: + pattern-sources: - patterns: - - pattern: $DICT[$KEY] - - focus-metavariable: $KEY + - pattern-inside: "def $FUNC(..., $REQUEST, ...):\n ...\n" + - focus-metavariable: $REQUEST + - metavariable-pattern: + metavariable: $REQUEST + patterns: + - pattern: request + - pattern-not-inside: request.build_absolute_uri severity: ERROR - message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. - An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, - scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, - prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set - of commands. - metadata: - category: security - technology: - - flask - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection - shortlink: https://sg.run/49BE - semgrep.dev: - rule: - r_id: 31144 - rv_id: 1263388 - rule_id: EwUepx - version_id: 7ZTE3qK - url: https://semgrep.dev/playground/r/7ZTE3qK/python.django.security.injection.command.subprocess-injection.subprocess-injection - origin: community - id: python.django.security.injection.csv-writer-injection.csv-writer-injection languages: - python - message: Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate - the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet - application that runs an attacker script, which could steal data from the importing user or, at worst, install malware - on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula - injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs. + message: Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to + generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into + a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, + install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to + mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs. metadata: category: security confidence: MEDIUM cwe: - 'CWE-1236: Improper Neutralization of Formula Elements in a CSV File' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -3145,38 +2301,28 @@ rules: - https://github.com/raphaelm/defusedcsv - https://owasp.org/www-community/attacks/CSV_Injection - https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities - technology: - - django - - python - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/python.django.security.injection.csv-writer-injection.csv-writer-injection - shortlink: https://sg.run/Pw9q semgrep.dev: rule: + origin: community r_id: 31145 - rv_id: 1263389 rule_id: 7KUK1y + rv_id: 1263389 + url: + https://semgrep.dev/playground/r/LjTkgD9/python.django.security.injection.csv-writer-injection.csv-writer-injection version_id: LjTkgD9 - url: https://semgrep.dev/playground/r/LjTkgD9/python.django.security.injection.csv-writer-injection.csv-writer-injection - origin: community + shortlink: https://sg.run/Pw9q + source: https://semgrep.dev/r/python.django.security.injection.csv-writer-injection.csv-writer-injection + subcategory: + - vuln + technology: + - django + - python + vulnerability_class: + - Improper Validation mode: taint pattern-sinks: - patterns: - - pattern-inside: '$WRITER = csv.writer(...) - - - ... - - - $WRITER.$WRITE(...) - - ' + - pattern-inside: "$WRITER = csv.writer(...)\n\n...\n\n$WRITER.$WRITE(...)\n" - pattern: $WRITER.$WRITE(...) - metavariable-regex: metavariable: $WRITE @@ -3192,790 +2338,245 @@ rules: - pattern-not-inside: request.build_absolute_uri severity: ERROR - id: python.django.security.injection.email.xss-html-email-body.xss-html-email-body - message: Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible - to XSS. An attacker could inject data into this HTML email, causing XSS. + languages: + - python + message: Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are + susceptible to XSS. An attacker could inject data into this HTML email, causing XSS. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (''Injection'')' + - "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://www.damonkohler.com/2008/12/email-injection.html - category: security - technology: - - django - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body - shortlink: https://sg.run/RoBe semgrep.dev: rule: + origin: community r_id: 9505 - rv_id: 1263390 rule_id: qNUj02 + rv_id: 1263390 + url: + https://semgrep.dev/playground/r/8KT5rOn/python.django.security.injection.email.xss-html-email-body.xss-html-email-body version_id: 8KT5rOn - url: https://semgrep.dev/playground/r/8KT5rOn/python.django.security.injection.email.xss-html-email-body.xss-html-email-body - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/RoBe + source: https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Other patterns: - pattern-inside: "def $FUNC(...):\n ...\n $EMAIL.content_subtype = \"html\"\n ...\n" - pattern-either: - pattern: django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.EmailMessage($SUBJ, $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, + $INTERM, ...)\n" - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...) - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...) - pattern: django.core.mail.EmailMessage($SUBJ, request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.EmailMessage($SUBJ, $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, + $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, + ...)\n" - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W(...), ...) - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W(...), ...) - pattern: django.core.mail.EmailMessage($SUBJ, request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.EmailMessage($SUBJ, $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, + $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, + ...)\n" - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W[...], ...) - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W[...], ...) - pattern: django.core.mail.EmailMessage($SUBJ, request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - django.core.mail.EmailMessage($SUBJ, $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.EmailMessage($SUBJ, $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, + ...)\n" - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W, ...) - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W, ...) + severity: WARNING - id: python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message - message: Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible - to XSS. An attacker could inject data into this HTML email, causing XSS. + languages: + - python + message: Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are + susceptible to XSS. An attacker could inject data into this HTML email, causing XSS. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (''Injection'')' + - "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://www.damonkohler.com/2008/12/email-injection.html - category: security - technology: - - django - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message - shortlink: https://sg.run/Avx8 semgrep.dev: rule: + origin: community r_id: 9506 - rv_id: 1263391 rule_id: lBU9Ll + rv_id: 1263391 + url: + https://semgrep.dev/playground/r/gETB7Gn/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message version_id: gETB7Gn - url: https://semgrep.dev/playground/r/gETB7Gn/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/Avx8 + source: + https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Other patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: - pattern: django.core.mail.send_mail(..., html_message=request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.send_mail(..., html_message=$DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., + html_message=$INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W.get(...), ...) - pattern: return django.core.mail.send_mail(..., html_message=request.$W.get(...), ...) - pattern: django.core.mail.send_mail(..., html_message=request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.send_mail(..., html_message=$DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., + html_message=$INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W(...), ...) - pattern: return django.core.mail.send_mail(..., html_message=request.$W(...), ...) - pattern: django.core.mail.send_mail(..., html_message=request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.send_mail(..., html_message=$DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., + html_message=$INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W[...], ...) - pattern: return django.core.mail.send_mail(..., html_message=request.$W[...], ...) - pattern: django.core.mail.send_mail(..., html_message=request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - django.core.mail.send_mail(..., html_message=$DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.send_mail(..., html_message=$STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.core.mail.send_mail(..., html_message=$STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - django.core.mail.send_mail(..., html_message=$INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, + ...)\n" - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W, ...) - pattern: return django.core.mail.send_mail(..., html_message=request.$W, ...) + severity: WARNING - id: python.django.security.injection.open-redirect.open-redirect - message: Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you - are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html - for more information. + languages: + - python + message: Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure + you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See + https://cwe.mitre.org/data/definitions/601.html for more information. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/ - https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231 - category: security - technology: - - django - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect - shortlink: https://sg.run/Ave2 semgrep.dev: rule: + origin: community r_id: 9494 - rv_id: 1263393 rule_id: PeUZgr - version_id: 3ZT4XD7 + rv_id: 1263393 url: https://semgrep.dev/playground/r/3ZT4XD7/python.django.security.injection.open-redirect.open-redirect - origin: community - languages: - - python - severity: WARNING + version_id: 3ZT4XD7 + shortlink: https://sg.run/Ave2 + source: https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Open Redirect patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-not-inside: "def $FUNC(...):\n ...\n django.utils.http.is_safe_url(...)\n ...\n" @@ -3988,96 +2589,18 @@ rules: - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: django.shortcuts.redirect(..., $S % request.$W.get(...), ...) - pattern: django.shortcuts.redirect(..., f"...{request.$W.get(...)}...", ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.shortcuts.redirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.shortcuts.redirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.shortcuts.redirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.shortcuts.redirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" - pattern: $A = django.shortcuts.redirect(..., request.$W.get(...), ...) - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: $A = django.shortcuts.redirect(..., $S % request.$W.get(...), ...) @@ -4090,96 +2613,17 @@ rules: - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.shortcuts.redirect(..., $S % request.$W(...), ...) - pattern: django.shortcuts.redirect(..., f"...{request.$W(...)}...", ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.shortcuts.redirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.shortcuts.redirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.shortcuts.redirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.shortcuts.redirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" - pattern: $A = django.shortcuts.redirect(..., request.$W(...), ...) - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...) - pattern: $A = django.shortcuts.redirect(..., $S % request.$W(...), ...) @@ -4192,96 +2636,17 @@ rules: - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.shortcuts.redirect(..., $S % request.$W[...], ...) - pattern: django.shortcuts.redirect(..., f"...{request.$W[...]}...", ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.shortcuts.redirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.shortcuts.redirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.shortcuts.redirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.shortcuts.redirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" - pattern: $A = django.shortcuts.redirect(..., request.$W[...], ...) - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...) - pattern: $A = django.shortcuts.redirect(..., $S % request.$W[...], ...) @@ -4294,96 +2659,17 @@ rules: - pattern: django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...) - pattern: django.shortcuts.redirect(..., $S % request.$W, ...) - pattern: django.shortcuts.redirect(..., f"...{request.$W}...", ...) - - pattern: '$DATA = request.$W - - ... - - django.shortcuts.redirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.shortcuts.redirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.shortcuts.redirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.shortcuts.redirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - django.shortcuts.redirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n" - pattern: $A = django.shortcuts.redirect(..., request.$W, ...) - pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...) - pattern: $A = django.shortcuts.redirect(..., $S % request.$W, ...) @@ -4396,96 +2682,20 @@ rules: - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...) - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W.get(...)}...", ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseRedirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseRedirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseRedirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" - pattern: $A = django.http.HttpResponseRedirect(..., request.$W.get(...), ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...) @@ -4498,96 +2708,20 @@ rules: - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.http.HttpResponseRedirect(..., $S % request.$W(...), ...) - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W(...)}...", ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseRedirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseRedirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseRedirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" - pattern: $A = django.http.HttpResponseRedirect(..., request.$W(...), ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W(...), ...) @@ -4600,96 +2734,20 @@ rules: - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.http.HttpResponseRedirect(..., $S % request.$W[...], ...) - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W[...]}...", ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseRedirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseRedirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseRedirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" - pattern: $A = django.http.HttpResponseRedirect(..., request.$W[...], ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W[...], ...) @@ -4702,96 +2760,18 @@ rules: - pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...) - pattern: django.http.HttpResponseRedirect(..., $S % request.$W, ...) - pattern: django.http.HttpResponseRedirect(..., f"...{request.$W}...", ...) - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseRedirect(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseRedirect(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseRedirect(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseRedirect(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n" - pattern: $A = django.http.HttpResponseRedirect(..., request.$W, ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...) - pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W, ...) @@ -4803,45 +2783,47 @@ rules: - metavariable-regex: metavariable: $W regex: (?!get_full_path) + severity: WARNING - id: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open - message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result - in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath - or the pathlib library. + languages: + - python + message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could + result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using + os.path.abspath or os.path.realpath or the pathlib library. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Path_Traversal - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open - shortlink: https://sg.run/W8qg semgrep.dev: rule: + origin: community r_id: 9509 - rv_id: 1263396 rule_id: oqUe7z + rv_id: 1263396 + url: + https://semgrep.dev/playground/r/JdTzxAw/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open version_id: JdTzxAw - url: https://semgrep.dev/playground/r/JdTzxAw/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/W8qg + source: + https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Path Traversal patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -4849,102 +2831,22 @@ rules: - pattern: open(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: open(..., $S % request.$W.get(...), ...) - pattern: open(..., f"...{request.$W.get(...)}...", ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - open(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W.get(...) - - ... - - open(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - open(..., $INTERM, ...) - - ' - - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...)\ - \ as $FD:\n ...\n" - - pattern: '$DATA = request.$W.get(...) - - ... - - open(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) + as $FD:\n ...\n" + - pattern: "$DATA = request.$W.get(...)\n...\nopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W.get(...) - - ... - - open(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n\ \ ...\n" - - pattern: '$DATA = request.$W.get(...) - - ... - - open(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - pattern: $A = open(..., request.$W.get(...), ...) - pattern: $A = open(..., $S.format(..., request.$W.get(...), ...), ...) @@ -4959,101 +2861,21 @@ rules: - pattern: open(..., $S.format(..., request.$W(...), ...), ...) - pattern: open(..., $S % request.$W(...), ...) - pattern: open(..., f"...{request.$W(...)}...", ...) - - pattern: '$DATA = request.$W(...) - - ... - - open(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W(...) - - ... - - open(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - open(..., $INTERM, ...) - - ' - - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as\ - \ $FD:\n ...\n" - - pattern: '$DATA = request.$W(...) - - ... - - open(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as + $FD:\n ...\n" + - pattern: "$DATA = request.$W(...)\n...\nopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W(...) - - ... - - open(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W(...) - - ... - - open(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - pattern: $A = open(..., request.$W(...), ...) - pattern: $A = open(..., $S.format(..., request.$W(...), ...), ...) @@ -5068,101 +2890,21 @@ rules: - pattern: open(..., $S.format(..., request.$W[...], ...), ...) - pattern: open(..., $S % request.$W[...], ...) - pattern: open(..., f"...{request.$W[...]}...", ...) - - pattern: '$DATA = request.$W[...] - - ... - - open(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W[...] - - ... - - open(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - open(..., $INTERM, ...) - - ' - - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as\ - \ $FD:\n ...\n" - - pattern: '$DATA = request.$W[...] - - ... - - open(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as + $FD:\n ...\n" + - pattern: "$DATA = request.$W[...]\n...\nopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W[...] - - ... - - open(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W[...] - - ... - - open(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - pattern: $A = open(..., request.$W[...], ...) - pattern: $A = open(..., $S.format(..., request.$W[...], ...), ...) @@ -5177,101 +2919,21 @@ rules: - pattern: open(..., $S.format(..., request.$W, ...), ...) - pattern: open(..., $S % request.$W, ...) - pattern: open(..., f"...{request.$W}...", ...) - - pattern: '$DATA = request.$W - - ... - - open(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W - - ... - - open(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as $FD:\n\ \ ...\n" - - pattern: '$DATA = request.$W - - ... - - open(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W - - ... - - open(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - - pattern: '$DATA = request.$W - - ... - - open(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - open(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n" - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n ...\n" - pattern: $A = open(..., request.$W, ...) - pattern: $A = open(..., $S.format(..., request.$W, ...), ...) @@ -5282,54 +2944,50 @@ rules: - pattern: return open(..., $S % request.$W, ...) - pattern: return open(..., f"...{request.$W}...", ...) - pattern: "$DATA = request.$W\n...\nwith open(..., $DATA, ...) as $FD:\n ...\n" + severity: WARNING - id: python.django.security.injection.raw-html-format.raw-html-format languages: - python - severity: WARNING - message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods - of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could - let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use - templates (`django.shortcuts.render`) which will safely render HTML instead. + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure + methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, + which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered + safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - django references: - https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render - https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format - shortlink: https://sg.run/oYj1 semgrep.dev: rule: + origin: community r_id: 14360 - rv_id: 1263397 rule_id: 2ZUPER - version_id: 5PTo100 + rv_id: 1263397 url: https://semgrep.dev/playground/r/5PTo100/python.django.security.injection.raw-html-format.raw-html-format - origin: community + version_id: 5PTo100 + shortlink: https://sg.run/oYj1 + source: https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint pattern-sanitizers: - pattern: django.utils.html.escape(...) - pattern-sources: - - patterns: - - pattern: request.$ANYTHING - - pattern-not: request.build_absolute_uri pattern-sinks: - patterns: - pattern-either: @@ -5340,57 +2998,60 @@ rules: - pattern: '"$HTMLSTR" + ...' - pattern: f"$HTMLSTR{...}..." - patterns: - - pattern-inside: '$HTML = "$HTMLSTR" - - ... - - ' + - pattern-inside: "$HTML = \"$HTMLSTR\"\n...\n" - pattern-either: - pattern: $HTML % ... - pattern: $HTML.format(...) - pattern: $HTML + ... - metavariable-pattern: - metavariable: $HTMLSTR language: generic + metavariable: $HTMLSTR pattern: <$TAG ... + pattern-sources: + - patterns: + - pattern: request.$ANYTHING + - pattern-not: request.build_absolute_uri + severity: WARNING - id: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse - message: Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers - gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed. + languages: + - python + message: Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to + attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped + or sanitzed. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse - shortlink: https://sg.run/BkvA semgrep.dev: rule: + origin: community r_id: 9495 - rv_id: 1263398 rule_id: JDUydR + rv_id: 1263398 + url: + https://semgrep.dev/playground/r/GxTke5K/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse version_id: GxTke5K - url: https://semgrep.dev/playground/r/GxTke5K/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/BkvA + source: + https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Cross-Site-Scripting (XSS) patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -5398,436 +3059,113 @@ rules: - pattern: django.http.HttpResponse(..., $S % request.$W.get(...), ...) - pattern: django.http.HttpResponse(..., f"...{request.$W.get(...)}...", ...) - pattern: django.http.HttpResponse(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponse(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponse(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponse(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponse(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" - pattern: $A = django.http.HttpResponse(..., request.$W.get(...), ...) - pattern: return django.http.HttpResponse(..., request.$W.get(...), ...) - pattern: django.http.HttpResponse(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.http.HttpResponse(..., $S % request.$W(...), ...) - pattern: django.http.HttpResponse(..., f"...{request.$W(...)}...", ...) - pattern: django.http.HttpResponse(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponse(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponse(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponse(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponse(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" - pattern: $A = django.http.HttpResponse(..., request.$W(...), ...) - pattern: return django.http.HttpResponse(..., request.$W(...), ...) - pattern: django.http.HttpResponse(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.http.HttpResponse(..., $S % request.$W[...], ...) - pattern: django.http.HttpResponse(..., f"...{request.$W[...]}...", ...) - pattern: django.http.HttpResponse(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponse(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponse(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponse(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponse(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" - pattern: $A = django.http.HttpResponse(..., request.$W[...], ...) - pattern: return django.http.HttpResponse(..., request.$W[...], ...) - pattern: django.http.HttpResponse(..., $S.format(..., request.$W, ...), ...) - pattern: django.http.HttpResponse(..., $S % request.$W, ...) - pattern: django.http.HttpResponse(..., f"...{request.$W}...", ...) - pattern: django.http.HttpResponse(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponse(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponse(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponse(..., f"...{$DATA}...", ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n" - pattern: $A = django.http.HttpResponse(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - $A = django.http.HttpResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$A = django.http.HttpResponse(..., $INTERM, ...)\n" - pattern: return django.http.HttpResponse(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponse(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n" + severity: WARNING - id: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest - message: Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading - to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped - or sanitzed. + languages: + - python + message: Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, + leading to attackers gaining access to user cookies and protected information. Ensure that the request data is + properly escaped or sanitzed. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest - shortlink: https://sg.run/DoZP semgrep.dev: rule: + origin: community r_id: 9496 - rv_id: 1263399 rule_id: 5rUOX1 + rv_id: 1263399 + url: + https://semgrep.dev/playground/r/RGT0LY6/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest version_id: RGT0LY6 - url: https://semgrep.dev/playground/r/RGT0LY6/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/DoZP + source: + https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Cross-Site-Scripting (XSS) patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -5835,888 +3173,269 @@ rules: - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W.get(...), ...) - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W.get(...)}...", ...) - pattern: django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseBadRequest(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) - pattern: return django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W(...), ...) - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W(...)}...", ...) - pattern: django.http.HttpResponseBadRequest(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseBadRequest(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W(...), ...) - pattern: return django.http.HttpResponseBadRequest(..., request.$W(...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W[...], ...) - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W[...]}...", ...) - pattern: django.http.HttpResponseBadRequest(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseBadRequest(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W[...], ...) - pattern: return django.http.HttpResponseBadRequest(..., request.$W[...], ...) - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W, ...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W, ...) - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W}...", ...) - pattern: django.http.HttpResponseBadRequest(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseBadRequest(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - django.http.HttpResponseBadRequest(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n" - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W, ...) - pattern: return django.http.HttpResponseBadRequest(..., request.$W, ...) + severity: WARNING - id: python.django.security.injection.request-data-fileresponse.request-data-fileresponse - message: Found user-controlled request data being passed into a file open, which is them passed as an argument into the - FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking - important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse. + languages: + - python + message: Found user-controlled request data being passed into a file open, which is them passed as an argument into + the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result + in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before + using it in FileResponse. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse - shortlink: https://sg.run/W862 semgrep.dev: rule: + origin: community r_id: 9497 - rv_id: 1263400 rule_id: GdU7QR + rv_id: 1263400 + url: + https://semgrep.dev/playground/r/A8Tgd1K/python.django.security.injection.request-data-fileresponse.request-data-fileresponse version_id: A8Tgd1K - url: https://semgrep.dev/playground/r/A8Tgd1K/python.django.security.injection.request-data-fileresponse.request-data-fileresponse - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/W862 + source: https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Path Traversal patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: - pattern: django.http.FileResponse(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.http.FileResponse(..., open($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = open($DATA, ...) - - ... - - django.http.FileResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, + ...)\n" - pattern: $A = django.http.FileResponse(..., request.$W.get(...), ...) - pattern: return django.http.FileResponse(..., request.$W.get(...), ...) - pattern: django.http.FileResponse(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.http.FileResponse(..., open($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = open($DATA, ...) - - ... - - django.http.FileResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n" - pattern: $A = django.http.FileResponse(..., request.$W(...), ...) - pattern: return django.http.FileResponse(..., request.$W(...), ...) - pattern: django.http.FileResponse(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.http.FileResponse(..., open($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = open($DATA, ...) - - ... - - django.http.FileResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n" - pattern: $A = django.http.FileResponse(..., request.$W[...], ...) - pattern: return django.http.FileResponse(..., request.$W[...], ...) - pattern: django.http.FileResponse(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - django.http.FileResponse(..., open($DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = open($DATA, ...) - - ... - - django.http.FileResponse(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n" - pattern: $A = django.http.FileResponse(..., request.$W, ...) - pattern: return django.http.FileResponse(..., request.$W, ...) + severity: WARNING - id: python.django.security.injection.request-data-write.request-data-write - message: Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able - to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause - a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized. + languages: + - python + message: Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is + able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, + or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped + or sanitized. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-93: Improper Neutralization of CRLF Sequences (''CRLF Injection'')' + - "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - django references: - https://owasp.org/Top10/A03_2021-Injection - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write - shortlink: https://sg.run/0Q6j semgrep.dev: rule: + origin: community r_id: 9498 - rv_id: 1263401 rule_id: ReUg5z + rv_id: 1263401 + url: + https://semgrep.dev/playground/r/BjTkZO5/python.django.security.injection.request-data-write.request-data-write version_id: BjTkZO5 - url: https://semgrep.dev/playground/r/BjTkZO5/python.django.security.injection.request-data-write.request-data-write - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/0Q6j + source: https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Improper Validation pattern-either: - pattern: $F.write(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $F.write(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $F.write(..., $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $F.write(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $F.write(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $F.write(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\n$F.write(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$F.write(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n" - pattern: $A = $F.write(..., request.$W.get(...), ...) - pattern: return $F.write(..., request.$W.get(...), ...) - pattern: $F.write(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - $F.write(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $F.write(..., $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $F.write(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $F.write(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $F.write(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\n$F.write(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$F.write(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n" - pattern: $A = $F.write(..., request.$W(...), ...) - pattern: return $F.write(..., request.$W(...), ...) - pattern: $F.write(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - $F.write(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $F.write(..., $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $F.write(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $F.write(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $F.write(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\n$F.write(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$F.write(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n" - pattern: $A = $F.write(..., request.$W[...], ...) - pattern: return $F.write(..., request.$W[...], ...) - pattern: $F.write(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - $F.write(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $F.write(..., $B.$C(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $B.$C(..., $DATA, ...) - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $F.write(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - $F.write(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $F.write(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $F.write(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\n$F.write(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$F.write(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n" - pattern: $A = $F.write(..., request.$W, ...) - pattern: return $F.write(..., request.$W, ...) + severity: WARNING - id: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where - message: User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected - information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and - not using quote placeholders in the SQL string. + languages: + - python + message: User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore + protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by + using `params` and not using quote placeholders in the SQL string. metadata: - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where - shortlink: https://sg.run/0Ql5 + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra semgrep.dev: rule: + origin: community r_id: 9510 - rv_id: 1263402 rule_id: zdUkx1 + rv_id: 1263402 + url: + https://semgrep.dev/playground/r/DkTRb4l/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where version_id: DkTRb4l - url: https://semgrep.dev/playground/r/DkTRb4l/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/0Ql5 + source: + https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where + subcategory: + - vuln + technology: + - django + vulnerability_class: + - SQL Injection patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -6724,497 +3443,136 @@ rules: - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W.get(...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W.get(...)}...", ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) - pattern: return $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W(...), ...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W(...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W(...)}...", ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) - pattern: return $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W[...], ...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W[...], ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W[...]}...", ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) - pattern: return $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W, ...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W, ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W}...", ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], + ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], + ...)\n" - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) - pattern: return $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., + $INTERM, ...], ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, + ...], ...)\n" + severity: WARNING - id: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql - message: User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected - information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and - not using quote placeholders in the SQL string. + languages: + - python + message: User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore + protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by + using `params` and not using quote placeholders in the SQL string. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql - shortlink: https://sg.run/Kl4X semgrep.dev: rule: + origin: community r_id: 9511 - rv_id: 1263403 rule_id: pKUOBp + rv_id: 1263403 + url: + https://semgrep.dev/playground/r/WrTqK2L/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql version_id: WrTqK2L - url: https://semgrep.dev/playground/r/WrTqK2L/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/Kl4X + source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql + subcategory: + - vuln + technology: + - django + vulnerability_class: + - SQL Injection patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -7222,497 +3580,135 @@ rules: - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W.get(...), ...) - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W.get(...)}...", ...) - pattern: django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.db.models.expressions.RawSQL(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) - pattern: return django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W(...), ...) - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W(...)}...", ...) - pattern: django.db.models.expressions.RawSQL(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - django.db.models.expressions.RawSQL(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W(...), ...) - pattern: return django.db.models.expressions.RawSQL(..., request.$W(...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W[...], ...) - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W[...]}...", ...) - pattern: django.db.models.expressions.RawSQL(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - django.db.models.expressions.RawSQL(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W[...], ...) - pattern: return django.db.models.expressions.RawSQL(..., request.$W[...], ...) - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W, ...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W, ...) - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W}...", ...) - pattern: django.db.models.expressions.RawSQL(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - django.db.models.expressions.RawSQL(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - django.db.models.expressions.RawSQL(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n" - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W, ...) - pattern: return django.db.models.expressions.RawSQL(..., request.$W, ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL($INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL($INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL($INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - django.db.models.expressions.RawSQL($INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, + ...)\n" + severity: WARNING - id: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute - message: User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore - protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and - therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`. + languages: + - python + message: User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and + therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query + parameterization and therefore not vulnerable to sql injection. For example, you could use + `Entry.objects.filter(date=2006)`. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute - shortlink: https://sg.run/qx7y semgrep.dev: rule: + origin: community r_id: 9512 - rv_id: 1263404 rule_id: 2ZUbDL + rv_id: 1263404 + url: + https://semgrep.dev/playground/r/0bTKzRj/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute version_id: 0bTKzRj - url: https://semgrep.dev/playground/r/0bTKzRj/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/qx7y + source: + https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute + subcategory: + - vuln + technology: + - django + vulnerability_class: + - SQL Injection patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -7720,495 +3716,116 @@ rules: - pattern: $CURSOR.execute(..., $S % request.$W.get(...), ...) - pattern: $CURSOR.execute(..., f"...{request.$W.get(...)}...", ...) - pattern: $CURSOR.execute(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $CURSOR.execute(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $CURSOR.execute(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $CURSOR.execute(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $CURSOR.execute(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" - pattern: $A = $CURSOR.execute(..., request.$W.get(...), ...) - pattern: return $CURSOR.execute(..., request.$W.get(...), ...) - pattern: $CURSOR.execute(..., $S.format(..., request.$W(...), ...), ...) - pattern: $CURSOR.execute(..., $S % request.$W(...), ...) - pattern: $CURSOR.execute(..., f"...{request.$W(...)}...", ...) - pattern: $CURSOR.execute(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - $CURSOR.execute(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $CURSOR.execute(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $CURSOR.execute(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $CURSOR.execute(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" - pattern: $A = $CURSOR.execute(..., request.$W(...), ...) - pattern: return $CURSOR.execute(..., request.$W(...), ...) - pattern: $CURSOR.execute(..., $S.format(..., request.$W[...], ...), ...) - pattern: $CURSOR.execute(..., $S % request.$W[...], ...) - pattern: $CURSOR.execute(..., f"...{request.$W[...]}...", ...) - pattern: $CURSOR.execute(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - $CURSOR.execute(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $CURSOR.execute(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $CURSOR.execute(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $CURSOR.execute(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" - pattern: $A = $CURSOR.execute(..., request.$W[...], ...) - pattern: return $CURSOR.execute(..., request.$W[...], ...) - pattern: $CURSOR.execute(..., $S.format(..., request.$W, ...), ...) - pattern: $CURSOR.execute(..., $S % request.$W, ...) - pattern: $CURSOR.execute(..., f"...{request.$W}...", ...) - pattern: $CURSOR.execute(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - $CURSOR.execute(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $CURSOR.execute(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $CURSOR.execute(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $CURSOR.execute(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - $CURSOR.execute(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\n$CURSOR.execute(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n" - pattern: $A = $CURSOR.execute(..., request.$W, ...) - pattern: return $CURSOR.execute(..., request.$W, ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $CURSOR.execute($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $CURSOR.execute($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $CURSOR.execute($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $CURSOR.execute($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $CURSOR.execute($INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $CURSOR.execute($INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $CURSOR.execute($INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $CURSOR.execute($INTERM, ...)' + - pattern: "$DATA = request.$W.get(...)\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)" + severity: WARNING - id: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw - message: Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection - and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization - and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`. + languages: + - python + message: Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL + injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built + with query parameterization and therefore not vulnerable to sql injection. For example, you could use + `Entry.objects.filter(date=2006)`. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw - shortlink: https://sg.run/l2v9 semgrep.dev: rule: + origin: community r_id: 9513 - rv_id: 1263405 rule_id: X5U8v5 + rv_id: 1263405 + url: + https://semgrep.dev/playground/r/K3TKkBW/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw version_id: K3TKkBW - url: https://semgrep.dev/playground/r/K3TKkBW/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/l2v9 + source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw + subcategory: + - vuln + technology: + - django + vulnerability_class: + - SQL Injection patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -8216,497 +3833,117 @@ rules: - pattern: $MODEL.objects.raw(..., $S % request.$W.get(...), ...) - pattern: $MODEL.objects.raw(..., f"...{request.$W.get(...)}...", ...) - pattern: $MODEL.objects.raw(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.raw(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.raw(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.raw(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.raw(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" - pattern: $A = $MODEL.objects.raw(..., request.$W.get(...), ...) - pattern: return $MODEL.objects.raw(..., request.$W.get(...), ...) - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W(...), ...), ...) - pattern: $MODEL.objects.raw(..., $S % request.$W(...), ...) - pattern: $MODEL.objects.raw(..., f"...{request.$W(...)}...", ...) - pattern: $MODEL.objects.raw(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.raw(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.raw(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.raw(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.raw(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" - pattern: $A = $MODEL.objects.raw(..., request.$W(...), ...) - pattern: return $MODEL.objects.raw(..., request.$W(...), ...) - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W[...], ...), ...) - pattern: $MODEL.objects.raw(..., $S % request.$W[...], ...) - pattern: $MODEL.objects.raw(..., f"...{request.$W[...]}...", ...) - pattern: $MODEL.objects.raw(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.raw(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.raw(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.raw(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.raw(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" - pattern: $A = $MODEL.objects.raw(..., request.$W[...], ...) - pattern: return $MODEL.objects.raw(..., request.$W[...], ...) - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W, ...), ...) - pattern: $MODEL.objects.raw(..., $S % request.$W, ...) - pattern: $MODEL.objects.raw(..., f"...{request.$W}...", ...) - pattern: $MODEL.objects.raw(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.raw(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.raw(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.raw(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.raw(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - $MODEL.objects.raw(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.raw(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n" - pattern: $A = $MODEL.objects.raw(..., request.$W, ...) - pattern: return $MODEL.objects.raw(..., request.$W, ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - $MODEL.objects.raw($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $MODEL.objects.raw($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $MODEL.objects.raw($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $MODEL.objects.raw($STR % (..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.raw($INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.raw($INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.raw($INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % (..., $DATA, ...) - - ... - - $MODEL.objects.raw($INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n" + severity: WARNING - id: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests - message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery - (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to - the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery - to learn more about SSRF vulnerabilities. + languages: + - python + message: Data from request object is passed to a new server-side request. This could lead to a server-side request + forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the + response to the user, and ensure proper authentication and transport-layer security in the proxied request. See + https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests - shortlink: https://sg.run/YvY4 semgrep.dev: rule: + origin: community r_id: 9514 - rv_id: 1263406 rule_id: j2UvEw + rv_id: 1263406 + url: + https://semgrep.dev/playground/r/qkTR7zn/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests version_id: qkTR7zn - url: https://semgrep.dev/playground/r/qkTR7zn/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests - origin: community - languages: - - python - severity: ERROR + shortlink: https://sg.run/YvY4 + source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Server-Side Request Forgery (SSRF) patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -8714,425 +3951,109 @@ rules: - pattern: requests.$METHOD(..., $S % request.$W.get(...), ...) - pattern: requests.$METHOD(..., f"...{request.$W.get(...)}...", ...) - pattern: requests.$METHOD(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - requests.$METHOD(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - requests.$METHOD(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - requests.$METHOD(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - requests.$METHOD(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" - pattern: $A = requests.$METHOD(..., request.$W.get(...), ...) - pattern: return requests.$METHOD(..., request.$W.get(...), ...) - pattern: requests.$METHOD(..., $S.format(..., request.$W(...), ...), ...) - pattern: requests.$METHOD(..., $S % request.$W(...), ...) - pattern: requests.$METHOD(..., f"...{request.$W(...)}...", ...) - pattern: requests.$METHOD(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - requests.$METHOD(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - requests.$METHOD(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - requests.$METHOD(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - requests.$METHOD(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" - pattern: $A = requests.$METHOD(..., request.$W(...), ...) - pattern: return requests.$METHOD(..., request.$W(...), ...) - pattern: requests.$METHOD(..., $S.format(..., request.$W[...], ...), ...) - pattern: requests.$METHOD(..., $S % request.$W[...], ...) - pattern: requests.$METHOD(..., f"...{request.$W[...]}...", ...) - pattern: requests.$METHOD(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - requests.$METHOD(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - requests.$METHOD(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - requests.$METHOD(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - requests.$METHOD(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" - pattern: $A = requests.$METHOD(..., request.$W[...], ...) - pattern: return requests.$METHOD(..., request.$W[...], ...) - pattern: requests.$METHOD(..., $S.format(..., request.$W, ...), ...) - pattern: requests.$METHOD(..., $S % request.$W, ...) - pattern: requests.$METHOD(..., f"...{request.$W}...", ...) - pattern: requests.$METHOD(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - requests.$METHOD(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - requests.$METHOD(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - requests.$METHOD(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - requests.$METHOD(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - requests.$METHOD(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nrequests.$METHOD(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n" - pattern: $A = requests.$METHOD(..., request.$W, ...) - pattern: return requests.$METHOD(..., request.$W, ...) + severity: ERROR - id: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib - message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery - (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes - and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication - and transport-layer security in the proxied request. + languages: + - python + message: Data from request object is passed to a new server-side request. This could lead to a server-side request + forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure + that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure + proper authentication and transport-layer security in the proxied request. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery - category: security - technology: - - django - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib - shortlink: https://sg.run/6n2B semgrep.dev: rule: + origin: community r_id: 9515 - rv_id: 1263407 rule_id: 10UKDo + rv_id: 1263407 + url: + https://semgrep.dev/playground/r/l4TJRwD/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib version_id: l4TJRwD - url: https://semgrep.dev/playground/r/l4TJRwD/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib - origin: community - languages: - - python - severity: ERROR + shortlink: https://sg.run/6n2B + source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Server-Side Request Forgery (SSRF) patterns: - pattern-inside: "def $FUNC(...):\n ...\n" - pattern-either: @@ -9140,760 +4061,410 @@ rules: - pattern: urllib.request.urlopen(..., $S % request.$W.get(...), ...) - pattern: urllib.request.urlopen(..., f"...{request.$W.get(...)}...", ...) - pattern: urllib.request.urlopen(..., request.$W.get(...), ...) - - pattern: '$DATA = request.$W.get(...) - - ... - - urllib.request.urlopen(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - urllib.request.urlopen(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR % $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - urllib.request.urlopen(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - urllib.request.urlopen(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W.get(...) - - ... - - $INTERM = $STR + $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., + $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" - pattern: $A = urllib.request.urlopen(..., request.$W.get(...), ...) - pattern: return urllib.request.urlopen(..., request.$W.get(...), ...) - pattern: urllib.request.urlopen(..., $S.format(..., request.$W(...), ...), ...) - pattern: urllib.request.urlopen(..., $S % request.$W(...), ...) - pattern: urllib.request.urlopen(..., f"...{request.$W(...)}...", ...) - pattern: urllib.request.urlopen(..., request.$W(...), ...) - - pattern: '$DATA = request.$W(...) - - ... - - urllib.request.urlopen(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - urllib.request.urlopen(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR % $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - urllib.request.urlopen(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = f"...{$DATA}..." - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - urllib.request.urlopen(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W(...) - - ... - - $INTERM = $STR + $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" - pattern: $A = urllib.request.urlopen(..., request.$W(...), ...) - pattern: return urllib.request.urlopen(..., request.$W(...), ...) - pattern: urllib.request.urlopen(..., $S.format(..., request.$W[...], ...), ...) - pattern: urllib.request.urlopen(..., $S % request.$W[...], ...) - pattern: urllib.request.urlopen(..., f"...{request.$W[...]}...", ...) - pattern: urllib.request.urlopen(..., request.$W[...], ...) - - pattern: '$DATA = request.$W[...] - - ... - - urllib.request.urlopen(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - urllib.request.urlopen(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR % $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - urllib.request.urlopen(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = f"...{$DATA}..." - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - urllib.request.urlopen(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W[...] - - ... - - $INTERM = $STR + $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" - pattern: $A = urllib.request.urlopen(..., request.$W[...], ...) - pattern: return urllib.request.urlopen(..., request.$W[...], ...) - pattern: urllib.request.urlopen(..., $S.format(..., request.$W, ...), ...) - pattern: urllib.request.urlopen(..., $S % request.$W, ...) - pattern: urllib.request.urlopen(..., f"...{request.$W}...", ...) - pattern: urllib.request.urlopen(..., request.$W, ...) - - pattern: '$DATA = request.$W - - ... - - urllib.request.urlopen(..., $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR.format(..., $DATA, ...) - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - urllib.request.urlopen(..., $STR % $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR % $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - urllib.request.urlopen(..., f"...{$DATA}...", ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = f"...{$DATA}..." - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - urllib.request.urlopen(..., $STR + $DATA, ...) - - ' - - pattern: '$DATA = request.$W - - ... - - $INTERM = $STR + $DATA - - ... - - urllib.request.urlopen(..., $INTERM, ...) - - ' + - pattern: "$DATA = request.$W\n...\nurllib.request.urlopen(..., $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, + ...)\n" + - pattern: "$DATA = request.$W\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" + - pattern: "$DATA = request.$W\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n" + - pattern: "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n" - pattern: $A = urllib.request.urlopen(..., request.$W, ...) - pattern: return urllib.request.urlopen(..., request.$W, ...) + severity: ERROR - id: python.django.security.nan-injection.nan-injection - message: Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject - Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. - Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'. languages: - python - severity: ERROR - mode: taint - pattern-sources: - - patterns: - - pattern-inside: "def $FUNC(request, ...):\n ...\n" - - pattern-either: - - pattern: request.$PROPERTY.get(...) - - pattern: request.$PROPERTY[...] - pattern-sinks: - - patterns: - - pattern-either: - - pattern: float(...) - - pattern: bool(...) - - pattern: complex(...) - - pattern-not-inside: "if $COND:\n ...\n...\n" - pattern-sanitizers: - - pattern: $ANYTHING(...) - not_conflicting: true + message: Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to + inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing + comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'. metadata: - references: - - https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868 - - https://blog.bitdiscovery.com/2021/12/python-nan-injection/ category: security + confidence: MEDIUM cwe: - 'CWE-704: Incorrect Type Conversion or Cast' - technology: - - django - subcategory: - - vuln impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/python.django.security.nan-injection.nan-injection - shortlink: https://sg.run/Og7L + likelihood: MEDIUM + references: + - https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868 + - https://blog.bitdiscovery.com/2021/12/python-nan-injection/ semgrep.dev: rule: + origin: community r_id: 18275 - rv_id: 946193 rule_id: DbUGvk - version_id: NdTqk7G + rv_id: 946193 url: https://semgrep.dev/playground/r/NdTqk7G/python.django.security.nan-injection.nan-injection - origin: community + version_id: NdTqk7G + shortlink: https://sg.run/Og7L + source: https://semgrep.dev/r/python.django.security.nan-injection.nan-injection + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Improper Validation + mode: taint + pattern-sanitizers: + - not_conflicting: true + pattern: $ANYTHING(...) + pattern-sinks: + - patterns: + - pattern-either: + - pattern: float(...) + - pattern: bool(...) + - pattern: complex(...) + - pattern-not-inside: "if $COND:\n ...\n...\n" + pattern-sources: + - patterns: + - pattern-inside: "def $FUNC(request, ...):\n ...\n" + - pattern-either: + - pattern: request.$PROPERTY.get(...) + - pattern: request.$PROPERTY[...] + severity: ERROR - id: python.django.security.passwords.password-empty-string.password-empty-string - message: '''$VAR'' is the empty string and is being used to set the password on ''$MODEL''. If you meant to set an unusable - password, set the password to None or call ''set_unusable_password()''.' + languages: + - python + message: "'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable + password, set the password to None or call 'set_unusable_password()'." metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-521: Weak Password Requirements' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password - category: security - technology: - - django - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string - shortlink: https://sg.run/oxnR semgrep.dev: rule: + origin: community r_id: 9516 - rv_id: 1263411 rule_id: 9AU1jW + rv_id: 1263411 + url: + https://semgrep.dev/playground/r/GxTke5Q/python.django.security.passwords.password-empty-string.password-empty-string version_id: GxTke5Q - url: https://semgrep.dev/playground/r/GxTke5Q/python.django.security.passwords.password-empty-string.password-empty-string - origin: community + shortlink: https://sg.run/oxnR + source: https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Improper Authentication patterns: - pattern-either: - - pattern: '$MODEL.set_password($EMPTY) - - ... - - $MODEL.save() - - ' - - pattern: '$VAR = $EMPTY - - ... - - $MODEL.set_password($VAR) - - ... - - $MODEL.save() - - ' + - pattern: "$MODEL.set_password($EMPTY)\n...\n$MODEL.save()\n" + - pattern: "$VAR = $EMPTY\n...\n$MODEL.set_password($VAR)\n...\n$MODEL.save()\n" - metavariable-regex: metavariable: $EMPTY regex: (\'\'|\"\") + severity: ERROR +- fix: "None\n" + id: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default languages: - python - severity: ERROR -- id: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default - message: '''$VAR'' is using the empty string as its default and is being used to set the password on ''$MODEL''. If you - meant to set an unusable password, set the default value to ''None'' or call ''set_unusable_password()''.' + message: "'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant + to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'." metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-521: Weak Password Requirements' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password - category: security - technology: - - django - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default - shortlink: https://sg.run/zvBW semgrep.dev: rule: + origin: community r_id: 9517 - rv_id: 1263412 rule_id: yyUn6Z + rv_id: 1263412 + url: + https://semgrep.dev/playground/r/RGT0LYX/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default version_id: RGT0LYX - url: https://semgrep.dev/playground/r/RGT0LYX/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default - origin: community - languages: - - python - severity: ERROR + shortlink: https://sg.run/zvBW + source: + https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default + subcategory: + - vuln + technology: + - django + vulnerability_class: + - Improper Authentication patterns: - pattern-either: - - pattern: '$VAR = request.$W.get($X, $EMPTY) - - ... - - $MODEL.set_password($VAR) - - ... - - $MODEL.save(...) - - ' + - pattern: "$VAR = request.$W.get($X, $EMPTY)\n...\n$MODEL.set_password($VAR)\n...\n$MODEL.save(...)\n" - pattern: "def $F(..., $VAR=$EMPTY, ...):\n ...\n $MODEL.set_password($VAR)\n" - metavariable-pattern: metavariable: $EMPTY pattern: '""' - focus-metavariable: $EMPTY - fix: 'None - - ' + severity: ERROR - id: python.fastapi.security.wildcard-cors.wildcard-cors languages: - python message: CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided. - mode: taint - pattern-sources: - - pattern: '[..., "*", ...]' - pattern-sinks: - - patterns: - - pattern: "$APP.add_middleware(\n CORSMiddleware,\n allow_origins=$ORIGIN,\n ...);\n" - - focus-metavariable: $ORIGIN - severity: WARNING metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-942: Permissive Cross-domain Policy with Untrusted Domains' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - category: security - technology: - - python - - fastapi references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - https://cwe.mitre.org/data/definitions/942.html - likelihood: HIGH - impact: LOW - confidence: MEDIUM - vulnerability_class: - - Configuration - subcategory: - - vuln - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - source: https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors - shortlink: https://sg.run/KxApY semgrep.dev: rule: + origin: community r_id: 112311 - rv_id: 1263413 rule_id: lBU4JQ3 - version_id: A8Tgd1R + rv_id: 1263413 url: https://semgrep.dev/playground/r/A8Tgd1R/python.fastapi.security.wildcard-cors.wildcard-cors - origin: community + version_id: A8Tgd1R + shortlink: https://sg.run/KxApY + source: https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors + subcategory: + - vuln + technology: + - python + - fastapi + vulnerability_class: + - Configuration + mode: taint + pattern-sinks: + - patterns: + - pattern: "$APP.add_middleware(\n CORSMiddleware,\n allow_origins=$ORIGIN,\n ...);\n" + - focus-metavariable: $ORIGIN + pattern-sources: + - pattern: '[..., "*", ...]' + severity: WARNING - id: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host + languages: + - python message: Running flask app with host 0.0.0.0 could expose the server publicly. metadata: + category: security + confidence: HIGH cwe: - 'CWE-668: Exposure of Resource to Wrong Sphere' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - flask references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host - shortlink: https://sg.run/eLby semgrep.dev: rule: + origin: community r_id: 9532 - rv_id: 1263414 rule_id: L1Uy1n + rv_id: 1263414 + url: + https://semgrep.dev/playground/r/BjTkZOY/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host version_id: BjTkZOY - url: https://semgrep.dev/playground/r/BjTkZOY/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/eLby + source: https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Other pattern-either: - pattern: app.run(..., host="0.0.0.0", ...) - pattern: app.run(..., "0.0.0.0", ...) + severity: WARNING - id: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly - patterns: - - pattern-not-inside: "if __name__ == '__main__':\n ...\n" - - pattern-not-inside: "def $X(...):\n ...\n" - - pattern: app.run(...) - message: top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function + languages: + - python + message: top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a + function metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-668: Exposure of Resource to Wrong Sphere' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - flask references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly - shortlink: https://sg.run/vz5b semgrep.dev: rule: + origin: community r_id: 9533 - rv_id: 1263415 rule_id: 8GUjdX + rv_id: 1263415 + url: + https://semgrep.dev/playground/r/DkTRb4z/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly version_id: DkTRb4z - url: https://semgrep.dev/playground/r/DkTRb4z/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly - origin: community - languages: - - python + shortlink: https://sg.run/vz5b + source: https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Other + patterns: + - pattern-not-inside: "if __name__ == '__main__':\n ...\n" + - pattern-not-inside: "def $X(...):\n ...\n" + - pattern: app.run(...) severity: WARNING - id: python.flask.security.audit.debug-enabled.debug-enabled - patterns: - - pattern-inside: 'import flask - - ... - - ' - - pattern: $APP.run(..., debug=True, ...) - message: Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive - information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables. + languages: + - python + message: Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak + sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system + environment variables. metadata: + category: security + confidence: HIGH cwe: - 'CWE-489: Active Debug Code' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: A06:2017 - Security Misconfiguration references: - https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/ - category: security - technology: - - flask - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Active Debug Code - source: https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled - shortlink: https://sg.run/dKrd semgrep.dev: rule: + origin: community r_id: 9534 - rv_id: 946206 rule_id: gxU1bd - version_id: 8KTKjwR + rv_id: 946206 url: https://semgrep.dev/playground/r/8KTKjwR/python.flask.security.audit.debug-enabled.debug-enabled - origin: community + version_id: 8KTKjwR + shortlink: https://sg.run/dKrd + source: https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Active Debug Code + patterns: + - pattern-inside: "import flask\n...\n" + - pattern: $APP.run(..., debug=True, ...) severity: WARNING +- id: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string languages: - python -- id: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string - message: Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input - can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'. + message: Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user + input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - flask references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string - shortlink: https://sg.run/Zv6o semgrep.dev: rule: + origin: community r_id: 9535 - rv_id: 1263416 rule_id: QrUz49 + rv_id: 1263416 + url: + https://semgrep.dev/playground/r/WrTqKAz/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string version_id: WrTqKAz - url: https://semgrep.dev/playground/r/WrTqKAz/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/Zv6o + source: + https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint - pattern-sources: - - pattern-either: - - patterns: - - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $PARAM, ...):\n ...\n" - - pattern: $PARAM - - pattern: 'request.$FUNC.get(...) - - ' - - pattern: 'request.$FUNC(...) - - ' - - pattern: request.$FUNC[...] pattern-sinks: - patterns: - pattern-not-inside: return "..." @@ -9906,122 +4477,105 @@ rules: - patterns: - pattern: return $X - pattern-either: - - pattern-inside: '$X = "...".format(...) - - ... - - ' - - pattern-inside: '$X = "..." % ... - - ... - - ' - - pattern-inside: '$X = "..." + ... - - ... - - ' - - pattern-inside: '$X = ... + "..." - - ... - - ' - - pattern-inside: '$X = f"...{...}..." - - ... - - ' - - pattern-not-inside: '$X = "..." - - ... - - ' + - pattern-inside: "$X = \"...\".format(...)\n...\n" + - pattern-inside: "$X = \"...\" % ...\n...\n" + - pattern-inside: "$X = \"...\" + ...\n...\n" + - pattern-inside: "$X = ... + \"...\"\n...\n" + - pattern-inside: "$X = f\"...{...}...\"\n...\n" + - pattern-not-inside: "$X = \"...\"\n...\n" + pattern-sources: + - pattern-either: + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $PARAM, ...):\n ...\n" + - pattern: $PARAM + - pattern: "request.$FUNC.get(...)\n" + - pattern: "request.$FUNC(...)\n" + - pattern: request.$FUNC[...] + severity: WARNING - id: python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true - message: Function `flask.url_for` with `_external=True` argument will generate URLs using the `Host` header of the HTTP - request, which may lead to security risks such as Host header injection + languages: + - python + message: Function `flask.url_for` with `_external=True` argument will generate URLs using the `Host` header of the + HTTP request, which may lead to security risks such as Host header injection metadata: + category: security + confidence: HIGH cwe: - 'CWE-673: External Influence of Sphere Definition' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - flask references: - https://flask.palletsprojects.com/en/latest/api/#flask.url_for - https://portswigger.net/kb/issues/00500300_host-header-injection - subcategory: - - audit - likelihood: MEDIUM - impact: LOW - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true - shortlink: https://sg.run/gEGeR semgrep.dev: rule: + origin: community r_id: 191541 - rv_id: 1263418 rule_id: JDU5oql + rv_id: 1263418 + url: + https://semgrep.dev/playground/r/K3TKk6n/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true version_id: K3TKk6n - url: https://semgrep.dev/playground/r/K3TKk6n/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true - origin: community - languages: - - python - severity: WARNING + shortlink: https://sg.run/gEGeR + source: https://semgrep.dev/r/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true + subcategory: + - audit + technology: + - flask + vulnerability_class: + - Other patterns: - pattern-not: flask.url_for(..., _external=False, ...) - pattern-not: url_for(..., _external=False, ...) - pattern-either: - pattern: flask.url_for(..., _external=$VAR, ...) - pattern: url_for(..., _external=$VAR, ...) + severity: WARNING - id: python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret languages: - python - message: The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, - the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through - the HashIDs. + message: The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient + HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by + attackers, through the HashIDs. metadata: category: security - subcategory: - - vuln + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A02:2021 – Cryptographic Failures references: - https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY - http://carnage.github.io/2015/08/cryptanalysis-of-hashids - technology: - - flask - likelihood: LOW - impact: HIGH - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret - shortlink: https://sg.run/N0Rx semgrep.dev: rule: + origin: community r_id: 72427 - rv_id: 946220 rule_id: KxUX3z + rv_id: 946220 + url: + https://semgrep.dev/playground/r/0bT15Px/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret version_id: 0bT15Px - url: https://semgrep.dev/playground/r/0bT15Px/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret - origin: community + shortlink: https://sg.run/N0Rx + source: https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: hashids.Hashids(..., salt=flask.current_app.config['SECRET_KEY'], ...) - pattern: hashids.Hashids(flask.current_app.config['SECRET_KEY'], ...) - patterns: - - pattern-inside: '$APP = flask.Flask(...) - - ... - - ' + - pattern-inside: "$APP = flask.Flask(...)\n...\n" - pattern-either: - pattern: hashids.Hashids(..., salt=$APP.config['SECRET_KEY'], ...) - pattern: hashids.Hashids($APP.config['SECRET_KEY'], ...) @@ -10029,16 +4583,19 @@ rules: - id: python.flask.security.injection.csv-writer-injection.csv-writer-injection languages: - python - message: Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate - the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet - application that runs an attacker script, which could steal data from the importing user or, at worst, install malware - on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula - injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs. + message: Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to + generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into + a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, + install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to + mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs. metadata: category: security confidence: MEDIUM cwe: - 'CWE-1236: Improper Neutralization of Formula Elements in a CSV File' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -10047,38 +4604,28 @@ rules: - https://github.com/raphaelm/defusedcsv - https://owasp.org/www-community/attacks/CSV_Injection - https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities - technology: - - python - - flask - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/python.flask.security.injection.csv-writer-injection.csv-writer-injection - shortlink: https://sg.run/JzqQ semgrep.dev: rule: + origin: community r_id: 31146 - rv_id: 1263428 rule_id: L1UR2K + rv_id: 1263428 + url: + https://semgrep.dev/playground/r/jQTn50Y/python.flask.security.injection.csv-writer-injection.csv-writer-injection version_id: jQTn50Y - url: https://semgrep.dev/playground/r/jQTn50Y/python.flask.security.injection.csv-writer-injection.csv-writer-injection - origin: community + shortlink: https://sg.run/JzqQ + source: https://semgrep.dev/r/python.flask.security.injection.csv-writer-injection.csv-writer-injection + subcategory: + - vuln + technology: + - python + - flask + vulnerability_class: + - Improper Validation mode: taint pattern-sinks: - patterns: - - pattern-inside: '$WRITER = csv.writer(...) - - - ... - - - $WRITER.$WRITE(...) - - ' + - pattern-inside: "$WRITER = csv.writer(...)\n\n...\n\n$WRITER.$WRITE(...)\n" - pattern: $WRITER.$WRITE(...) - metavariable-regex: metavariable: $WRITE @@ -10111,99 +4658,99 @@ rules: - focus-metavariable: $ROUTEVAR severity: ERROR - id: python.flask.security.injection.nan-injection.nan-injection - message: Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject - Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. - Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'. languages: - python - severity: ERROR - mode: taint - pattern-sources: - - pattern-either: - - pattern: flask.request.$SOMETHING.get(...) - - pattern: flask.request.$SOMETHING[...] - - patterns: - - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" - - pattern: $ROUTEVAR - pattern-sinks: - - pattern-either: - - pattern: float(...) - - pattern: bool(...) - - pattern: complex(...) - pattern-sanitizers: - - not_conflicting: true - pattern: $ANYTHING(...) + message: Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to + inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing + comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'. metadata: - references: - - https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868 - - https://blog.bitdiscovery.com/2021/12/python-nan-injection/ category: security + confidence: MEDIUM cwe: - 'CWE-704: Incorrect Type Conversion or Cast' - technology: - - flask - subcategory: - - vuln impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection - shortlink: https://sg.run/e598 + likelihood: MEDIUM + references: + - https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868 + - https://blog.bitdiscovery.com/2021/12/python-nan-injection/ semgrep.dev: rule: + origin: community r_id: 18276 - rv_id: 946222 rule_id: WAUdj7 - version_id: qkT4j85 + rv_id: 946222 url: https://semgrep.dev/playground/r/qkT4j85/python.flask.security.injection.nan-injection.nan-injection - origin: community + version_id: qkT4j85 + shortlink: https://sg.run/e598 + source: https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Improper Validation + mode: taint + pattern-sanitizers: + - not_conflicting: true + pattern: $ANYTHING(...) + pattern-sinks: + - pattern-either: + - pattern: float(...) + - pattern: bool(...) + - pattern: complex(...) + pattern-sources: + - pattern-either: + - pattern: flask.request.$SOMETHING.get(...) + - pattern: flask.request.$SOMETHING[...] + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - pattern: $ROUTEVAR + severity: ERROR - id: python.flask.security.injection.os-system-injection.os-system-injection languages: - python - severity: ERROR - message: User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this - must be done, use the 'subprocess' module instead and pass the arguments as a list. + message: User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If + this must be done, use the 'subprocess' module instead and pass the arguments as a list. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/www-community/attacks/Command_Injection - category: security - technology: - - flask - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection - shortlink: https://sg.run/4xzz semgrep.dev: rule: + origin: community r_id: 9544 - rv_id: 1263429 rule_id: BYUN99 + rv_id: 1263429 + url: + https://semgrep.dev/playground/r/1QTypw7/python.flask.security.injection.os-system-injection.os-system-injection version_id: 1QTypw7 - url: https://semgrep.dev/playground/r/1QTypw7/python.flask.security.injection.os-system-injection.os-system-injection - origin: community + shortlink: https://sg.run/4xzz + source: https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection + subcategory: + - audit + technology: + - flask + vulnerability_class: + - Command Injection pattern-either: - patterns: - pattern: os.system(...) - pattern-either: - - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n os.system(..., <... $ROUTEVAR\ - \ ...>, ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n os.system(..., <... $ROUTEVAR + ...>, ...)\n" - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ \ ...\n os.system(..., <... $INTERM ...>, ...)\n" - pattern: os.system(..., <... flask.request.$W.get(...) ...>, ...) @@ -10211,87 +4758,64 @@ rules: - pattern: os.system(..., <... flask.request.$W(...) ...>, ...) - pattern: os.system(..., <... flask.request.$W ...>, ...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> - - ... - - os.system(<... $INTERM ...>) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\nos.system(<... $INTERM ...>)\n" - pattern: os.system(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> - - ... - - os.system(<... $INTERM ...>) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W[...] ...>\n...\nos.system(<... $INTERM ...>)\n" - pattern: os.system(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> - - ... - - os.system(<... $INTERM ...>) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W(...) ...>\n...\nos.system(<... $INTERM ...>)\n" - pattern: os.system(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W ...> - - ... - - os.system(<... $INTERM ...>) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\nos.system(<... $INTERM ...>)\n" - pattern: os.system(...) + severity: ERROR - id: python.flask.security.injection.path-traversal-open.path-traversal-open languages: - python - severity: ERROR - message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result - in path traversal attacks. + message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could + result in path traversal attacks. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Path_Traversal - category: security - technology: - - flask - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open - shortlink: https://sg.run/PJRW semgrep.dev: rule: + origin: community r_id: 9545 - rv_id: 1263430 rule_id: DbUpOQ + rv_id: 1263430 + url: + https://semgrep.dev/playground/r/9lT4b94/python.flask.security.injection.path-traversal-open.path-traversal-open version_id: 9lT4b94 - url: https://semgrep.dev/playground/r/9lT4b94/python.flask.security.injection.path-traversal-open.path-traversal-open - origin: community + shortlink: https://sg.run/PJRW + source: https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open + subcategory: + - audit + technology: + - flask + vulnerability_class: + - Path Traversal pattern-either: - patterns: - pattern: open(...) - pattern-either: - - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n open(..., <... $ROUTEVAR ...>,\ - \ ...)\n" - - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n with open(..., <... $ROUTEVAR\ - \ ...>, ...) as $FD:\n ...\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n open(..., <... $ROUTEVAR ...>, + ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n with open(..., <... $ROUTEVAR + ...>, ...) as $FD:\n ...\n" - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ \ ...\n open(..., <... $INTERM ...>, ...)\n" - pattern: open(..., <... flask.request.$W.get(...) ...>, ...) @@ -10299,40 +4823,16 @@ rules: - pattern: open(..., <... flask.request.$W(...) ...>, ...) - pattern: open(..., <... flask.request.$W ...>, ...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> - - ... - - open(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\nopen(<... $INTERM ...>, ...)\n" - pattern: open(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> - - ... - - open(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W[...] ...>\n...\nopen(<... $INTERM ...>, ...)\n" - pattern: open(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> - - ... - - open(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W(...) ...>\n...\nopen(<... $INTERM ...>, ...)\n" - pattern: open(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W ...> - - ... - - open(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\nopen(<... $INTERM ...>, ...)\n" - pattern: open(...) - patterns: - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n ...\n" @@ -10346,46 +4846,46 @@ rules: - patterns: - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n ...\n" - pattern: open(...) + severity: ERROR - id: python.flask.security.injection.raw-html-concat.raw-html-format languages: - python - severity: WARNING - message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods - of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could - let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use - templates (`flask.render_template`) which will safely render HTML instead. + message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure + methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, + which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered + safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - flask references: - https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format - shortlink: https://sg.run/Pb7e semgrep.dev: rule: + origin: community r_id: 14389 - rv_id: 1409401 rule_id: GdUrJv - version_id: RGTEN1l + rv_id: 1409401 url: https://semgrep.dev/playground/r/RGTEN1l/python.flask.security.injection.raw-html-concat.raw-html-format - origin: community + version_id: RGTEN1l + shortlink: https://sg.run/Pb7e + source: https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint pattern-sanitizers: - pattern: jinja2.escape(...) @@ -10395,13 +4895,6 @@ rules: - metavariable-regex: metavariable: $TPL regex: .*\.html - pattern-sources: - - patterns: - - pattern-either: - - pattern: flask.request.$ANYTHING - - patterns: - - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" - - pattern: $ROUTEVAR pattern-sinks: - patterns: - pattern-either: @@ -10412,65 +4905,68 @@ rules: - pattern: '"$HTMLSTR" + ...' - pattern: f"$HTMLSTR{...}..." - patterns: - - pattern-inside: '$HTML = "$HTMLSTR" - - ... - - ' + - pattern-inside: "$HTML = \"$HTMLSTR\"\n...\n" - pattern-either: - pattern: $HTML % ... - pattern: $HTML.format(...) - pattern: $HTML + ... - metavariable-pattern: - metavariable: $HTMLSTR language: generic + metavariable: $HTMLSTR pattern: <$TAG ... + pattern-sources: + - patterns: + - pattern-either: + - pattern: flask.request.$ANYTHING + - patterns: + - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" + - pattern: $ROUTEVAR + severity: WARNING - id: python.flask.security.injection.ssrf-requests.ssrf-requests languages: - python - severity: ERROR - message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery - (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to - the user, and ensure proper authentication and transport-layer security in the proxied request. + message: Data from request object is passed to a new server-side request. This could lead to a server-side request + forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the + response to the user, and ensure proper authentication and transport-layer security in the proxied request. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery - category: security - technology: - - flask - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests - shortlink: https://sg.run/J9LW semgrep.dev: rule: + origin: community r_id: 9546 - rv_id: 1263432 rule_id: WAUoRx - version_id: rxTAKJn + rv_id: 1263432 url: https://semgrep.dev/playground/r/rxTAKJn/python.flask.security.injection.ssrf-requests.ssrf-requests - origin: community + version_id: rxTAKJn + shortlink: https://sg.run/J9LW + source: https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Server-Side Request Forgery (SSRF) pattern-either: - patterns: - pattern: requests.$FUNC(...) - pattern-either: - - pattern-inside: "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n ...\n requests.$FUNC(...,\ - \ <... $ROUTEVAR ...>, ...)\n" - - pattern-inside: "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <...\ - \ $ROUTEVAR ...>\n ...\n requests.$FUNC(..., <... $INTERM ...>, ...)\n" + - pattern-inside: "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n ...\n requests.$FUNC(..., + <... $ROUTEVAR ...>, ...)\n" + - pattern-inside: "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... + $ROUTEVAR ...>\n ...\n requests.$FUNC(..., <... $INTERM ...>, ...)\n" - metavariable-regex: metavariable: $ROUTE_METHOD regex: ^(route|get|post|put|delete|patch)$ @@ -10479,47 +4975,84 @@ rules: - pattern: requests.$FUNC(..., <... flask.request.$W(...) ...>, ...) - pattern: requests.$FUNC(..., <... flask.request.$W ...>, ...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> - - ... - - requests.$FUNC(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\nrequests.$FUNC(<... $INTERM ...>, ...)\n" - pattern: requests.$FUNC(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> - - ... - - requests.$FUNC(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W[...] ...>\n...\nrequests.$FUNC(<... $INTERM ...>, ...)\n" - pattern: requests.$FUNC(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> - - ... - - requests.$FUNC(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W(...) ...>\n...\nrequests.$FUNC(<... $INTERM ...>, ...)\n" - pattern: requests.$FUNC(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W ...> - - ... - - requests.$FUNC(<... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\nrequests.$FUNC(<... $INTERM ...>, ...)\n" - pattern: requests.$FUNC(...) + severity: ERROR - id: python.flask.security.injection.subprocess-injection.subprocess-injection languages: - python + message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection + vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them + to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the + command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a + dictionary to allowlist a set of commands. + metadata: + category: security + confidence: HIGH + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 31147 + rule_id: 8GU3qp + rv_id: 1263433 + url: + https://semgrep.dev/playground/r/bZT53gQ/python.flask.security.injection.subprocess-injection.subprocess-injection + version_id: bZT53gQ + shortlink: https://sg.run/5gW3 + source: https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sanitizers: + - patterns: + - pattern: $DICT[$KEY] + - focus-metavariable: $KEY + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern: subprocess.$FUNC(...) + - pattern-not: subprocess.$FUNC("...", ...) + - pattern-not: subprocess.$FUNC(["...", ...], ...) + - pattern-not-inside: "$CMD = [\"...\", ...]\n...\nsubprocess.$FUNC($CMD, ...)\n" + - patterns: + - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...) + - metavariable-regex: + metavariable: $SHELL + regex: ^(sh|bash|ksh|csh|tcsh|zsh)$ + - patterns: + - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...) + - metavariable-regex: + metavariable: $INTERPRETER + regex: ^(python|python\d)$ pattern-sources: - pattern-either: - patterns: @@ -10545,80 +5078,22 @@ rules: - patterns: - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" - focus-metavariable: $ROUTEVAR - pattern-sinks: - - patterns: - - pattern-either: - - patterns: - - pattern: subprocess.$FUNC(...) - - pattern-not: subprocess.$FUNC("...", ...) - - pattern-not: subprocess.$FUNC(["...", ...], ...) - - pattern-not-inside: '$CMD = ["...", ...] - - ... - - subprocess.$FUNC($CMD, ...) - - ' - - patterns: - - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...) - - metavariable-regex: - metavariable: $SHELL - regex: ^(sh|bash|ksh|csh|tcsh|zsh)$ - - patterns: - - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...) - - metavariable-regex: - metavariable: $INTERPRETER - regex: ^(python|python\d)$ - pattern-sanitizers: - - patterns: - - pattern: $DICT[$KEY] - - focus-metavariable: $KEY severity: ERROR - message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. - An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, - scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, - prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set - of commands. +- id: python.flask.security.injection.tainted-sql-string.tainted-sql-string + languages: + - python + message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual + construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify + contents of the database. Instead, use a parameterized query which is available by default in most database engines. + Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries. metadata: category: security - technology: - - flask - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - confidence: HIGH - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + - 'CWE-704: Incorrect Type Conversion or Cast' impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection - shortlink: https://sg.run/5gW3 - semgrep.dev: - rule: - r_id: 31147 - rv_id: 1263433 - rule_id: 8GU3qp - version_id: bZT53gQ - url: https://semgrep.dev/playground/r/bZT53gQ/python.flask.security.injection.subprocess-injection.subprocess-injection - origin: community -- id: python.flask.security.injection.tainted-sql-string.tainted-sql-string - message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction - could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the - database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider - using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries. - metadata: - cwe: - - 'CWE-704: Incorrect Type Conversion or Cast' + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection @@ -10627,32 +5102,35 @@ rules: - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql - https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column - category: security - technology: - - sqlalchemy - - flask - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string - shortlink: https://sg.run/JxZj semgrep.dev: rule: + origin: community r_id: 14702 - rv_id: 1409402 rule_id: YGUDKQ + rv_id: 1409402 + url: + https://semgrep.dev/playground/r/A8TEvb4/python.flask.security.injection.tainted-sql-string.tainted-sql-string version_id: A8TEvb4 - url: https://semgrep.dev/playground/r/A8TEvb4/python.flask.security.injection.tainted-sql-string.tainted-sql-string - origin: community - severity: ERROR - languages: - - python + shortlink: https://sg.run/JxZj + source: https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string + subcategory: + - vuln + technology: + - sqlalchemy + - flask + vulnerability_class: + - Improper Validation mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "\"$SQLSTR\" + ...\n" + - pattern: "\"$SQLSTR\" % ...\n" + - pattern: "\"$SQLSTR\".format(...)\n" + - pattern: "f\"$SQLSTR{...}...\"\n" + - metavariable-regex: + metavariable: $SQLSTR + regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.* pattern-sources: - patterns: - pattern-either: @@ -10660,63 +5138,46 @@ rules: - patterns: - pattern-inside: "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n" - pattern: $ROUTEVAR - pattern-sinks: - - patterns: - - pattern-either: - - pattern: '"$SQLSTR" + ... - - ' - - pattern: '"$SQLSTR" % ... - - ' - - pattern: '"$SQLSTR".format(...) - - ' - - pattern: 'f"$SQLSTR{...}..." - - ' - - metavariable-regex: - metavariable: $SQLSTR - regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.* + severity: ERROR - id: python.flask.security.injection.tainted-url-host.tainted-url-host languages: - python - message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data - to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. - They could also probe internal servers or other resources that the server running this code can access. (This is called - server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, - or hardcode the correct host. + message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send + data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with + this request. They could also probe internal servers or other resources that the server running this code can + access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an + allowlist for approved hosts, or hardcode the correct host. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html - category: security - technology: - - flask - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - impact: MEDIUM - likelihood: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Server-Side Request Forgery (SSRF) - source: https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host - shortlink: https://sg.run/RXpK semgrep.dev: rule: + origin: community r_id: 14649 - rv_id: 1409403 rule_id: ReU3Wb - version_id: BjTy42w + rv_id: 1409403 url: https://semgrep.dev/playground/r/BjTy42w/python.flask.security.injection.tainted-url-host.tainted-url-host - origin: community + version_id: BjTy42w + shortlink: https://sg.run/RXpK + source: https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Server-Side Request Forgery (SSRF) mode: taint pattern-sinks: - patterns: @@ -10724,8 +5185,8 @@ rules: - patterns: - pattern: '"$URLSTR" % ...' - metavariable-pattern: - metavariable: $URLSTR language: generic + metavariable: $URLSTR patterns: - pattern-either: - pattern: $SCHEME://%s @@ -10733,8 +5194,8 @@ rules: - patterns: - pattern: '"$URLSTR".format(...)' - metavariable-pattern: - metavariable: $URLSTR language: generic + metavariable: $URLSTR pattern: $SCHEME:// { ... } - patterns: - pattern: '"$URLSTR" + ...' @@ -10747,11 +5208,7 @@ rules: metavariable: $URLSTR regex: .*://$ - patterns: - - pattern-inside: '$URL = "$URLSTR" - - ... - - ' + - pattern-inside: "$URL = \"$URLSTR\"\n...\n" - pattern: $URL += ... - metavariable-regex: metavariable: $URLSTR @@ -10767,43 +5224,42 @@ rules: - id: python.flask.security.injection.user-eval.eval-injection languages: - python - severity: ERROR message: Detected user data flowing into eval. This is code injection and should be avoided. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html - category: security - technology: - - flask - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection - shortlink: https://sg.run/5QpX semgrep.dev: rule: + origin: community r_id: 9547 - rv_id: 1263436 rule_id: 0oU54W - version_id: w8TRoB0 + rv_id: 1263436 url: https://semgrep.dev/playground/r/w8TRoB0/python.flask.security.injection.user-eval.eval-injection - origin: community + version_id: w8TRoB0 + shortlink: https://sg.run/5QpX + source: https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Code Injection pattern-either: - patterns: - pattern: eval(...) - pattern-either: - - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n eval(..., <... $ROUTEVAR ...>,\ - \ ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n eval(..., <... $ROUTEVAR ...>, + ...)\n" - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ \ ...\n eval(..., <... $INTERM ...>, ...)\n" - pattern: eval(..., <... flask.request.$W.get(...) ...>, ...) @@ -10811,81 +5267,57 @@ rules: - pattern: eval(..., <... flask.request.$W(...) ...>, ...) - pattern: eval(..., <... flask.request.$W ...>, ...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> - - ... - - eval(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\neval(..., <... $INTERM ...>, ...)\n" - pattern: eval(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> - - ... - - eval(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W[...] ...>\n...\neval(..., <... $INTERM ...>, ...)\n" - pattern: eval(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> - - ... - - eval(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W(...) ...>\n...\neval(..., <... $INTERM ...>, ...)\n" - pattern: eval(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W ...> - - ... - - eval(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\neval(..., <... $INTERM ...>, ...)\n" - pattern: eval(...) + severity: ERROR - id: python.flask.security.injection.user-exec.exec-injection languages: - python - severity: ERROR message: Detected user data flowing into exec. This is code injection and should be avoided. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html - category: security - technology: - - flask - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection - shortlink: https://sg.run/Ge42 semgrep.dev: rule: + origin: community r_id: 9548 - rv_id: 1263437 rule_id: KxUbl2 - version_id: xyTjzD9 + rv_id: 1263437 url: https://semgrep.dev/playground/r/xyTjzD9/python.flask.security.injection.user-exec.exec-injection - origin: community + version_id: xyTjzD9 + shortlink: https://sg.run/Ge42 + source: https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection + subcategory: + - vuln + technology: + - flask + vulnerability_class: + - Code Injection pattern-either: - patterns: - pattern: exec(...) - pattern-either: - - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n exec(..., <... $ROUTEVAR ...>,\ - \ ...)\n" + - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n exec(..., <... $ROUTEVAR ...>, + ...)\n" - pattern-inside: "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n ...\n $INTERM = <... $ROUTEVAR ...>\n\ \ ...\n exec(..., <... $INTERM ...>, ...)\n" - pattern: exec(..., <... flask.request.$W.get(...) ...>, ...) @@ -10893,399 +5325,303 @@ rules: - pattern: exec(..., <... flask.request.$W(...) ...>, ...) - pattern: exec(..., <... flask.request.$W ...>, ...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W.get(...) ...> - - ... - - exec(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W.get(...) ...>\n...\nexec(..., <... $INTERM ...>, ...)\n" - pattern: exec(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W[...] ...> - - ... - - exec(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W[...] ...>\n...\nexec(..., <... $INTERM ...>, ...)\n" - pattern: exec(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W(...) ...> - - ... - - exec(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W(...) ...>\n...\nexec(..., <... $INTERM ...>, ...)\n" - pattern: exec(...) - patterns: - - pattern-inside: '$INTERM = <... flask.request.$W ...> - - ... - - exec(..., <... $INTERM ...>, ...) - - ' + - pattern-inside: "$INTERM = <... flask.request.$W ...>\n...\nexec(..., <... $INTERM ...>, ...)\n" - pattern: exec(...) -- id: python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled - patterns: - - pattern: jinja2.Environment(... , autoescape=$VAL, ...) - - pattern-not: jinja2.Environment(... , autoescape=True, ...) - - pattern-not: jinja2.Environment(... , autoescape=jinja2.select_autoescape(...), ...) - - focus-metavariable: $VAL - fix: 'True - - ' - message: Detected a Jinja2 environment with 'autoescaping' disabled. This is dangerous if you are rendering to a browser - because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable 'autoescaping' by setting - 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain - file extensions. + severity: ERROR +- fix: "True\n" + id: python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled + languages: + - python + message: Detected a Jinja2 environment with 'autoescaping' disabled. This is dangerous if you are rendering to a + browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable + 'autoescaping' by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable + automatic escaping for certain file extensions. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html + category: security + confidence: MEDIUM cwe: - 'CWE-116: Improper Encoding or Escaping of Output' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://jinja.palletsprojects.com/en/2.11.x/api/#basics - category: security - technology: - - jinja2 - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Encoding - source: https://semgrep.dev/r/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled - shortlink: https://sg.run/L2L7 semgrep.dev: rule: + origin: community r_id: 20039 - rv_id: 1263448 rule_id: QrU1Xg + rv_id: 1263448 + url: + https://semgrep.dev/playground/r/gETB7oN/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled version_id: gETB7oN - url: https://semgrep.dev/playground/r/gETB7oN/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled - origin: community - languages: - - python - severity: WARNING -- id: python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled + shortlink: https://sg.run/L2L7 + source: https://semgrep.dev/r/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html + subcategory: + - vuln + technology: + - jinja2 + vulnerability_class: + - Improper Encoding patterns: - - pattern-not: jinja2.Environment(..., autoescape=$VAL, ...) - - pattern: jinja2.Environment(...) - fix-regex: + - pattern: jinja2.Environment(... , autoescape=$VAL, ...) + - pattern-not: jinja2.Environment(... , autoescape=True, ...) + - pattern-not: jinja2.Environment(... , autoescape=jinja2.select_autoescape(...), ...) + - focus-metavariable: $VAL + severity: WARNING +- fix-regex: regex: (.*)\) replacement: \1, autoescape=True) - message: Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous if - you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, - enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable - automatic escaping for certain file extensions. + id: python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled + languages: + - python + message: Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous + if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web + context, enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' + to only enable automatic escaping for certain file extensions. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html + category: security + confidence: MEDIUM cwe: - 'CWE-116: Improper Encoding or Escaping of Output' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://jinja.palletsprojects.com/en/2.11.x/api/#basics - category: security - technology: - - jinja2 - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Encoding - source: https://semgrep.dev/r/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled - shortlink: https://sg.run/8kY4 semgrep.dev: rule: + origin: community r_id: 20040 - rv_id: 1263449 rule_id: 3qULRx + rv_id: 1263449 + url: + https://semgrep.dev/playground/r/QkTGqje/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled version_id: QkTGqje - url: https://semgrep.dev/playground/r/QkTGqje/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled - origin: community - languages: - - python + shortlink: https://sg.run/8kY4 + source: https://semgrep.dev/r/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html + subcategory: + - vuln + technology: + - jinja2 + vulnerability_class: + - Improper Encoding + patterns: + - pattern-not: jinja2.Environment(..., autoescape=$VAL, ...) + - pattern: jinja2.Environment(...) severity: WARNING - id: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret + languages: + - python message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' metadata: + category: security + confidence: HIGH cwe: - 'CWE-522: Insufficiently Protected Credentials' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design references: - https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - category: security - technology: - - jwt - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret - shortlink: https://sg.run/l2E9 semgrep.dev: rule: + origin: community r_id: 9557 - rv_id: 1263452 rule_id: X5U8P5 - version_id: PkTR3X3 + rv_id: 1263452 url: https://semgrep.dev/playground/r/PkTR3X3/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret - origin: community + version_id: PkTR3X3 + shortlink: https://sg.run/l2E9 + source: https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret + subcategory: + - vuln + technology: + - jwt + vulnerability_class: + - Cryptographic Issues patterns: - - pattern: 'jwt.encode($_, "...", ...) - - ' - languages: - - python + - pattern: "jwt.encode($_, \"...\", ...)\n" severity: ERROR - id: python.jwt.security.jwt-none-alg.jwt-python-none-alg - message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has - already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do - not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + languages: + - python + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token + has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be + verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - category: security - technology: - - jwt references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg - shortlink: https://sg.run/Yvp4 semgrep.dev: rule: + origin: community r_id: 9558 - rv_id: 1263453 rule_id: j2UvKw - version_id: JdTzxYj + rv_id: 1263453 url: https://semgrep.dev/playground/r/JdTzxYj/python.jwt.security.jwt-none-alg.jwt-python-none-alg - origin: community - languages: - - python - severity: ERROR + version_id: JdTzxYj + shortlink: https://sg.run/Yvp4 + source: https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - vuln + technology: + - jwt + vulnerability_class: + - Cryptographic Issues pattern-either: - - pattern: 'jwt.encode(...,algorithm="none",...) - - ' + - pattern: "jwt.encode(...,algorithm=\"none\",...)\n" - pattern: jwt.decode(...,algorithms=[...,"none",...],...) -- id: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode - patterns: - - pattern-either: - - patterns: - - pattern: 'jwt.decode(..., options={..., "verify_signature": $BOOL, ...}, ...) - - ' - - metavariable-pattern: - metavariable: $BOOL - pattern: 'False - - ' - - focus-metavariable: $BOOL - - patterns: - - pattern: '$OPTS = {..., "verify_signature": $BOOL, ...} - - ... - - jwt.decode(..., options=$OPTS, ...) - - ' - - metavariable-pattern: - metavariable: $BOOL - pattern: 'False - - ' - - focus-metavariable: $BOOL - message: Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the - token could be tampered with by malicious actors. Ensure that the JWT token is verified. + severity: ERROR +- fix: "True\n" + id: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode + languages: + - python + message: Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means + the token could be tampered with by malicious actors. Ensure that the JWT token is verified. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-287: Improper Authentication' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - cwe: - - 'CWE-287: Improper Authentication' references: - https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96 - category: security - technology: - - jwt - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode - shortlink: https://sg.run/6nyB semgrep.dev: rule: + origin: community r_id: 9559 - rv_id: 1263454 rule_id: 10UKjo - version_id: 5PTo12w + rv_id: 1263454 url: https://semgrep.dev/playground/r/5PTo12w/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode - origin: community - fix: 'True - - ' - severity: ERROR - languages: - - python -- id: python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args - mode: taint - options: - symbolic_propagation: true - pattern-sources: - - patterns: - - pattern-either: - - patterns: - - pattern-either: - - pattern: os.environ - - pattern: os.environ.get('$FOO', ...) - - pattern: os.environb - - pattern: os.environb.get('$FOO', ...) - - pattern: os.getenv('$ANYTHING', ...) - - pattern: os.getenvb('$ANYTHING', ...) - - patterns: - - pattern-either: - - patterns: - - pattern-either: - - pattern: sys.argv - - pattern: sys.orig_argv - - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' - - pattern: <... $ARGS ...> - - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' - - pattern: <... $ARGS ...> - - patterns: - - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' - - pattern-either: - - patterns: - - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - - pattern: $A - - pattern: $ARGS - pattern-sinks: + version_id: 5PTo12w + shortlink: https://sg.run/6nyB + source: https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode + subcategory: + - audit + technology: + - jwt + vulnerability_class: + - Improper Authentication + patterns: - pattern-either: - patterns: - - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "...", ...) - - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["...",...], ...) - - pattern: $LOOP.subprocess_exec(...) - - patterns: - - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...) - - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c",...) + - pattern: "jwt.decode(..., options={..., \"verify_signature\": $BOOL, ...}, ...)\n" + - metavariable-pattern: + metavariable: $BOOL + pattern: "False\n" + - focus-metavariable: $BOOL - patterns: - - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...], ...) - - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", ...], ...) - message: Detected subprocess function '$LOOP.subprocess_exec' with user controlled data. You may consider using 'shlex.escape()'. + - pattern: "$OPTS = {..., \"verify_signature\": $BOOL, ...}\n...\njwt.decode(..., options=$OPTS, ...)\n" + - metavariable-pattern: + metavariable: $BOOL + pattern: "False\n" + - focus-metavariable: $BOOL + severity: ERROR +- id: python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args + languages: + - python + message: Detected subprocess function '$LOOP.subprocess_exec' with user controlled data. You may consider using + 'shlex.escape()'. metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' - references: - - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec - - https://docs.python.org/3/library/shlex.html - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ category: security - technology: - - python confidence: MEDIUM - cwe2022-top25: true + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args - shortlink: https://sg.run/Apjp + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ semgrep.dev: rule: + origin: community r_id: 27250 - rv_id: 1263460 rule_id: 7KUE1E + rv_id: 1263460 + url: + https://semgrep.dev/playground/r/WrTqKXz/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args version_id: WrTqKXz - url: https://semgrep.dev/playground/r/WrTqKXz/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args - origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + shortlink: https://sg.run/Apjp + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - pattern-either: + - patterns: + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "...", ...) + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["...",...], ...) + - pattern: $LOOP.subprocess_exec(...) + - patterns: + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c",...) + - patterns: + - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...], ...) + - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", ...], ...) pattern-sources: - patterns: - pattern-either: @@ -11304,104 +5640,83 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: $LOOP.subprocess_shell($PROTOCOL, $CMD) - - pattern-inside: asyncio.subprocess.create_subprocess_shell($CMD, ...) - - pattern-inside: asyncio.create_subprocess_shell($CMD, ...) - - focus-metavariable: $CMD - - pattern-not-inside: '$CMD = "..." - - ... - - ' - - pattern-not: $LOOP.subprocess_shell($PROTOCOL, "...") - - pattern-not: asyncio.subprocess.create_subprocess_shell("...", ...) - - pattern-not: asyncio.create_subprocess_shell("...", ...) + severity: ERROR +- id: python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + languages: + - python message: Detected asyncio subprocess function with user controlled data. You may consider using 'shlex.escape()'. metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' - references: - - https://docs.python.org/3/library/asyncio-subprocess.html - - https://docs.python.org/3/library/shlex.html - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ category: security - technology: - - python confidence: MEDIUM - cwe2022-top25: true + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args - shortlink: https://sg.run/Dx8Y + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.python.org/3/library/asyncio-subprocess.html + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ semgrep.dev: rule: - r_id: 27252 - rv_id: 1263462 - rule_id: 8GU5q3 - version_id: K3TKkDn - url: https://semgrep.dev/playground/r/K3TKkDn/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args + r_id: 27252 + rule_id: 8GU5q3 + rv_id: 1263462 + url: + https://semgrep.dev/playground/r/K3TKkDn/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + version_id: K3TKkDn + shortlink: https://sg.run/Dx8Y + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: $LOOP.subprocess_shell($PROTOCOL, $CMD) + - pattern-inside: asyncio.subprocess.create_subprocess_shell($CMD, ...) + - pattern-inside: asyncio.create_subprocess_shell($CMD, ...) + - focus-metavariable: $CMD + - pattern-not-inside: "$CMD = \"...\"\n...\n" + - pattern-not: $LOOP.subprocess_shell($PROTOCOL, "...") + - pattern-not: asyncio.subprocess.create_subprocess_shell("...", ...) + - pattern-not: asyncio.create_subprocess_shell("...", ...) pattern-sources: - patterns: - pattern-either: @@ -11420,127 +5735,77 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '$X = code.InteractiveConsole(...) - - ... - - ' - - pattern-inside: '$X = code.InteractiveInterpreter(...) - - ... - - ' - - pattern-either: - - pattern-inside: '$X.push($PAYLOAD,...) - - ' - - pattern-inside: '$X.runsource($PAYLOAD,...) - - ' - - pattern-inside: '$X.runcode(code.compile_command($PAYLOAD),...) - - ' - - pattern-inside: '$PL = code.compile_command($PAYLOAD,...) - - ... - - $X.runcode($PL,...) - - ' - - pattern: $PAYLOAD - - pattern-not: '$X.push("...",...) - - ' - - pattern-not: '$X.runsource("...",...) - - ' - - pattern-not: '$X.runcode(code.compile_command("..."),...) - - ' - - pattern-not: '$PL = code.compile_command("...",...) - - ... - - $X.runcode($PL,...) - - ' - message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external - data can reach this function call because it allows a malicious actor to run arbitrary Python code. - metadata: - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + severity: ERROR +- id: python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args + languages: + - python + message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if + external data can reach this function call because it allows a malicious actor to run arbitrary Python code. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args - shortlink: https://sg.run/0Bgv semgrep.dev: rule: + origin: community r_id: 27254 - rv_id: 1263464 rule_id: QrUG72 + rv_id: 1263464 + url: + https://semgrep.dev/playground/r/l4TJRK9/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args version_id: l4TJRK9 - url: https://semgrep.dev/playground/r/l4TJRK9/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args - origin: community - severity: WARNING - languages: - - python -- id: python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + shortlink: https://sg.run/0Bgv + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "$X = code.InteractiveConsole(...)\n...\n" + - pattern-inside: "$X = code.InteractiveInterpreter(...)\n...\n" + - pattern-either: + - pattern-inside: "$X.push($PAYLOAD,...)\n" + - pattern-inside: "$X.runsource($PAYLOAD,...)\n" + - pattern-inside: "$X.runcode(code.compile_command($PAYLOAD),...)\n" + - pattern-inside: "$PL = code.compile_command($PAYLOAD,...)\n...\n$X.runcode($PL,...)\n" + - pattern: $PAYLOAD + - pattern-not: "$X.push(\"...\",...)\n" + - pattern-not: "$X.runsource(\"...\",...)\n" + - pattern-not: "$X.runcode(code.compile_command(\"...\"),...)\n" + - pattern-not: "$PL = code.compile_command(\"...\",...)\n...\n$X.runcode($PL,...)\n" pattern-sources: - patterns: - pattern-either: @@ -11559,42 +5824,71 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS + severity: WARNING +- id: python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + languages: + - python + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor + to execute commands. + metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 27256 + rule_id: 4bUEAY + rv_id: 1263466 + url: + https://semgrep.dev/playground/r/6xT29l6/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + version_id: 6xT29l6 + shortlink: https://sg.run/qL6z + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection + mode: taint + options: + symbolic_propagation: true pattern-sinks: - patterns: - pattern-either: @@ -11624,52 +5918,6 @@ rules: - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to - execute commands. - metadata: - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' - confidence: MEDIUM - category: security - technology: - - python - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args - shortlink: https://sg.run/qL6z - semgrep.dev: - rule: - r_id: 27256 - rv_id: 1263466 - rule_id: 4bUEAY - version_id: 6xT29l6 - url: https://semgrep.dev/playground/r/6xT29l6/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args - origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args - mode: taint - options: - symbolic_propagation: true pattern-sources: - patterns: - pattern-either: @@ -11688,42 +5936,72 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS + severity: ERROR +- id: python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args + languages: + - python + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor + to execute commands. + metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 27258 + rule_id: JDUz34 + rv_id: 1263468 + url: + https://semgrep.dev/playground/r/zyTb2wn/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args + version_id: zyTb2wn + shortlink: https://sg.run/Y3Ke + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection + mode: taint + options: + symbolic_propagation: true pattern-sinks: - patterns: - pattern-either: @@ -11733,7 +6011,8 @@ rules: - pattern: $CMD - metavariable-regex: metavariable: $METHOD - regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) + regex: + (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) - patterns: - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...) - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...) @@ -11754,53 +6033,6 @@ rules: - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to - execute commands. - metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' - category: security - technology: - - python - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args - shortlink: https://sg.run/Y3Ke - semgrep.dev: - rule: - r_id: 27258 - rv_id: 1263468 - rule_id: JDUz34 - version_id: zyTb2wn - url: https://semgrep.dev/playground/r/zyTb2wn/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args - origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args - mode: taint - options: - symbolic_propagation: true pattern-sources: - patterns: - pattern-either: @@ -11819,92 +6051,69 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS - pattern-sinks: - - patterns: - - pattern-inside: '_xxsubinterpreters.run_string($ID, $PAYLOAD, ...) - - ' - - pattern-not: '_xxsubinterpreters.run_string($ID, "...", ...) - - ' - - pattern: $PAYLOAD - message: Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary - Python code. + severity: ERROR +- id: + python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args + languages: + - python + message: Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run + arbitrary Python code. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - - https://bugs.python.org/issue43472 - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args - shortlink: https://sg.run/oLl9 + - https://bugs.python.org/issue43472 + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ semgrep.dev: rule: + origin: community r_id: 27260 - rv_id: 1409404 rule_id: GdUkxO + rv_id: 1409404 + url: + https://semgrep.dev/playground/r/DkTwBzO/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args version_id: DkTwBzO - url: https://semgrep.dev/playground/r/DkTwBzO/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args - origin: community - severity: WARNING - languages: - - python -- id: python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + shortlink: https://sg.run/oLl9 + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection mode: taint options: symbolic_propagation: true - pattern-sanitizers: - - pattern: shlex.quote(...) + pattern-sinks: + - patterns: + - pattern-inside: "_xxsubinterpreters.run_string($ID, $PAYLOAD, ...)\n" + - pattern-not: "_xxsubinterpreters.run_string($ID, \"...\", ...)\n" + - pattern: $PAYLOAD pattern-sources: - patterns: - pattern-either: @@ -11923,42 +6132,76 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS + severity: WARNING +- id: python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + languages: + - python + message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to + perform command injection. You may consider using 'shlex.quote()'. + metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess + - https://docs.python.org/3/library/subprocess.html + - https://docs.python.org/3/library/shlex.html + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 27262 + rule_id: AbUgrZ + rv_id: 1263472 + url: + https://semgrep.dev/playground/r/jQTn54Y/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + version_id: jQTn54Y + shortlink: https://sg.run/pLGg + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection + mode: taint + options: + symbolic_propagation: true + pattern-sanitizers: + - pattern: shlex.quote(...) pattern-sinks: - patterns: - pattern-either: @@ -11988,55 +6231,6 @@ rules: - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...) - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...) - focus-metavariable: $CMD - message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform - command injection. You may consider using 'shlex.quote()'. - metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' - references: - - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess - - https://docs.python.org/3/library/subprocess.html - - https://docs.python.org/3/library/shlex.html - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args - shortlink: https://sg.run/pLGg - semgrep.dev: - rule: - r_id: 27262 - rv_id: 1263472 - rule_id: AbUgrZ - version_id: jQTn54Y - url: https://semgrep.dev/playground/r/jQTn54Y/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args - origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args - mode: taint - options: - symbolic_propagation: true pattern-sources: - patterns: - pattern-either: @@ -12055,130 +6249,86 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS - pattern-sinks: - - patterns: - - pattern-not: os.$W("...", ...) - - pattern-either: - - pattern: os.system(...) - - pattern: '$X = __import__("os") - - ... - - $X.system(...) - - ' - - pattern: '$X = __import__("os") - - ... - - getattr($X, "system")(...) - - ' - - pattern: '$X = getattr(os, "system") - - ... - - $X(...) - - ' - - pattern: '$X = __import__("os") - - ... - - $Y = getattr($X, "system") - - ... - - $Y(...) - - ' - - pattern: os.popen(...) - - pattern: os.popen2(...) - - pattern: os.popen3(...) - - pattern: os.popen4(...) - message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the - 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. + severity: ERROR +- id: python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args + languages: + - python + message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use + the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection + vulnerability. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.2.4 Dyanmic Code Execution Features - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' version: '4' category: security - technology: - - python confidence: MEDIUM - cwe2022-top25: true + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args - shortlink: https://sg.run/XR2K + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ semgrep.dev: rule: + origin: community r_id: 27264 - rv_id: 1263474 rule_id: DbUR9g + rv_id: 1263474 + url: + https://semgrep.dev/playground/r/9lT4bG4/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args version_id: 9lT4bG4 - url: https://semgrep.dev/playground/r/9lT4bG4/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args - origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args + shortlink: https://sg.run/XR2K + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-not: os.$W("...", ...) + - pattern-either: + - pattern: os.system(...) + - pattern: "$X = __import__(\"os\")\n...\n$X.system(...)\n" + - pattern: "$X = __import__(\"os\")\n...\ngetattr($X, \"system\")(...)\n" + - pattern: "$X = getattr(os, \"system\")\n...\n$X(...)\n" + - pattern: "$X = __import__(\"os\")\n...\n$Y = getattr($X, \"system\")\n...\n$Y(...)\n" + - pattern: os.popen(...) + - pattern: os.popen2(...) + - pattern: os.popen3(...) + - pattern: os.popen4(...) pattern-sources: - patterns: - pattern-either: @@ -12197,129 +6347,143 @@ rules: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '_testcapi.run_in_subinterp($PAYLOAD, ...) - - ' - - pattern-inside: 'test.support.run_in_subinterp($PAYLOAD, ...) - - ' - - pattern: $PAYLOAD - - pattern-not: '_testcapi.run_in_subinterp("...", ...) - - ' - - pattern-not: 'test.support.run_in_subinterp("...", ...) - - ' - message: Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run - arbitrary Python code. + severity: ERROR +- id: + python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args + languages: + - python + message: Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to + run arbitrary Python code. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args - shortlink: https://sg.run/1DLw semgrep.dev: rule: + origin: community r_id: 27266 - rv_id: 1263476 rule_id: 0oUK7N + rv_id: 1263476 + url: + https://semgrep.dev/playground/r/rxTAKpn/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args version_id: rxTAKpn - url: https://semgrep.dev/playground/r/rxTAKpn/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args - origin: community + shortlink: https://sg.run/1DLw + source: + https://semgrep.dev/r/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection + mode: taint + options: + symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "_testcapi.run_in_subinterp($PAYLOAD, ...)\n" + - pattern-inside: "test.support.run_in_subinterp($PAYLOAD, ...)\n" + - pattern: $PAYLOAD + - pattern-not: "_testcapi.run_in_subinterp(\"...\", ...)\n" + - pattern-not: "test.support.run_in_subinterp(\"...\", ...)\n" + pattern-sources: + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: os.environ + - pattern: os.environ.get('$FOO', ...) + - pattern: os.environb + - pattern: os.environb.get('$FOO', ...) + - pattern: os.getenv('$ANYTHING', ...) + - pattern: os.getenvb('$ANYTHING', ...) + - patterns: + - pattern-either: + - patterns: + - pattern-either: + - pattern: sys.argv + - pattern: sys.orig_argv + - patterns: + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" + - pattern: <... $ARGS ...> + - patterns: + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" + - pattern: <... $ARGS ...> + - patterns: + - pattern-either: + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" + - pattern-either: + - patterns: + - pattern-inside: "for $O, $A in $OPTS:\n ...\n" + - pattern: $A + - pattern: $ARGS severity: WARNING - languages: - - python - id: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions languages: - python - severity: WARNING + message: These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good + default is `0o644` which gives read and write access to yourself and read access to everyone else. metadata: category: security + confidence: MEDIUM + cwe: + - 'CWE-276: Incorrect Default Permissions' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - cwe: - - 'CWE-276: Incorrect Default Permissions' - technology: - - python references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions - shortlink: https://sg.run/AXY4 semgrep.dev: rule: + origin: community r_id: 13594 - rv_id: 1263482 rule_id: zdUYqR + rv_id: 1263482 + url: + https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions version_id: O9Tpxqr - url: https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions - origin: community - message: These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default - is `0o644` which gives read and write access to yourself and read access to everyone else. + shortlink: https://sg.run/AXY4 + source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Improper Authorization patterns: - pattern-inside: os.$METHOD(...) - metavariable-pattern: @@ -12333,13 +6497,13 @@ rules: - patterns: - pattern: os.$METHOD($FILE, $BITS, ...) - metavariable-comparison: - metavariable: $BITS comparison: $BITS >= 0o650 and $BITS < 0o100000 + metavariable: $BITS - patterns: - pattern: os.$METHOD($FILE, $BITS) - metavariable-comparison: - metavariable: $BITS comparison: $BITS >= 0o100650 + metavariable: $BITS - patterns: - pattern: os.$METHOD($FILE, $BITS, ...) - metavariable-pattern: @@ -12355,199 +6519,193 @@ rules: - patterns: - pattern: os.$METHOD($FILE, $EXPR | $MOD, ...) - metavariable-comparison: - metavariable: $MOD comparison: $MOD == 0o111 -- id: python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + metavariable: $MOD + severity: WARNING +- fix-regex: + count: 1 + regex: '[Hh][Tt][Tt][Pp]://' + replacement: https:// + id: + python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + languages: + - python + message: Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead. + metadata: + asvs: + control_id: 9.2.1 Weak TLS + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements + section: V9 Communications Verification Requirements + version: '4' + category: security + confidence: MEDIUM + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + semgrep.dev: + rule: + origin: community + r_id: 9651 + rule_id: lBU9BZ + rv_id: 1263484 + url: + https://semgrep.dev/playground/r/vdT06wb/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + version_id: vdT06wb + shortlink: https://sg.run/Bk5W + source: + https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context + subcategory: + - audit + technology: + - requests + vulnerability_class: + - Mishandled Sensitive Information + mode: taint options: symbolic_propagation: true - mode: taint + pattern-sinks: + - patterns: + - pattern-inside: "with requests.Session(...) as $SESSION:\n ...\n" + - pattern-either: + - pattern: $SESSION.$W($SINK, ...) + - pattern: $SESSION.request($METHOD, $SINK, ...) + - focus-metavariable: $SINK pattern-sources: - patterns: - - pattern: '"$URL" - - ' + - pattern: "\"$URL\"\n" - metavariable-pattern: - metavariable: $URL language: regex + metavariable: $URL patterns: - pattern-regex: http:// - pattern-not-regex: .*://localhost - pattern-not-regex: .*://127\.0\.0\.1 - pattern-sinks: - - patterns: - - pattern-inside: "with requests.Session(...) as $SESSION:\n ...\n" - - pattern-either: - - pattern: $SESSION.$W($SINK, ...) - - pattern: $SESSION.request($METHOD, $SINK, ...) - - focus-metavariable: $SINK - fix-regex: + severity: INFO +- fix-regex: + count: 1 regex: '[Hh][Tt][Tt][Pp]://' replacement: https:// - count: 1 + id: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http + languages: + - python message: Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead. metadata: - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-319: Cleartext Transmission of Sensitive Information' asvs: + control_id: 9.1.1 Weak TLS + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements section: V9 Communications Verification Requirements - control_id: 9.2.1 Weak TLS - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements version: '4' category: security - technology: - - requests + confidence: MEDIUM + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A03:2017 - Sensitive Data Exposure + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures + semgrep.dev: + rule: + origin: community + r_id: 9652 + rule_id: YGURXw + rv_id: 1263485 + url: + https://semgrep.dev/playground/r/d6Tyx02/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http + version_id: d6Tyx02 + shortlink: https://sg.run/DoBY + source: + https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http subcategory: - audit - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - requests vulnerability_class: - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context - shortlink: https://sg.run/Bk5W - semgrep.dev: - rule: - r_id: 9651 - rv_id: 1263484 - rule_id: lBU9BZ - version_id: vdT06wb - url: https://semgrep.dev/playground/r/vdT06wb/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context - origin: community - languages: - - python - severity: INFO -- id: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http + mode: taint options: symbolic_propagation: true - mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: requests.Session(...).$W($SINK, ...) + - pattern: requests.Session(...).request($METHOD, $SINK, ...) + - focus-metavariable: $SINK pattern-sources: - patterns: - - pattern: '"$URL" - - ' + - pattern: "\"$URL\"\n" - metavariable-pattern: - metavariable: $URL language: regex + metavariable: $URL patterns: - pattern-regex: http:// - pattern-not-regex: .*://localhost - pattern-not-regex: .*://127\.0\.0\.1 - pattern-sinks: - - patterns: - - pattern-either: - - pattern: requests.Session(...).$W($SINK, ...) - - pattern: requests.Session(...).request($METHOD, $SINK, ...) - - focus-metavariable: $SINK - fix-regex: + severity: INFO +- fix-regex: + count: 1 regex: '[Hh][Tt][Tt][Pp]://' replacement: https:// - count: 1 - message: Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead. + id: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http languages: - python - severity: INFO + message: Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic + on the network and be able to obtain sensitive information. Use 'https://' instead. metadata: - owasp: - - A03:2017 - Sensitive Data Exposure - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-319: Cleartext Transmission of Sensitive Information' asvs: - section: V9 Communications Verification Requirements control_id: 9.1.1 Weak TLS - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements + section: V9 Communications Verification Requirements version: '4' category: security - technology: - - requests - references: - - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - audit - likelihood: LOW - impact: LOW confidence: MEDIUM + cwe: + - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http - shortlink: https://sg.run/DoBY - semgrep.dev: - rule: - r_id: 9652 - rv_id: 1263485 - rule_id: YGURXw - version_id: d6Tyx02 - url: https://semgrep.dev/playground/r/d6Tyx02/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http - origin: community -- id: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http - fix-regex: - regex: '[Hh][Tt][Tt][Pp]://' - replacement: https:// - count: 1 - message: Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on - the network and be able to obtain sensitive information. Use 'https://' instead. - metadata: + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - cwe: - - 'CWE-319: Cleartext Transmission of Sensitive Information' - asvs: - section: V9 Communications Verification Requirements - control_id: 9.1.1 Weak TLS - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements - version: '4' - category: security - technology: - - requests references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - audit - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http - shortlink: https://sg.run/W8J4 semgrep.dev: rule: + origin: community r_id: 9653 - rv_id: 1263486 rule_id: 6JUjpG + rv_id: 1263486 + url: + https://semgrep.dev/playground/r/ZRTKA9v/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http version_id: ZRTKA9v - url: https://semgrep.dev/playground/r/ZRTKA9v/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http - origin: community - languages: - - python - severity: INFO + shortlink: https://sg.run/W8J4 + source: + https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http + subcategory: + - audit + technology: + - requests + vulnerability_class: + - Mishandled Sensitive Information + mode: taint options: symbolic_propagation: true - mode: taint - pattern-sources: - - patterns: - - pattern: '"$URL" - - ' - - metavariable-pattern: - metavariable: $URL - language: regex - patterns: - - pattern-regex: http:// - - pattern-not-regex: .*://localhost - - pattern-not-regex: .*://127\.0\.0\.1 pattern-sinks: - patterns: - pattern-either: @@ -12555,63 +6713,79 @@ rules: - pattern: requests.request($METHOD, $SINK, ...) - pattern: requests.Request($METHOD, $SINK, ...) - focus-metavariable: $SINK -- id: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure - patterns: - - pattern: '$LOGGER_OBJ.$LOGGER_CALL($FORMAT_STRING,...) - - ' - - metavariable-regex: - metavariable: $LOGGER_OBJ - regex: (?i)(_logger|logger|self.logger|log) - - metavariable-regex: - metavariable: $LOGGER_CALL - regex: (debug|info|warn|warning|error|exception|critical) - - metavariable-regex: - metavariable: $FORMAT_STRING - regex: (?i).*(api.key|secret|credential|token|password).*\%s.* - message: Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret - credentials being exposed. Make sure that the logger is not logging sensitive information. - severity: WARNING + pattern-sources: + - patterns: + - pattern: "\"$URL\"\n" + - metavariable-pattern: + language: regex + metavariable: $URL + patterns: + - pattern-regex: http:// + - pattern-not-regex: .*://localhost + - pattern-not-regex: .*://127\.0\.0\.1 + severity: INFO +- id: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure languages: - python + message: Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to + secret credentials being exposed. Make sure that the logger is not logging sensitive information. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-532: Insertion of Sensitive Information into Log File' - category: security - technology: - - python + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A09:2021 - Security Logging and Monitoring Failures - A09:2025 - Security Logging & Alerting Failures references: - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure - shortlink: https://sg.run/ydNx semgrep.dev: rule: + origin: community r_id: 9668 - rv_id: 1263501 rule_id: x8UnJk + rv_id: 1263501 + url: + https://semgrep.dev/playground/r/A8TgdOR/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure version_id: A8TgdOR - url: https://semgrep.dev/playground/r/A8TgdOR/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure - origin: community -- id: python.lang.security.audit.md5-used-as-password.md5-used-as-password + shortlink: https://sg.run/ydNx + source: + https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Mishandled Sensitive Information + patterns: + - pattern: "$LOGGER_OBJ.$LOGGER_CALL($FORMAT_STRING,...)\n" + - metavariable-regex: + metavariable: $LOGGER_OBJ + regex: (?i)(_logger|logger|self.logger|log) + - metavariable-regex: + metavariable: $LOGGER_CALL + regex: (debug|info|warn|warning|error|exception|critical) + - metavariable-regex: + metavariable: $FORMAT_STRING + regex: (?i).*(api.key|secret|credential|token|password).*\%s.* severity: WARNING - message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked - by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`. +- id: python.lang.security.audit.md5-used-as-password.md5-used-as-password languages: - python + message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be + cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can + use `hashlib.scrypt`. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -12623,30 +6797,32 @@ rules: - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords - https://github.com/returntocorp/semgrep-rules/issues/1609 - https://docs.python.org/3/library/hashlib.html#hashlib.scrypt - category: security + semgrep.dev: + rule: + origin: community + r_id: 14703 + rule_id: 6JU1w1 + rv_id: 1263504 + url: + https://semgrep.dev/playground/r/WrTqKDz/python.lang.security.audit.md5-used-as-password.md5-used-as-password + version_id: WrTqKDz + shortlink: https://sg.run/5DwD + source: https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password + subcategory: + - vuln technology: - pycryptodome - hashlib - md5 - subcategory: - - vuln - likelihood: HIGH - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password - shortlink: https://sg.run/5DwD - semgrep.dev: - rule: - r_id: 14703 - rv_id: 1263504 - rule_id: 6JU1w1 - version_id: WrTqKDz - url: https://semgrep.dev/playground/r/WrTqKDz/python.lang.security.audit.md5-used-as-password.md5-used-as-password - origin: community mode: taint + pattern-sinks: + - patterns: + - pattern: $FUNCTION(...) + - metavariable-regex: + metavariable: $FUNCTION + regex: (?i)(.*password.*) pattern-sources: - patterns: - pattern-either: @@ -12655,163 +6831,152 @@ rules: - pattern: Cryptodome.Hash.MD5 - pattern: Crypto.Hash.MD5 - pattern: cryptography.hazmat.primitives.hashes.MD5 - pattern-sinks: - - patterns: - - pattern: $FUNCTION(...) - - metavariable-regex: - metavariable: $FUNCTION - regex: (?i)(.*password.*) + severity: WARNING - id: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces - message: Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to - all available interfaces. Consider instead getting correct address from an environment variable or configuration file. + languages: + - python + message: Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds + to all available interfaces. Consider instead getting correct address from an environment variable or configuration + file. metadata: + category: security + confidence: HIGH cwe: - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' + cwe2021-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - python references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces - shortlink: https://sg.run/rdln semgrep.dev: rule: + origin: community r_id: 9669 - rv_id: 1263505 rule_id: OrU3og + rv_id: 1263505 + url: + https://semgrep.dev/playground/r/0bTKzDL/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces version_id: 0bTKzDL - url: https://semgrep.dev/playground/r/0bTKzDL/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces - origin: community - languages: - - python - severity: INFO + shortlink: https://sg.run/rdln + source: https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Mishandled Sensitive Information pattern-either: - - pattern: '$S = socket.socket(...) - - ... - - $S.bind(("0.0.0.0", ...)) - - ' - - pattern: '$S = socket.socket(...) - - ... - - $S.bind(("::", ...)) - - ' - - pattern: '$S = socket.socket(...) - - ... - - $S.bind(("", ...)) - - ' + - pattern: "$S = socket.socket(...)\n...\n$S.bind((\"0.0.0.0\", ...))\n" + - pattern: "$S = socket.socket(...)\n...\n$S.bind((\"::\", ...))\n" + - pattern: "$S = socket.socket(...)\n...\n$S.bind((\"\", ...))\n" + severity: INFO - id: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation - patterns: - - pattern-either: - - pattern: urllib3.PoolManager(..., cert_reqs=$REQS, ...) - - pattern: urllib3.ProxyManager(..., cert_reqs=$REQS, ...) - - pattern: urllib3.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) - - pattern: urllib3.connectionpool.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) - - pattern: urllib3.connection_from_url(..., cert_reqs=$REQS, ...) - - pattern: urllib3.proxy_from_url(..., cert_reqs=$REQS, ...) - - pattern: $CONTEXT.wrap_socket(..., cert_reqs=$REQS, ...) - - pattern: ssl.wrap_socket(..., cert_reqs=$REQS, ...) - - metavariable-regex: - metavariable: $REQS - regex: (NONE|CERT_NONE|CERT_OPTIONAL|ssl\.CERT_NONE|ssl\.CERT_OPTIONAL|\'NONE\'|\"NONE\"|\'OPTIONAL\'|\"OPTIONAL\") + languages: + - python message: certificate verification explicitly disabled, insecure connections possible metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-295: Improper Certificate Validation' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - category: security - technology: - - python references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation - shortlink: https://sg.run/b7yp semgrep.dev: rule: + origin: community r_id: 9670 - rv_id: 1263506 rule_id: eqU87k + rv_id: 1263506 + url: + https://semgrep.dev/playground/r/K3TKkZn/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation version_id: K3TKkZn - url: https://semgrep.dev/playground/r/K3TKkZn/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation - origin: community - languages: - - python + shortlink: https://sg.run/b7yp + source: https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Improper Authentication + patterns: + - pattern-either: + - pattern: urllib3.PoolManager(..., cert_reqs=$REQS, ...) + - pattern: urllib3.ProxyManager(..., cert_reqs=$REQS, ...) + - pattern: urllib3.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) + - pattern: urllib3.connectionpool.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) + - pattern: urllib3.connection_from_url(..., cert_reqs=$REQS, ...) + - pattern: urllib3.proxy_from_url(..., cert_reqs=$REQS, ...) + - pattern: $CONTEXT.wrap_socket(..., cert_reqs=$REQS, ...) + - pattern: ssl.wrap_socket(..., cert_reqs=$REQS, ...) + - metavariable-regex: + metavariable: $REQS + regex: + (NONE|CERT_NONE|CERT_OPTIONAL|ssl\.CERT_NONE|ssl\.CERT_OPTIONAL|\'NONE\'|\"NONE\"|\'OPTIONAL\'|\"OPTIONAL\") severity: ERROR - id: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection - message: Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool - instead for to encrypt communications. + languages: + - python + message: Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use + HTTPSConnectionPool instead for to encrypt communications. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool - category: security - technology: - - python - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Mishandled Sensitive Information - source: https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection - shortlink: https://sg.run/N4Np semgrep.dev: rule: + origin: community r_id: 9671 - rv_id: 1263507 rule_id: v8UnWQ + rv_id: 1263507 + url: + https://semgrep.dev/playground/r/qkTR7E1/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection version_id: qkTR7E1 - url: https://semgrep.dev/playground/r/qkTR7E1/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection - origin: community - languages: - - python - severity: ERROR + shortlink: https://sg.run/N4Np + source: https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection + subcategory: + - audit + technology: + - python + vulnerability_class: + - Mishandled Sensitive Information pattern-either: - pattern: urllib3.HTTPConnectionPool(...) - pattern: urllib3.connectionpool.HTTPConnectionPool(...) + severity: ERROR - id: python.lang.security.audit.sha224-hash.sha224-hash - message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating - to a stronger hash function such as SHA-384 or higher to ensure compliance and security. + languages: + - python + message: This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider + updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security. metadata: + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -12819,40 +6984,39 @@ rules: references: - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography - category: security - technology: - - python - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.audit.sha224-hash.sha224-hash - shortlink: https://sg.run/Db1Yv semgrep.dev: rule: + origin: community r_id: 151752 - rv_id: 1263511 rule_id: BYUX0y9 - version_id: 5PTo1QL + rv_id: 1263511 url: https://semgrep.dev/playground/r/5PTo1QL/python.lang.security.audit.sha224-hash.sha224-hash - origin: community - severity: WARNING - languages: - - python + version_id: 5PTo1QL + shortlink: https://sg.run/Db1Yv + source: https://semgrep.dev/r/python.lang.security.audit.sha224-hash.sha224-hash + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: hashlib.sha224(...) - pattern: hashlib.sha3_224(...) + severity: WARNING - id: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated - pattern: ssl.wrap_socket(...) - message: '''ssl.wrap_socket()'' is deprecated. This function creates an insecure socket without server name indication or - hostname matching. Instead, create an SSL context using ''ssl.SSLContext()'' and use that to wrap a socket.' + languages: + - python + message: "'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or + hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket." metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -12860,125 +7024,120 @@ rules: references: - https://docs.python.org/3/library/ssl.html#ssl.wrap_socket - https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket - category: security - technology: - - python - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated - shortlink: https://sg.run/PJOY semgrep.dev: rule: + origin: community r_id: 9645 - rv_id: 1263516 rule_id: BYUN2e + rv_id: 1263516 + url: + https://semgrep.dev/playground/r/DkTRbgn/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated version_id: DkTRbgn - url: https://semgrep.dev/playground/r/DkTRbgn/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated - origin: community + shortlink: https://sg.run/PJOY + source: https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Cryptographic Issues + pattern: ssl.wrap_socket(...) + severity: WARNING +- fix: "False\n" + id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true languages: - python - severity: WARNING -- id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true - patterns: - - pattern: subprocess.$FUNC(..., shell=$TRUE, ...) - - metavariable-pattern: - metavariable: $TRUE - pattern: "True \n" - - pattern-not: subprocess.$FUNC("...", shell=True, ...) - - focus-metavariable: $TRUE - message: Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command - using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious - actor to execute commands. Use 'shell=False' instead. - fix: 'False - - ' + message: Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the + command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier + for a malicious actor to execute commands. Use 'shell=False' instead. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' references: - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess - https://docs.python.org/3/library/subprocess.html - category: security - technology: - - python - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - secure default - likelihood: HIGH - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true - shortlink: https://sg.run/J92w semgrep.dev: rule: + origin: community r_id: 9646 - rv_id: 1263518 rule_id: DbUpz2 + rv_id: 1263518 + url: + https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true version_id: 0bTKzDK - url: https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true - origin: community - languages: - - python + shortlink: https://sg.run/J92w + source: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html + subcategory: + - secure default + technology: + - python + vulnerability_class: + - Command Injection + patterns: + - pattern: subprocess.$FUNC(..., shell=$TRUE, ...) + - metavariable-pattern: + metavariable: $TRUE + pattern: "True \n" + - pattern-not: subprocess.$FUNC("...", shell=True, ...) + - focus-metavariable: $TRUE severity: ERROR - id: python.lang.security.audit.weak-ssl-version.weak-ssl-version - message: An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption - and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher. + languages: + - python + message: An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak + encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher. metadata: + asvs: + control_id: 9.1.3 Weak TLS + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements + section: V9 Communications Verification Requirements + version: '4' + category: security + confidence: MEDIUM cwe: - 'CWE-326: Inadequate Encryption Strength' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/insecure_ssl_tls.py#L30 - asvs: - section: V9 Communications Verification Requirements - control_id: 9.1.3 Weak TLS - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements - version: '4' references: - https://tools.ietf.org/html/rfc7568 - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html - https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2 - category: security - technology: - - python - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version - shortlink: https://sg.run/RoZO semgrep.dev: rule: + origin: community r_id: 9649 - rv_id: 1263520 rule_id: KxUbNG - version_id: qkTR7Ev + rv_id: 1263520 url: https://semgrep.dev/playground/r/qkTR7Ev/python.lang.security.audit.weak-ssl-version.weak-ssl-version - origin: community - languages: - - python - severity: WARNING + version_id: qkTR7Ev + shortlink: https://sg.run/RoZO + source: https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/insecure_ssl_tls.py#L30 + subcategory: + - audit + technology: + - python + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: ssl.PROTOCOL_SSLv2 - pattern: ssl.PROTOCOL_SSLv3 @@ -12989,10 +7148,60 @@ rules: - pattern: pyOpenSSL.SSL.SSLv3_METHOD - pattern: pyOpenSSL.SSL.TLSv1_METHOD - pattern: pyOpenSSL.SSL.TLSv1_1_METHOD + severity: WARNING - id: python.lang.security.dangerous-code-run.dangerous-interactive-code-run + languages: + - python + message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if + external data can reach this function call because it allows a malicious actor to run arbitrary Python code. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 27267 + rule_id: KxUKzx + rv_id: 1263521 + url: + https://semgrep.dev/playground/r/l4TJRgo/python.lang.security.dangerous-code-run.dangerous-interactive-code-run + version_id: l4TJRgo + shortlink: https://sg.run/9pRY + source: https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "$X = code.InteractiveConsole(...)\n...\n" + - pattern-inside: "$X = code.InteractiveInterpreter(...)\n...\n" + - pattern-either: + - pattern: "$X.push($PAYLOAD,...)\n" + - pattern: "$X.runsource($PAYLOAD,...)\n" + - pattern: "$X.runcode(code.compile_command($PAYLOAD),...)\n" + - pattern: "$PL = code.compile_command($PAYLOAD,...)\n...\n$X.runcode($PL,...)\n" + - focus-metavariable: $PAYLOAD + - pattern-not: "$X.push(\"...\",...)\n" + - pattern-not: "$X.runsource(\"...\",...)\n" + - pattern-not: "$X.runcode(code.compile_command(\"...\"),...)\n" + - pattern-not: "$PL = code.compile_command(\"...\",...)\n...\n$X.runcode($PL,...)\n" pattern-sources: - patterns: - pattern-either: @@ -13068,91 +7277,82 @@ rules: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '$X = code.InteractiveConsole(...) - - ... - - ' - - pattern-inside: '$X = code.InteractiveInterpreter(...) - - ... - - ' - - pattern-either: - - pattern: '$X.push($PAYLOAD,...) - - ' - - pattern: '$X.runsource($PAYLOAD,...) - - ' - - pattern: '$X.runcode(code.compile_command($PAYLOAD),...) - - ' - - pattern: '$PL = code.compile_command($PAYLOAD,...) - - ... - - $X.runcode($PL,...) - - ' - - focus-metavariable: $PAYLOAD - - pattern-not: '$X.push("...",...) - - ' - - pattern-not: '$X.runsource("...",...) - - ' - - pattern-not: '$X.runcode(code.compile_command("..."),...) - - ' - - pattern-not: '$PL = code.compile_command("...",...) - - ... - - $X.runcode($PL,...) - - ' - message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external - data can reach this function call because it allows a malicious actor to run arbitrary Python code. - metadata: - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + severity: WARNING +- id: python.lang.security.dangerous-os-exec.dangerous-os-exec + languages: + - python + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor + to execute commands. + metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: + - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run - shortlink: https://sg.run/9pRY semgrep.dev: rule: - r_id: 27267 - rv_id: 1263521 - rule_id: KxUKzx - version_id: l4TJRgo - url: https://semgrep.dev/playground/r/l4TJRgo/python.lang.security.dangerous-code-run.dangerous-interactive-code-run origin: community - severity: WARNING - languages: - - python -- id: python.lang.security.dangerous-os-exec.dangerous-os-exec + r_id: 27268 + rule_id: qNUR13 + rv_id: 1263523 + url: https://semgrep.dev/playground/r/6xT29rz/python.lang.security.dangerous-os-exec.dangerous-os-exec + version_id: 6xT29rz + shortlink: https://sg.run/yL9x + source: https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: os.$METHOD("...", ...) + - pattern: os.$METHOD(...) + - metavariable-regex: + metavariable: $METHOD + regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe) + - patterns: + - pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...) + - pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (execv|execve|execvp|execvpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) + - patterns: + - pattern-not: os.$METHOD("...", $PATH, "...", "...",...) + - pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...) + - pattern: $CMD + - metavariable-regex: + metavariable: $METHOD + regex: (execl|execle|execlp|execlpe) + - metavariable-regex: + metavariable: $BASH + regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) pattern-sources: - patterns: - pattern-either: @@ -13228,81 +7428,86 @@ rules: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession + severity: ERROR +- id: python.lang.security.dangerous-spawn-process.dangerous-spawn-process + languages: + - python + message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor + to execute commands. + metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ + semgrep.dev: + rule: + origin: community + r_id: 27269 + rule_id: lBUJrn + rv_id: 1263524 + url: + https://semgrep.dev/playground/r/o5TbDO5/python.lang.security.dangerous-spawn-process.dangerous-spawn-process + version_id: o5TbDO5 + shortlink: https://sg.run/r8Zn + source: https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection + mode: taint + options: + symbolic_propagation: true pattern-sinks: - patterns: - pattern-either: - patterns: - - pattern-not: os.$METHOD("...", ...) - - pattern: os.$METHOD(...) + - pattern-not: os.$METHOD($MODE, "...", ...) + - pattern-inside: os.$METHOD($MODE, $CMD, ...) + - pattern: $CMD - metavariable-regex: metavariable: $METHOD - regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe) + regex: + (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) - patterns: - - pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...) - - pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...) + - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...) + - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD - regex: (execv|execve|execvp|execvpe) + regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - patterns: - - pattern-not: os.$METHOD("...", $PATH, "...", "...",...) - - pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...) + - pattern-not: os.$METHOD($MODE, "...", "...", "...", ...) + - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD - regex: (execl|execle|execlp|execlpe) + regex: (spawnl|spawnle|spawnlp|spawnlpe) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to - execute commands. - metadata: - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' - confidence: MEDIUM - category: security - technology: - - python - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec - shortlink: https://sg.run/yL9x - semgrep.dev: - rule: - r_id: 27268 - rv_id: 1263523 - rule_id: qNUR13 - version_id: 6xT29rz - url: https://semgrep.dev/playground/r/6xT29rz/python.lang.security.dangerous-os-exec.dangerous-os-exec - origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.dangerous-spawn-process.dangerous-spawn-process - mode: taint - options: - symbolic_propagation: true pattern-sources: - patterns: - pattern-either: @@ -13393,119 +7598,68 @@ rules: - pattern: sys.argv[...] - pattern: sys.orig_argv[...] - patterns: - - pattern-inside: '$PARSER = argparse.ArgumentParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = argparse.ArgumentParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - - pattern-inside: '$PARSER = optparse.OptionParser(...) - - ... - - ' - - pattern-inside: '$ARGS = $PARSER.parse_args() - - ' + - pattern-inside: "$PARSER = optparse.OptionParser(...)\n...\n" + - pattern-inside: "$ARGS = $PARSER.parse_args()\n" - pattern: <... $ARGS ...> - patterns: - pattern-either: - - pattern-inside: '$OPTS, $ARGS = getopt.getopt(...) - - ... - - ' - - pattern-inside: '$OPTS, $ARGS = getopt.gnu_getopt(...) - - ... - - ' + - pattern-inside: "$OPTS, $ARGS = getopt.getopt(...)\n...\n" + - pattern-inside: "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n" - pattern-either: - patterns: - pattern-inside: "for $O, $A in $OPTS:\n ...\n" - pattern: $A - pattern: $ARGS - pattern-sinks: - - patterns: - - pattern-either: - - patterns: - - pattern-not: os.$METHOD($MODE, "...", ...) - - pattern-inside: os.$METHOD($MODE, $CMD, ...) - - pattern: $CMD - - metavariable-regex: - metavariable: $METHOD - regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) - - patterns: - - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...) - - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...) - - pattern: $CMD - - metavariable-regex: - metavariable: $METHOD - regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) - - metavariable-regex: - metavariable: $BASH - regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - - patterns: - - pattern-not: os.$METHOD($MODE, "...", "...", "...", ...) - - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) - - pattern: $CMD - - metavariable-regex: - metavariable: $METHOD - regex: (spawnl|spawnle|spawnlp|spawnlpe) - - metavariable-regex: - metavariable: $BASH - regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to - execute commands. + severity: ERROR +- id: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + languages: + - python + message: Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run + arbitrary Python code. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + category: security + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: + - https://bugs.python.org/issue43472 - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements - version: '4' - category: security - technology: - - python - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process - shortlink: https://sg.run/r8Zn semgrep.dev: rule: - r_id: 27269 - rv_id: 1263524 - rule_id: lBUJrn - version_id: o5TbDO5 - url: https://semgrep.dev/playground/r/o5TbDO5/python.lang.security.dangerous-spawn-process.dangerous-spawn-process origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + r_id: 27270 + rule_id: PeURWr + rv_id: 1263525 + url: + https://semgrep.dev/playground/r/zyTb2OX/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + version_id: zyTb2OX + shortlink: https://sg.run/bPop + source: + https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern: "_xxsubinterpreters.run_string($ID, $PAYLOAD, ...)\n" + - pattern-not: "_xxsubinterpreters.run_string($ID, \"...\", ...)\n" + - focus-metavariable: $PAYLOAD pattern-sources: - patterns: - pattern-either: @@ -13581,54 +7735,86 @@ rules: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - pattern-sinks: - - patterns: - - pattern: '_xxsubinterpreters.run_string($ID, $PAYLOAD, ...) - - ' - - pattern-not: '_xxsubinterpreters.run_string($ID, "...", ...) - - ' - - focus-metavariable: $PAYLOAD - message: Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary - Python code. + severity: WARNING +- id: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + languages: + - python + message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to + perform command injection. You may consider using 'shlex.escape()'. metadata: + asvs: + control_id: 5.3.8 OS Command Injection + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements + section: 'V5: Validation, Sanitization and Encoding Verification Requirements' + version: '4' + category: security + confidence: MEDIUM cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: + - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - - https://bugs.python.org/issue43472 + - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess + - https://docs.python.org/3/library/subprocess.html + - https://docs.python.org/3/library/shlex.html - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string - shortlink: https://sg.run/bPop semgrep.dev: rule: - r_id: 27270 - rv_id: 1263525 - rule_id: PeURWr - version_id: zyTb2OX - url: https://semgrep.dev/playground/r/zyTb2OX/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string origin: community - severity: WARNING - languages: - - python -- id: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + r_id: 27271 + rule_id: JDUz3R + rv_id: 1263526 + url: + https://semgrep.dev/playground/r/pZT038J/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + version_id: pZT038J + shortlink: https://sg.run/NWxp + source: https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - patterns: + - pattern-not: subprocess.$FUNC("...", ...) + - pattern-not: subprocess.$FUNC(["...",...], ...) + - pattern-not: subprocess.$FUNC(("...",...), ...) + - pattern-not: subprocess.CalledProcessError(...) + - pattern-not: subprocess.SubprocessError(...) + - pattern: subprocess.$FUNC($CMD, ...) + - patterns: + - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...) + - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD) + - patterns: + - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...) + - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...) + - pattern-either: + - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD], ...) + - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD), ...) + - patterns: + - pattern-not: subprocess.$FUNC("=~/(python)/","...",...) + - pattern: subprocess.$FUNC("=~/(python)/", $CMD) + - patterns: + - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...) + - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...) + - pattern-either: + - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...) + - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...) + - focus-metavariable: $CMD pattern-sources: - patterns: - pattern-either: @@ -13704,84 +7890,71 @@ rules: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - pattern-sinks: - - patterns: - - pattern-either: - - patterns: - - pattern-not: subprocess.$FUNC("...", ...) - - pattern-not: subprocess.$FUNC(["...",...], ...) - - pattern-not: subprocess.$FUNC(("...",...), ...) - - pattern-not: subprocess.CalledProcessError(...) - - pattern-not: subprocess.SubprocessError(...) - - pattern: subprocess.$FUNC($CMD, ...) - - patterns: - - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...) - - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD) - - patterns: - - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...) - - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...) - - pattern-either: - - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD], ...) - - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD), ...) - - patterns: - - pattern-not: subprocess.$FUNC("=~/(python)/","...",...) - - pattern: subprocess.$FUNC("=~/(python)/", $CMD) - - patterns: - - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...) - - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...) - - pattern-either: - - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...) - - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...) - - focus-metavariable: $CMD - message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform - command injection. You may consider using 'shlex.escape()'. + severity: ERROR +- id: python.lang.security.dangerous-system-call.dangerous-system-call + languages: + - python + message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use + the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection + vulnerability. metadata: - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: + control_id: 5.2.4 Dyanmic Code Execution Features + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.3.8 OS Command Injection - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' - references: - - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess - - https://docs.python.org/3/library/subprocess.html - - https://docs.python.org/3/library/shlex.html - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ category: security - technology: - - python confidence: MEDIUM - cwe2022-top25: true + cwe: + - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM + cwe2022-top25: true impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use - shortlink: https://sg.run/NWxp + likelihood: HIGH + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ semgrep.dev: rule: - r_id: 27271 - rv_id: 1263526 - rule_id: JDUz3R - version_id: pZT038J - url: https://semgrep.dev/playground/r/pZT038J/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.dangerous-system-call.dangerous-system-call + r_id: 27272 + rule_id: 5rUoP1 + rv_id: 1263527 + url: https://semgrep.dev/playground/r/2KTv2Zn/python.lang.security.dangerous-system-call.dangerous-system-call + version_id: 2KTv2Zn + shortlink: https://sg.run/k0W7 + source: https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call + source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Command Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-not: os.$W("...", ...) + - pattern-either: + - pattern: os.system(...) + - pattern: getattr(os, "system")(...) + - pattern: __import__("os").system(...) + - pattern: getattr(__import__("os"), "system")(...) + - pattern: "$X = __import__(\"os\")\n...\n$X.system(...)\n" + - pattern: "$X = __import__(\"os\")\n...\ngetattr($X, \"system\")(...)\n" + - pattern: "$X = getattr(os, \"system\")\n...\n$X(...)\n" + - pattern: "$X = __import__(\"os\")\n...\n$Y = getattr($X, \"system\")\n...\n$Y(...)\n" + - pattern: os.popen(...) + - pattern: os.popen2(...) + - pattern: os.popen3(...) + - pattern: os.popen4(...) pattern-sources: - patterns: - pattern-either: @@ -13857,97 +8030,54 @@ rules: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - pattern-sinks: - - patterns: - - pattern-not: os.$W("...", ...) - - pattern-either: - - pattern: os.system(...) - - pattern: getattr(os, "system")(...) - - pattern: __import__("os").system(...) - - pattern: getattr(__import__("os"), "system")(...) - - pattern: '$X = __import__("os") - - ... - - $X.system(...) - - ' - - pattern: '$X = __import__("os") - - ... - - getattr($X, "system")(...) - - ' - - pattern: '$X = getattr(os, "system") - - ... - - $X(...) - - ' - - pattern: '$X = __import__("os") - - ... - - $Y = getattr($X, "system") - - ... - - $Y(...) - - ' - - pattern: os.popen(...) - - pattern: os.popen2(...) - - pattern: os.popen3(...) - - pattern: os.popen4(...) - message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the - 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. + severity: ERROR +- id: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + languages: + - python + message: Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to + run arbitrary Python code. metadata: - source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html + category: security + confidence: MEDIUM cwe: - - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' + - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - asvs: - section: 'V5: Validation, Sanitization and Encoding Verification Requirements' - control_id: 5.2.4 Dyanmic Code Execution Features - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements - version: '4' - category: security - technology: - - python - confidence: MEDIUM - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Command Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call - shortlink: https://sg.run/k0W7 semgrep.dev: rule: - r_id: 27272 - rv_id: 1263527 - rule_id: 5rUoP1 - version_id: 2KTv2Zn - url: https://semgrep.dev/playground/r/2KTv2Zn/python.lang.security.dangerous-system-call.dangerous-system-call origin: community - languages: - - python - severity: ERROR -- id: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + r_id: 27273 + rule_id: GdUkxR + rv_id: 1263528 + url: + https://semgrep.dev/playground/r/X0Tzy1e/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + version_id: X0Tzy1e + shortlink: https://sg.run/wLpY + source: + https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Code Injection mode: taint options: symbolic_propagation: true + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "_testcapi.run_in_subinterp($PAYLOAD, ...)\n" + - pattern: "test.support.run_in_subinterp($PAYLOAD, ...)\n" + - focus-metavariable: $PAYLOAD + - pattern-not: "_testcapi.run_in_subinterp(\"...\", ...)\n" + - pattern-not: "test.support.run_in_subinterp(\"...\", ...)\n" pattern-sources: - patterns: - pattern-either: @@ -14023,113 +8153,56 @@ rules: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - pattern-sinks: - - patterns: - - pattern-either: - - pattern: '_testcapi.run_in_subinterp($PAYLOAD, ...) - - ' - - pattern: 'test.support.run_in_subinterp($PAYLOAD, ...) - - ' - - focus-metavariable: $PAYLOAD - - pattern-not: '_testcapi.run_in_subinterp("...", ...) - - ' - - pattern-not: 'test.support.run_in_subinterp("...", ...) - - ' - message: Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run - arbitrary Python code. - metadata: - cwe: - - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' - owasp: - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ - category: security - technology: - - python - confidence: MEDIUM - subcategory: - - vuln - likelihood: HIGH - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp - shortlink: https://sg.run/wLpY - semgrep.dev: - rule: - r_id: 27273 - rv_id: 1263528 - rule_id: GdUkxR - version_id: X0Tzy1e - url: https://semgrep.dev/playground/r/X0Tzy1e/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp - origin: community severity: WARNING +- fix-regex: + count: 1 + regex: unsafe_load + replacement: safe_load + id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load languages: - python -- id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load + message: Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, + and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the + YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow + the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` + or `yaml.SafeLoader` instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - cwe: - - 'CWE-502: Deserialization of Untrusted Data' references: - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation - https://nvd.nist.gov/vuln/detail/CVE-2017-18342 - category: security - technology: - - pyyaml - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load - shortlink: https://sg.run/we9Y semgrep.dev: rule: + origin: community r_id: 9673 - rv_id: 1263530 rule_id: ZqU5jZ + rv_id: 1263530 + url: + https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load version_id: 1QTyprw - url: https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load - origin: community - languages: - - python - message: Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and - `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input - could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to - steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` - instead. - fix-regex: - regex: unsafe_load - replacement: safe_load - count: 1 - severity: ERROR + shortlink: https://sg.run/we9Y + source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load + subcategory: + - audit + technology: + - pyyaml + vulnerability_class: + - 'Insecure Deserialization ' patterns: - - pattern-inside: 'import yaml - - ... - - ' - - pattern-not-inside: '$YAML = ruamel.yaml.YAML(...) - - ... - - ' + - pattern-inside: "import yaml\n...\n" + - pattern-not-inside: "$YAML = ruamel.yaml.YAML(...)\n...\n" - pattern-either: - pattern: yaml.unsafe_load(...) - pattern: yaml.load(..., Loader=yaml.Loader, ...) @@ -14138,614 +8211,645 @@ rules: - pattern: yaml.load_all(..., Loader=yaml.Loader, ...) - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...) - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...) + severity: ERROR - id: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel + languages: + - python + message: Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious + actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - cwe: - - 'CWE-502: Deserialization of Untrusted Data' references: - https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ - category: security - technology: - - ruamel.yaml - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel - shortlink: https://sg.run/x1rz semgrep.dev: rule: + origin: community r_id: 9674 - rv_id: 1263531 rule_id: nJUzqK + rv_id: 1263531 + url: + https://semgrep.dev/playground/r/9lT4bvG/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel version_id: 9lT4bvG - url: https://semgrep.dev/playground/r/9lT4bvG/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel - origin: community - languages: - - python - message: Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor - could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead. - severity: ERROR + shortlink: https://sg.run/x1rz + source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel + subcategory: + - audit + technology: + - ruamel.yaml + vulnerability_class: + - 'Insecure Deserialization ' pattern-either: - pattern: ruamel.yaml.YAML(..., typ='unsafe', ...) - pattern: ruamel.yaml.YAML(..., typ='base', ...) + severity: ERROR - id: python.lang.security.deserialization.pickle.avoid-shelve + languages: + - python + message: Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When + unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the + relevant data as JSON or a similar text-based serialization format. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - cwe: - - 'CWE-502: Deserialization of Untrusted Data' references: - https://docs.python.org/3/library/pickle.html - category: security - technology: - - python - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve - shortlink: https://sg.run/dKkZ semgrep.dev: rule: + origin: community r_id: 9678 - rv_id: 1263535 rule_id: 8GUje2 - version_id: NdTzyb4 + rv_id: 1263535 url: https://semgrep.dev/playground/r/NdTzyb4/python.lang.security.deserialization.pickle.avoid-shelve - origin: community - languages: - - python - message: Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, - the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON - or a similar text-based serialization format. - severity: WARNING + version_id: NdTzyb4 + shortlink: https://sg.run/dKkZ + source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve + subcategory: + - audit + technology: + - python + vulnerability_class: + - 'Insecure Deserialization ' pattern: shelve.$FUNC(...) + severity: WARNING - id: python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 - patterns: - - pattern: hashlib.md5(...) - - pattern-not: hashlib.md5(..., usedforsecurity=False, ...) - message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use SHA256 or SHA3 instead. + languages: + - python + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + asvs: + control_id: 6.2.2 Insecure Custom Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + bandit-code: B303 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B303 - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.2 Insecure Custom Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' references: - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - python - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 - shortlink: https://sg.run/vYrY semgrep.dev: rule: + origin: community r_id: 33633 - rv_id: 1263536 rule_id: PeU2e2 + rv_id: 1263536 + url: + https://semgrep.dev/playground/r/kbTzGE1/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 version_id: kbTzGE1 - url: https://semgrep.dev/playground/r/kbTzGE1/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 - origin: community + shortlink: https://sg.run/vYrY + source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Cryptographic Issues + patterns: + - pattern: hashlib.md5(...) + - pattern-not: hashlib.md5(..., usedforsecurity=False, ...) severity: WARNING - languages: - - python -- id: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 - pattern: hashlib.sha1(...) - fix-regex: +- fix-regex: regex: sha1 replacement: sha256 - message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not - suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + id: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + languages: + - python + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore + not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + asvs: + control_id: 6.2.2 Insecure Custom Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + bandit-code: B303 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B303 - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.2 Insecure Custom Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' references: - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - python - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 - shortlink: https://sg.run/ydYx semgrep.dev: rule: + origin: community r_id: 9624 - rv_id: 1263537 rule_id: x8UnBk + rv_id: 1263537 + url: + https://semgrep.dev/playground/r/w8TRoE7/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 version_id: w8TRoE7 - url: https://semgrep.dev/playground/r/w8TRoE7/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 - origin: community + shortlink: https://sg.run/ydYx + source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - python + vulnerability_class: + - Cryptographic Issues + pattern: hashlib.sha1(...) severity: WARNING +- id: python.lang.security.insecure-hash-function.insecure-hash-function languages: - python -- id: python.lang.security.insecure-hash-function.insecure-hash-function - message: Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered - deprecated. Consider using 'SHA256' or a similar function instead. + message: Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are + considered deprecated. Consider using 'SHA256' or a similar function instead. metadata: + asvs: + control_id: 6.2.2 Insecure Custom Algorithm + control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms + section: V6 Stored Cryptography Verification Requirements + version: '4' + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/hashlib_new_insecure_functions.py - asvs: - section: V6 Stored Cryptography Verification Requirements - control_id: 6.2.2 Insecure Custom Algorithm - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms - version: '4' references: - https://tools.ietf.org/html/rfc6151 - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - python - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function - shortlink: https://sg.run/rdBn semgrep.dev: rule: + origin: community r_id: 9625 - rv_id: 1501841 rule_id: OrU30g - version_id: xyT0gk7 + rv_id: 1501841 url: https://semgrep.dev/playground/r/xyT0gk7/python.lang.security.insecure-hash-function.insecure-hash-function - origin: community - languages: - - python - severity: WARNING + version_id: xyT0gk7 + shortlink: https://sg.run/rdBn + source: https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/hashlib_new_insecure_functions.py + subcategory: + - audit + technology: + - python + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - pattern: hashlib.new("=~/[M|m][D|d][4|5]/", ...) - pattern: hashlib.new(..., name="=~/[M|m][D|d][4|5]/", ...) - pattern-not: hashlib.new(..., usedforsecurity=False, ...) -- id: python.lang.security.insecure-uuid-version.insecure-uuid-version - patterns: - - pattern: uuid.uuid1(...) - message: Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, - timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better - randomness and security. - metadata: - references: - - https://www.landh.tech/blog/20230811-sandwich-attack/ - cwe: - - 'CWE-330: Use of Insufficiently Random Values' - owasp: - - A02:2021 - Cryptographic Failures - - A04:2025 - Cryptographic Failures + severity: WARNING +- fix-regex: + regex: uuid1 + replacement: uuid4 + id: python.lang.security.insecure-uuid-version.insecure-uuid-version + languages: + - python + message: Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC + address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` + instead for better randomness and security. + metadata: asvs: - section: V6 Stored Cryptography Verification Requirements control_id: 6.3.2 Insecure UUID Generation control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v63-random-values + section: V6 Stored Cryptography Verification Requirements version: '4' category: security - technology: - - python - subcategory: - - audit - likelihood: LOW - impact: MEDIUM confidence: MEDIUM + cwe: + - 'CWE-330: Use of Insufficiently Random Values' + impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version - shortlink: https://sg.run/BYBgW + likelihood: LOW + owasp: + - A02:2021 - Cryptographic Failures + - A04:2025 - Cryptographic Failures + references: + - https://www.landh.tech/blog/20230811-sandwich-attack/ semgrep.dev: rule: + origin: community r_id: 148295 - rv_id: 1263539 rule_id: kxUd1yD - version_id: O9Tpx97 + rv_id: 1263539 url: https://semgrep.dev/playground/r/O9Tpx97/python.lang.security.insecure-uuid-version.insecure-uuid-version - origin: community - languages: - - python - severity: WARNING - fix-regex: - regex: uuid1 - replacement: uuid4 -- id: python.lang.security.unverified-ssl-context.unverified-ssl-context + version_id: O9Tpx97 + shortlink: https://sg.run/BYBgW + source: https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version + subcategory: + - audit + technology: + - python + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-either: - - pattern: ssl._create_unverified_context(...) - - pattern: ssl._create_default_https_context = ssl._create_unverified_context - fix-regex: + - pattern: uuid.uuid1(...) + severity: WARNING +- fix-regex: regex: _create_unverified_context replacement: create_default_context - message: Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use - 'ssl.create_default_context' instead. + id: python.lang.security.unverified-ssl-context.unverified-ssl-context + languages: + - python + message: Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. + Use 'ssl.create_default_context' instead. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-295: Improper Certificate Validation' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures - cwe: - - 'CWE-295: Improper Certificate Validation' references: - https://docs.python.org/3/library/ssl.html#ssl-security - https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection - category: security - technology: - - python - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context - shortlink: https://sg.run/N4lp semgrep.dev: rule: + origin: community r_id: 9627 - rv_id: 1263540 rule_id: v8UnkQ - version_id: e1Tyjlj + rv_id: 1263540 url: https://semgrep.dev/playground/r/e1Tyjlj/python.lang.security.unverified-ssl-context.unverified-ssl-context - origin: community + version_id: e1Tyjlj + shortlink: https://sg.run/N4lp + source: https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context + subcategory: + - audit + technology: + - python + vulnerability_class: + - Improper Authentication + patterns: + - pattern-either: + - pattern: ssl._create_unverified_context(...) + - pattern: ssl._create_default_https_context = ssl._create_unverified_context severity: ERROR +- fix: defusedxml.etree.ElementTree.parse($...ARGS) + id: python.lang.security.use-defused-xml-parse.use-defused-xml-parse languages: - python -- id: python.lang.security.use-defused-xml-parse.use-defused-xml-parse + message: The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak + confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. + Instead the Python documentation recommends using `defusedxml`. metadata: + category: security + confidence: MEDIUM + cwe: + - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - cwe: - - 'CWE-611: Improper Restriction of XML External Entity Reference' references: - https://docs.python.org/3/library/xml.html - https://github.com/tiran/defusedxml - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing - category: security - technology: - - python - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse - shortlink: https://sg.run/n3jG semgrep.dev: rule: + origin: community r_id: 72436 - rv_id: 1263541 rule_id: X5Uqnx - version_id: vdT06ER + rv_id: 1263541 url: https://semgrep.dev/playground/r/vdT06ER/python.lang.security.use-defused-xml-parse.use-defused-xml-parse - origin: community - message: The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential - data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python - documentation recommends using `defusedxml`. - languages: - - python - severity: ERROR + version_id: vdT06ER + shortlink: https://sg.run/n3jG + source: https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse + subcategory: + - vuln + technology: + - python + vulnerability_class: + - XML Injection patterns: - pattern: xml.etree.ElementTree.parse($...ARGS) - pattern-not: xml.etree.ElementTree.parse("...") - fix: defusedxml.etree.ElementTree.parse($...ARGS) + severity: ERROR - id: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish - message: Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure - and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such - as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, - such as GCM. + languages: + - python + message: Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically + secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block + cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that + also provides authentication, such as GCM. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + bandit-code: B304 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption - https://www.pycryptodome.org/src/cipher/cipher - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::symmetric-algorithm::pycryptodome - - crypto::search::symmetric-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish - shortlink: https://sg.run/dlOE semgrep.dev: rule: + origin: community r_id: 33634 - rv_id: 1263545 rule_id: JDUGnK + rv_id: 1263545 + url: + https://semgrep.dev/playground/r/ExTExln/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish version_id: ExTExln - url: https://semgrep.dev/playground/r/ExTExln/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish - origin: community + shortlink: https://sg.run/dlOE + source: + https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - severity: WARNING - languages: - - python pattern-either: - pattern: Cryptodome.Cipher.Blowfish.new(...) - pattern: Crypto.Cipher.Blowfish.new(...) + severity: WARNING - id: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des - message: Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically - secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream - ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using - a block cipher, use a modern mode of operation that also provides authentication, such as GCM. + languages: + - python + message: Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not + cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package + instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a + block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, + such as GCM. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + bandit-code: B304 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://cwe.mitre.org/data/definitions/326.html - https://www.pycryptodome.org/src/cipher/cipher - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::symmetric-algorithm::pycryptodome - - crypto::search::symmetric-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des - shortlink: https://sg.run/Z5bw semgrep.dev: rule: + origin: community r_id: 33635 - rv_id: 1263546 rule_id: 5rUr73 + rv_id: 1263546 + url: + https://semgrep.dev/playground/r/7ZTE3G7/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des version_id: 7ZTE3G7 - url: https://semgrep.dev/playground/r/7ZTE3G7/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des - origin: community + shortlink: https://sg.run/Z5bw + source: + https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - severity: WARNING - languages: - - python pattern-either: - pattern: Cryptodome.Cipher.DES.new(...) - pattern: Crypto.Cipher.DES.new(...) - pattern: Cryptodome.Cipher.DES3.new(...) - pattern: Crypto.Cipher.DES3.new(...) + severity: WARNING - id: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 - message: Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and - can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES - with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, - such as GCM. + languages: + - python + message: Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure + and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher + such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also + provides authentication, such as GCM. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + bandit-code: B304 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://cwe.mitre.org/data/definitions/326.html - https://www.pycryptodome.org/src/cipher/cipher - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::symmetric-algorithm::pycryptodome - - crypto::search::symmetric-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 - shortlink: https://sg.run/nAbY semgrep.dev: rule: + origin: community r_id: 33636 - rv_id: 1263547 rule_id: GdUYlW + rv_id: 1263547 + url: + https://semgrep.dev/playground/r/LjTkgn6/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 version_id: LjTkgn6 - url: https://semgrep.dev/playground/r/LjTkgn6/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 - origin: community + shortlink: https://sg.run/nAbY + source: + https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - severity: WARNING - languages: - - python pattern-either: - pattern: Cryptodome.Cipher.ARC2.new(...) - pattern: Crypto.Cipher.ARC2.new(...) + severity: WARNING - id: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 - message: Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and - can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES - with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, - such as GCM. + languages: + - python + message: Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure + and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher + such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also + provides authentication, such as GCM. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + bandit-code: B304 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::symmetric-algorithm::pycryptodome + - crypto::search::symmetric-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://cwe.mitre.org/data/definitions/326.html - https://www.pycryptodome.org/src/cipher/cipher - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::symmetric-algorithm::pycryptodome - - crypto::search::symmetric-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 - shortlink: https://sg.run/Eo6N semgrep.dev: rule: + origin: community r_id: 33637 - rv_id: 1263548 rule_id: ReUnEB + rv_id: 1263548 + url: + https://semgrep.dev/playground/r/8KT5rXY/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 version_id: 8KT5rXY - url: https://semgrep.dev/playground/r/8KT5rXY/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/Eo6N + source: + https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: Cryptodome.Cipher.ARC4.new(...) - pattern: Crypto.Cipher.ARC4.new(...) + severity: WARNING - id: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor - message: Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and - can be reversed easily. Use AES instead. + languages: + - python + message: Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure + and can be reversed easily. Use AES instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + bandit-code: B304 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - bandit-code: B304 references: - https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor - shortlink: https://sg.run/L0yr semgrep.dev: rule: + origin: community r_id: 9683 - rv_id: 1263549 rule_id: PeUk5W + rv_id: 1263549 + url: + https://semgrep.dev/playground/r/gETB7j3/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor version_id: gETB7j3 - url: https://semgrep.dev/playground/r/gETB7j3/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/L0yr + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: Cryptodome.Cipher.XOR.new(...) - pattern: Crypto.Cipher.XOR.new(...) + severity: WARNING - id: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 - message: Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. + languages: + - python + message: Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::hash-algorithm::pycryptodome + - crypto::search::hash-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -14756,45 +8860,47 @@ rules: - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::hash-algorithm::pycryptodome - - crypto::search::hash-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 - shortlink: https://sg.run/7JP2 semgrep.dev: rule: + origin: community r_id: 33638 - rv_id: 1263550 rule_id: AbU0Ex + rv_id: 1263550 + url: + https://semgrep.dev/playground/r/QkTGqD8/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 version_id: QkTGqD8 - url: https://semgrep.dev/playground/r/QkTGqD8/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 - origin: community + shortlink: https://sg.run/7JP2 + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - severity: WARNING - languages: - - python pattern-either: - pattern: Crypto.Hash.MD2.new(...) - pattern: Cryptodome.Hash.MD2.new (...) + severity: WARNING - id: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 - message: Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. + languages: + - python + message: Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::hash-algorithm::pycryptodome + - crypto::search::hash-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -14805,45 +8911,47 @@ rules: - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::hash-algorithm::pycryptodome - - crypto::search::hash-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 - shortlink: https://sg.run/Lve6 semgrep.dev: rule: + origin: community r_id: 33639 - rv_id: 1263551 rule_id: BYUJy4 + rv_id: 1263551 + url: + https://semgrep.dev/playground/r/3ZT4Xnp/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 version_id: 3ZT4Xnp - url: https://semgrep.dev/playground/r/3ZT4Xnp/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 - origin: community + shortlink: https://sg.run/Lve6 + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - severity: WARNING - languages: - - python pattern-either: - pattern: Crypto.Hash.MD4.new(...) - pattern: Cryptodome.Hash.MD4.new (...) + severity: WARNING - id: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 - message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable - as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. + languages: + - python + message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not + suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + functional-categories: + - crypto::search::hash-algorithm::pycryptodome + - crypto::search::hash-algorithm::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -14854,45 +8962,44 @@ rules: - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::hash-algorithm::pycryptodome - - crypto::search::hash-algorithm::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 - shortlink: https://sg.run/85JN semgrep.dev: rule: + origin: community r_id: 33640 - rv_id: 1263552 rule_id: DbUXwo + rv_id: 1263552 + url: + https://semgrep.dev/playground/r/44TEjpk/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 version_id: 44TEjpk - url: https://semgrep.dev/playground/r/44TEjpk/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 - origin: community + shortlink: https://sg.run/85JN + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - severity: WARNING - languages: - - python pattern-either: - pattern: Crypto.Hash.MD5.new(...) - pattern: Cryptodome.Hash.MD5.new (...) + severity: WARNING - id: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 - message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not - suitable as a cryptographic signature. Use SHA256 or SHA3 instead. + languages: + - python + message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore + not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: - source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures @@ -14902,75 +9009,72 @@ rules: - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 - shortlink: https://sg.run/3ALr semgrep.dev: rule: + origin: community r_id: 9687 - rv_id: 1263553 rule_id: ReUPO3 + rv_id: 1263553 + url: + https://semgrep.dev/playground/r/PkTR3vk/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 version_id: PkTR3vk - url: https://semgrep.dev/playground/r/PkTR3vk/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/3ALr + source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 + source-rule-url: + https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues pattern-either: - pattern: Crypto.Hash.SHA.new(...) - pattern: Cryptodome.Hash.SHA.new (...) + severity: WARNING - id: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size + languages: + - python message: Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher. metadata: + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::key-length::pycryptodome + - crypto::search::key-length::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://www.pycryptodome.org/src/public_key/dsa - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::key-length::pycryptodome - - crypto::search::key-length::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size - shortlink: https://sg.run/4y8l semgrep.dev: rule: + origin: community r_id: 9688 - rv_id: 1263554 rule_id: AbUWje + rv_id: 1263554 + url: + https://semgrep.dev/playground/r/JdTzxbQ/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size version_id: JdTzxbQ - url: https://semgrep.dev/playground/r/JdTzxbQ/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size - origin: community + shortlink: https://sg.run/4y8l + source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - languages: - - python - severity: WARNING patterns: - pattern-either: - pattern: Crypto.PublicKey.DSA.generate(..., bits=$SIZE, ...) @@ -14978,50 +9082,52 @@ rules: - pattern: Cryptodome.PublicKey.DSA.generate(..., bits=$SIZE, ...) - pattern: Cryptodome.PublicKey.DSA.generate($SIZE, ...) - metavariable-comparison: - metavariable: $SIZE comparison: $SIZE < 2048 + metavariable: $SIZE + severity: WARNING - id: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size + languages: + - python message: Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher. metadata: + category: security + confidence: HIGH cwe: - 'CWE-326: Inadequate Encryption Strength' + functional-categories: + - crypto::search::key-length::pycryptodome + - crypto::search::key-length::pycryptodomex + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://www.pycryptodome.org/src/public_key/rsa#rsa - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf - category: security - technology: - - pycryptodome - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: HIGH - functional-categories: - - crypto::search::key-length::pycryptodome - - crypto::search::key-length::pycryptodomex - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size - shortlink: https://sg.run/PprY semgrep.dev: rule: + origin: community r_id: 9689 - rv_id: 1263555 rule_id: BYUBWe + rv_id: 1263555 + url: + https://semgrep.dev/playground/r/5PTo1jL/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size version_id: 5PTo1jL - url: https://semgrep.dev/playground/r/5PTo1jL/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size - origin: community + shortlink: https://sg.run/PprY + source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size + source-rule-url: + https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py + subcategory: + - vuln + technology: + - pycryptodome + vulnerability_class: + - Cryptographic Issues options: symbolic_propagation: true - languages: - - python - severity: WARNING patterns: - pattern-either: - pattern: Crypto.PublicKey.RSA.generate(..., bits=$SIZE, ...) @@ -15029,58 +9135,52 @@ rules: - pattern: Cryptodome.PublicKey.RSA.generate(..., bits=$SIZE, ...) - pattern: Cryptodome.PublicKey.RSA.generate($SIZE, ...) - metavariable-comparison: - metavariable: $SIZE comparison: $SIZE < 3072 + metavariable: $SIZE + severity: WARNING - id: python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication - message: 'An encryption mode of operation is being used without proper message authentication. This can potentially result - in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ' languages: - python - severity: ERROR + message: 'An encryption mode of operation is being used without proper message authentication. This can potentially result + in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ' metadata: category: security - technology: - - cryptography + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication - shortlink: https://sg.run/k1K1 semgrep.dev: rule: + origin: community r_id: 31872 - rv_id: 1263556 rule_id: YGUw8w + rv_id: 1263556 + url: + https://semgrep.dev/playground/r/GxTkeyz/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication version_id: GxTkeyz - url: https://semgrep.dev/playground/r/GxTkeyz/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication - origin: community + shortlink: https://sg.run/k1K1 + source: + https://semgrep.dev/r/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication + subcategory: + - vuln + technology: + - cryptography + vulnerability_class: + - Cryptographic Issues patterns: - pattern-either: - patterns: - pattern-either: - - pattern: 'AES.new(..., $PYCRYPTODOME_MODE) - - ' - - pattern-not-inside: 'AES.new(..., $PYCRYPTODOME_MODE) - - ... - - HMAC.new - - ' + - pattern: "AES.new(..., $PYCRYPTODOME_MODE)\n" + - pattern-not-inside: "AES.new(..., $PYCRYPTODOME_MODE)\n...\nHMAC.new\n" - metavariable-pattern: metavariable: $PYCRYPTODOME_MODE patterns: @@ -15089,45 +9189,81 @@ rules: - pattern: AES.MODE_CTR - pattern: AES.MODE_CFB - pattern: AES.MODE_OFB -- id: python.pymongo.security.mongodb.mongo-client-bad-auth - pattern: 'pymongo.MongoClient(..., authMechanism=''MONGODB-CR'') - - ' - message: Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see - https://api.mongodb.com/python/current/examples/authentication.html for details). - fix-regex: + severity: ERROR +- fix-regex: regex: MONGODB-CR replacement: SCRAM-SHA-256 - severity: WARNING + id: python.pymongo.security.mongodb.mongo-client-bad-auth languages: - python + message: Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 + (see https://api.mongodb.com/python/current/examples/authentication.html for details). metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-477: Use of Obsolete Function' - category: security - technology: - - pymongo + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW references: - https://cwe.mitre.org/data/definitions/477.html + semgrep.dev: + rule: + origin: community + r_id: 12658 + rule_id: d8UlOX + rv_id: 946422 + url: https://semgrep.dev/playground/r/0bT15XY/python.pymongo.security.mongodb.mongo-client-bad-auth + version_id: 0bT15XY + shortlink: https://sg.run/YXRd + source: https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth subcategory: - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - pymongo vulnerability_class: - Dangerous Method or Function - source: https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth - shortlink: https://sg.run/YXRd + pattern: "pymongo.MongoClient(..., authMechanism='MONGODB-CR')\n" + severity: WARNING +- fix: "$...PARAMS, httponly=True\n" + id: python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + languages: + - python + message: Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies + should be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not + properly protected and are at risk of being stolen by an attacker. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration + references: + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration semgrep.dev: rule: - r_id: 12658 - rv_id: 946422 - rule_id: d8UlOX - version_id: 0bT15XY - url: https://semgrep.dev/playground/r/0bT15XY/python.pymongo.security.mongodb.mongo-client-bad-auth origin: community -- id: python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + r_id: 21437 + rule_id: bwUXKB + rv_id: 1263557 + url: + https://semgrep.dev/playground/r/RGT0L7K/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + version_id: RGT0L7K + shortlink: https://sg.run/EprB + source: + https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - pattern: pyramid.authentication.$FUNC($...PARAMS) - metavariable-pattern: @@ -15138,45 +9274,45 @@ rules: - pattern-not: pyramid.authentication.$FUNC(..., httponly=$HTTPONLY, ...) - pattern-not: pyramid.authentication.$FUNC(..., **$PARAMS, ...) - focus-metavariable: $...PARAMS - fix: '$...PARAMS, httponly=True - - ' - message: Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should - be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected - and are at risk of being stolen by an attacker. + severity: WARNING +- fix: "True\n" + id: python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value + languages: + - python + message: Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies + should be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not + properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + semgrep.dev: + rule: + origin: community + r_id: 21438 + rule_id: NbUq9e + rv_id: 1263558 + url: + https://semgrep.dev/playground/r/A8Tgd8N/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value + version_id: A8Tgd8N + shortlink: https://sg.run/7DgQ + source: + https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value subcategory: - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - pyramid vulnerability_class: - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default - shortlink: https://sg.run/EprB - semgrep.dev: - rule: - r_id: 21437 - rv_id: 1263557 - rule_id: bwUXKB - version_id: RGT0L7K - url: https://semgrep.dev/playground/r/RGT0L7K/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value patterns: - pattern-either: - patterns: @@ -15188,48 +9324,45 @@ rules: - pattern: $HTTPONLY - metavariable-pattern: metavariable: $HTTPONLY - pattern: 'False - - ' - fix: 'True - - ' - message: Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should - be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected - and are at risk of being stolen by an attacker. + pattern: "False\n" + severity: WARNING +- fix: "'Lax'\n" + id: python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite + languages: + - python + message: Found a Pyramid Authentication Ticket without the samesite option correctly set. Pyramid cookies should be + handled securely by setting samesite='Lax'. If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - - A05:2021 - Security Misconfiguration - - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control references: - - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + - https://owasp.org/Top10/A01_2021-Broken_Access_Control + semgrep.dev: + rule: + origin: community + r_id: 21439 + rule_id: kxUYjY + rv_id: 1263559 + url: + https://semgrep.dev/playground/r/BjTkZ51/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite + version_id: BjTkZ51 + shortlink: https://sg.run/LYrY + source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite subcategory: - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - pyramid vulnerability_class: - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value - shortlink: https://sg.run/7DgQ - semgrep.dev: - rule: - r_id: 21438 - rv_id: 1263558 - rule_id: NbUq9e - version_id: A8Tgd8N - url: https://semgrep.dev/playground/r/A8Tgd8N/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite patterns: - pattern-either: - pattern: pyramid.authentication.AuthTktCookieHelper(..., samesite=$SAMESITE, ...) @@ -15238,45 +9371,47 @@ rules: - metavariable-regex: metavariable: $SAMESITE regex: (?!'Lax') - fix: '''Lax'' - - ' - message: Found a Pyramid Authentication Ticket without the samesite option correctly set. Pyramid cookies should be handled - securely by setting samesite='Lax'. If this parameter is not properly set, your cookies are not properly protected and - are at risk of being stolen by an attacker. + severity: WARNING +- fix-regex: + regex: (.*)\) + replacement: \1, secure=True) + id: python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default + languages: + - python + message: Found a Pyramid Authentication Ticket cookie using an unsafe default for the secure option. Pyramid cookies + should be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not + properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - category: security - technology: - - pyramid + - A05:2021 - Security Misconfiguration + - A02:2025 - Security Misconfiguration references: - - https://owasp.org/Top10/A01_2021-Broken_Access_Control + - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + semgrep.dev: + rule: + origin: community + r_id: 21440 + rule_id: wdUKzn + rv_id: 1263560 + url: + https://semgrep.dev/playground/r/DkTRbJn/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default + version_id: DkTRbJn + shortlink: https://sg.run/8WxQ + source: + https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default subcategory: - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - pyramid vulnerability_class: - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite - shortlink: https://sg.run/LYrY - semgrep.dev: - rule: - r_id: 21439 - rv_id: 1263559 - rule_id: kxUYjY - version_id: BjTkZ51 - url: https://semgrep.dev/playground/r/BjTkZ51/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default patterns: - pattern-either: - patterns: @@ -15287,45 +9422,45 @@ rules: - pattern-not: pyramid.authentication.AuthTktAuthenticationPolicy(..., secure=$SECURE, ...) - pattern-not: pyramid.authentication.AuthTktAuthenticationPolicy(..., **$PARAMS) - pattern: pyramid.authentication.AuthTktAuthenticationPolicy(...) - fix-regex: - regex: (.*)\) - replacement: \1, secure=True) - message: Found a Pyramid Authentication Ticket cookie using an unsafe default for the secure option. Pyramid cookies should - be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected - and are at risk of being stolen by an attacker. + severity: WARNING +- fix: "True\n" + id: python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value + languages: + - python + message: Found a Pyramid Authentication Ticket cookie without the secure option correctly set. Pyramid cookies should + be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly + protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration + semgrep.dev: + rule: + origin: community + r_id: 21441 + rule_id: x8UqAp + rv_id: 1263561 + url: + https://semgrep.dev/playground/r/WrTqK93/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value + version_id: WrTqK93 + shortlink: https://sg.run/gjp5 + source: + https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value subcategory: - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + technology: + - pyramid vulnerability_class: - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default - shortlink: https://sg.run/8WxQ - semgrep.dev: - rule: - r_id: 21440 - rv_id: 1263560 - rule_id: wdUKzn - version_id: DkTRbJn - url: https://semgrep.dev/playground/r/DkTRbJn/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value patterns: - pattern-either: - patterns: @@ -15337,218 +9472,172 @@ rules: - pattern: $SECURE - metavariable-pattern: metavariable: $SECURE - pattern: 'False - - ' - fix: 'True - - ' - message: Found a Pyramid Authentication Ticket cookie without the secure option correctly set. Pyramid cookies should be - handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected - and are at risk of being stolen by an attacker. - metadata: - cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' - owasp: - - A05:2021 - Security Misconfiguration - - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid - references: - - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value - shortlink: https://sg.run/gjp5 - semgrep.dev: - rule: - r_id: 21441 - rv_id: 1263561 - rule_id: x8UqAp - version_id: WrTqK93 - url: https://semgrep.dev/playground/r/WrTqK93/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value - origin: community - languages: - - python + pattern: "False\n" severity: WARNING -- id: python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally - patterns: - - pattern-inside: '$CONFIG.set_default_csrf_options(..., check_origin=$CHECK_ORIGIN, ...) - - ' - - pattern: $CHECK_ORIGIN - - metavariable-comparison: - metavariable: $CHECK_ORIGIN - comparison: $CHECK_ORIGIN == False - message: Automatic check of the referrer for cross-site request forgery tokens has been explicitly disabled globally, which - might leave views unprotected when an unsafe CSRF storage policy is used. Use 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)' - to turn the automatic check for all unsafe methods (per RFC2616). +- fix: "True\n" + id: python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally languages: - python - severity: ERROR - fix: 'True - - ' + message: Automatic check of the referrer for cross-site request forgery tokens has been explicitly disabled globally, + which might leave views unprotected when an unsafe CSRF storage policy is used. Use + 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)' to turn the automatic check for all unsafe + methods (per RFC2616). metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site Request Forgery (CSRF) - source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally - shortlink: https://sg.run/3GeW semgrep.dev: rule: + origin: community r_id: 21443 - rv_id: 1263563 rule_id: eqU9Le + rv_id: 1263563 + url: + https://semgrep.dev/playground/r/K3TKkeo/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally version_id: K3TKkeo - url: https://semgrep.dev/playground/r/K3TKkeo/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally - origin: community -- id: python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled - message: Origin check for the CSRF token is disabled for this view. This might represent a security risk if the CSRF storage - policy is not known to be secure. + shortlink: https://sg.run/3GeW + source: + https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + patterns: + - pattern-inside: "$CONFIG.set_default_csrf_options(..., check_origin=$CHECK_ORIGIN, ...)\n" + - pattern: $CHECK_ORIGIN + - metavariable-comparison: + comparison: $CHECK_ORIGIN == False + metavariable: $CHECK_ORIGIN + severity: ERROR +- fix: "True\n" + id: python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled + languages: + - python + message: Origin check for the CSRF token is disabled for this view. This might represent a security risk if the CSRF + storage policy is not known to be secure. metadata: - cwe: - - 'CWE-352: Cross-Site Request Forgery (CSRF)' - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control asvs: - section: V4 Access Control control_id: 4.2.2 CSRF - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control + section: V4 Access Control version: '4' category: security - technology: - - pyramid - references: - - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2022-top25: true + confidence: MEDIUM + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW + cwe2022-top25: true impact: LOW - confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site Request Forgery (CSRF) - source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled - shortlink: https://sg.run/4RB9 + likelihood: LOW + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control semgrep.dev: rule: + origin: community r_id: 21444 - rv_id: 1263564 rule_id: v8UGpL + rv_id: 1263564 + url: + https://semgrep.dev/playground/r/qkTR7Gv/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled version_id: qkTR7Gv - url: https://semgrep.dev/playground/r/qkTR7Gv/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled - origin: community - severity: WARNING - languages: - - python + shortlink: https://sg.run/4RB9 + source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cross-Site Request Forgery (CSRF) patterns: - pattern-inside: "from pyramid.view import view_config\n...\n@view_config(..., check_origin=$CHECK_ORIGIN, ...)\ndef $VIEW(...):\n\ \ ...\n" - pattern: $CHECK_ORIGIN - metavariable-comparison: - metavariable: $CHECK_ORIGIN comparison: $CHECK_ORIGIN == False - fix: 'True - - ' -- id: python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default - patterns: - - pattern-either: - - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ - \ ...\n" - - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" - - pattern-not: $RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...) - - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) - - pattern: $RESPONSE.set_cookie(...) - fix-regex: + metavariable: $CHECK_ORIGIN + severity: WARNING +- fix-regex: regex: (.*)\) replacement: \1, httponly=True) - message: Found a Pyramid cookie using an unsafe default for the httponly option. Pyramid cookies should be handled securely - by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly - protected and are at risk of being stolen by an attacker. + id: python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default + languages: + - python + message: Found a Pyramid cookie using an unsafe default for the httponly option. Pyramid cookies should be handled + securely by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies + are not properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default - shortlink: https://sg.run/P19v semgrep.dev: rule: + origin: community r_id: 21445 - rv_id: 1263565 rule_id: d8UPQ7 + rv_id: 1263565 + url: + https://semgrep.dev/playground/r/l4TJRbo/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default version_id: l4TJRbo - url: https://semgrep.dev/playground/r/l4TJRbo/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value + shortlink: https://sg.run/P19v + source: + https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - pattern-either: - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ \ ...\n" - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" - - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) - - pattern: $RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...) - - pattern: $HTTPONLY - - metavariable-pattern: - metavariable: $HTTPONLY - pattern: 'False - - ' - fix: 'True - - ' - message: Found a Pyramid cookie without the httponly option correctly set. Pyramid cookies should be handled securely by - setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly - protected and are at risk of being stolen by an attacker. + - pattern-not: $RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...) + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(...) + severity: WARNING +- fix: "True\n" + id: python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value + languages: + - python + message: Found a Pyramid cookie without the httponly option correctly set. Pyramid cookies should be handled securely + by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not + properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' + - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration @@ -15556,401 +9645,387 @@ rules: - https://owasp.org/www-community/controls/SecureCookieAttribute - https://owasp.org/www-community/HttpOnly - https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#httponly-attribute - category: security - technology: - - pyramid - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value - shortlink: https://sg.run/JbqP semgrep.dev: rule: + origin: community r_id: 21446 - rv_id: 1263566 rule_id: ZqU37W + rv_id: 1263566 + url: + https://semgrep.dev/playground/r/YDTZe54/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value version_id: YDTZe54 - url: https://semgrep.dev/playground/r/YDTZe54/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default + shortlink: https://sg.run/JbqP + source: + https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - pattern-either: - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ \ ...\n" - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" - - pattern-not: $RESPONSE.set_cookie(..., samesite=$SAMESITE, ...) - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) - - pattern: $RESPONSE.set_cookie(...) - fix-regex: + - pattern: $RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...) + - pattern: $HTTPONLY + - metavariable-pattern: + metavariable: $HTTPONLY + pattern: "False\n" + severity: WARNING +- fix-regex: regex: (.*)\) replacement: \1, samesite='Lax') - message: Found a Pyramid cookie using an unsafe value for the samesite option. Pyramid cookies should be handled securely - by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly - protected and are at risk of being stolen by an attacker. + id: python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default + languages: + - python + message: Found a Pyramid cookie using an unsafe value for the samesite option. Pyramid cookies should be handled + securely by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies + are not properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default - shortlink: https://sg.run/5AWj semgrep.dev: rule: + origin: community r_id: 21447 - rv_id: 1263567 rule_id: nJUp80 + rv_id: 1263567 + url: + https://semgrep.dev/playground/r/6xT293z/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default version_id: 6xT293z - url: https://semgrep.dev/playground/r/6xT293z/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value + shortlink: https://sg.run/5AWj + source: + https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - pattern-either: - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ \ ...\n" - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., samesite=$SAMESITE, ...) - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) - - pattern: $RESPONSE.set_cookie(..., samesite=$SAMESITE, ...) - - pattern: $SAMESITE - - metavariable-regex: - metavariable: $SAMESITE - regex: (?!'Lax') - fix: '''Lax'' - - ' - message: Found a Pyramid cookie without the samesite option correctly set. Pyramid cookies should be handled securely by - setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly - protected and are at risk of being stolen by an attacker. + - pattern: $RESPONSE.set_cookie(...) + severity: WARNING +- fix: "'Lax'\n" + id: python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value + languages: + - python + message: Found a Pyramid cookie without the samesite option correctly set. Pyramid cookies should be handled securely + by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not + properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value - shortlink: https://sg.run/GXR6 semgrep.dev: rule: + origin: community r_id: 21448 - rv_id: 1263568 rule_id: EwUgpY + rv_id: 1263568 + url: + https://semgrep.dev/playground/r/o5TbDv5/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value version_id: o5TbDv5 - url: https://semgrep.dev/playground/r/o5TbDv5/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default + shortlink: https://sg.run/GXR6 + source: + https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - pattern-either: - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ \ ...\n" - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" - - pattern-not: $RESPONSE.set_cookie(..., secure=$SECURE, ...) - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) - - pattern: $RESPONSE.set_cookie(...) - fix-regex: + - pattern: $RESPONSE.set_cookie(..., samesite=$SAMESITE, ...) + - pattern: $SAMESITE + - metavariable-regex: + metavariable: $SAMESITE + regex: (?!'Lax') + severity: WARNING +- fix-regex: regex: (.*)\) replacement: \1, secure=True) - message: Found a Pyramid cookie using an unsafe default for the secure option. Pyramid cookies should be handled securely - by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly - protected and are at risk of being stolen by an attacker. + id: python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default + languages: + - python + message: Found a Pyramid cookie using an unsafe default for the secure option. Pyramid cookies should be handled + securely by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are + not properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default - shortlink: https://sg.run/RbrN semgrep.dev: rule: + origin: community r_id: 21449 - rv_id: 1263569 rule_id: 7KUr15 + rv_id: 1263569 + url: + https://semgrep.dev/playground/r/zyTb2dX/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default version_id: zyTb2dX - url: https://semgrep.dev/playground/r/zyTb2dX/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value + shortlink: https://sg.run/RbrN + source: + https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - pattern-either: - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ \ ...\n" - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., secure=$SECURE, ...) - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) - - pattern: $RESPONSE.set_cookie(..., secure=$SECURE, ...) - - pattern: $SECURE - - metavariable-pattern: - metavariable: $SECURE - pattern: 'False - - ' - fix: 'True - - ' - message: Found a Pyramid cookie without the secure option correctly set. Pyramid cookies should be handled securely by setting - secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected - and are at risk of being stolen by an attacker. + - pattern: $RESPONSE.set_cookie(...) + severity: WARNING +- fix: "True\n" + id: python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value + languages: + - python + message: Found a Pyramid cookie without the secure option correctly set. Pyramid cookies should be handled securely by + setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not + properly protected and are at risk of being stolen by an attacker. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' + - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cookie Security - source: https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value - shortlink: https://sg.run/AzjB semgrep.dev: rule: + origin: community r_id: 21450 - rv_id: 1263570 rule_id: L1UX2J + rv_id: 1263570 + url: + https://semgrep.dev/playground/r/pZT03oJ/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value version_id: pZT03oJ - url: https://semgrep.dev/playground/r/pZT03oJ/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value - origin: community - languages: - - python - severity: WARNING -- id: python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally + shortlink: https://sg.run/AzjB + source: + https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cookie Security patterns: - - pattern-inside: '$CONFIG.set_default_csrf_options(..., require_csrf=$REQUIRE_CSRF, ...) - - ' - - pattern: $REQUIRE_CSRF - - metavariable-comparison: - metavariable: $REQUIRE_CSRF - comparison: $REQUIRE_CSRF == False - message: Automatic check of cross-site request forgery tokens has been explicitly disabled globally, which might leave views - unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)' to turn the automatic check - for all unsafe methods (per RFC2616). + - pattern-either: + - pattern-inside: "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n ...\n $RESPONSE = $REQUEST.response\n\ + \ ...\n" + - pattern-inside: "def $VIEW(...):\n ...\n $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n ...\n" + - pattern-not: $RESPONSE.set_cookie(..., **$PARAMS) + - pattern: $RESPONSE.set_cookie(..., secure=$SECURE, ...) + - pattern: $SECURE + - metavariable-pattern: + metavariable: $SECURE + pattern: "False\n" + severity: WARNING +- fix: "True\n" + id: python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally languages: - python - severity: ERROR - fix: 'True - - ' + message: Automatic check of cross-site request forgery tokens has been explicitly disabled globally, which might leave + views unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)' to turn the + automatic check for all unsafe methods (per RFC2616). metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: LOW - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site Request Forgery (CSRF) - source: https://semgrep.dev/r/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally - shortlink: https://sg.run/Bx2R semgrep.dev: rule: + origin: community r_id: 21451 - rv_id: 1263571 rule_id: 8GUKqP + rv_id: 1263571 + url: + https://semgrep.dev/playground/r/2KTv2en/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally version_id: 2KTv2en - url: https://semgrep.dev/playground/r/2KTv2en/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally - origin: community + shortlink: https://sg.run/Bx2R + source: + https://semgrep.dev/r/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + patterns: + - pattern-inside: "$CONFIG.set_default_csrf_options(..., require_csrf=$REQUIRE_CSRF, ...)\n" + - pattern: $REQUIRE_CSRF + - metavariable-comparison: + comparison: $REQUIRE_CSRF == False + metavariable: $REQUIRE_CSRF + severity: ERROR - id: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response - message: Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting - (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML. + languages: + - python + message: Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site + scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render + HTML. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - pyramid references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response - shortlink: https://sg.run/DX8G semgrep.dev: rule: + origin: community r_id: 21452 - rv_id: 1263572 rule_id: gxUeA8 + rv_id: 1263572 + url: + https://semgrep.dev/playground/r/X0TzyEe/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response version_id: X0TzyEe - url: https://semgrep.dev/playground/r/X0TzyEe/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response - origin: community - languages: - - python - severity: ERROR + shortlink: https://sg.run/DX8G + source: https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - Cross-Site-Scripting (XSS) mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern: "pyramid.request.Response.text($SINK)\n" + - pattern: "pyramid.request.Response($SINK)\n" + - pattern: "$REQ.response.body = $SINK\n" + - pattern: "$REQ.response.text = $SINK\n" + - pattern: "$REQ.response.ubody = $SINK\n" + - pattern: "$REQ.response.unicode_body = $SINK\n" + - pattern: $SINK pattern-sources: - patterns: - pattern-inside: "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n ...\n" - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - pattern-sinks: - - patterns: - - pattern-either: - - pattern: 'pyramid.request.Response.text($SINK) - - ' - - pattern: 'pyramid.request.Response($SINK) - - ' - - pattern: '$REQ.response.body = $SINK - - ' - - pattern: '$REQ.response.text = $SINK - - ' - - pattern: '$REQ.response.ubody = $SINK - - ' - - pattern: '$REQ.response.unicode_body = $SINK - - ' - - pattern: $SINK -- id: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection - message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs - raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL - into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function - besides "bindparams". Use bindParams to securely bind user-input to SQL statements. + severity: ERROR +- fix-regex: + regex: format + replacement: bindparams + id: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection languages: - python - severity: ERROR + message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer + inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs + raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with + any function besides "bindparams". Use bindParams to securely bind user-input to SQL statements. metadata: category: security + confidence: MEDIUM cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data - technology: - - pyramid - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection - shortlink: https://sg.run/W7eE semgrep.dev: rule: + origin: community r_id: 21453 - rv_id: 1263573 rule_id: QrUZ7l + rv_id: 1263573 + url: + https://semgrep.dev/playground/r/jQTn5WA/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection version_id: jQTn5WA - url: https://semgrep.dev/playground/r/jQTn5WA/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection - origin: community + shortlink: https://sg.run/W7eE + source: https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection + subcategory: + - vuln + technology: + - pyramid + vulnerability_class: + - SQL Injection mode: taint - pattern-sources: - - patterns: - - pattern-inside: "from pyramid.view import view_config\n...\n@view_config( ... )\ndef $VIEW($REQ):\n ...\n" - - pattern: $REQ.$ANYTHING - - pattern-not: $REQ.dbsession pattern-sinks: - patterns: - - pattern-inside: '$QUERY = $REQ.dbsession.query(...) - - ... - - ' + - pattern-inside: "$QUERY = $REQ.dbsession.query(...)\n...\n" - pattern-either: - - pattern: '$QUERY.$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...)) - - ' - - pattern: '$QUERY.join(...).$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...)) - - ' + - pattern: "$QUERY.$SQLFUNC(\"...\".$FORMATFUNC(..., $SINK, ...))\n" + - pattern: "$QUERY.join(...).$SQLFUNC(\"...\".$FORMATFUNC(..., $SINK, ...))\n" - pattern: $SINK - metavariable-regex: metavariable: $SQLFUNC @@ -15958,87 +10033,121 @@ rules: - metavariable-regex: metavariable: $FORMATFUNC regex: (?!bindparams) - fix-regex: - regex: format - replacement: bindparams + pattern-sources: + - patterns: + - pattern-inside: "from pyramid.view import view_config\n...\n@view_config( ... )\ndef $VIEW($REQ):\n ...\n" + - pattern: $REQ.$ANYTHING + - pattern-not: $REQ.dbsession + severity: ERROR - id: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text + languages: + - python + message: sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the + usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can + reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL. + metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A01:2017 - Injection + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql + semgrep.dev: + rule: + origin: community + r_id: 15824 + rule_id: r6U2wE + rv_id: 1263577 + url: + https://semgrep.dev/playground/r/rxTAKqq/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text + version_id: rxTAKqq + shortlink: https://sg.run/yP1O + source: https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text + subcategory: + - audit + technology: + - sqlalchemy + vulnerability_class: + - SQL Injection mode: taint pattern-sinks: - - pattern: 'sqlalchemy.text(...) - - ' + - pattern: "sqlalchemy.text(...)\n" pattern-sources: - patterns: - - pattern: '$X + $Y - - ' + - pattern: "$X + $Y\n" - metavariable-type: metavariable: $X type: string - patterns: - - pattern: '$X + $Y - - ' + - pattern: "$X + $Y\n" - metavariable-type: metavariable: $Y type: string - patterns: - - pattern: 'f"..." - - ' + - pattern: "f\"...\"\n" - patterns: - - pattern: '$X.format(...) - - ' + - pattern: "$X.format(...)\n" - metavariable-type: metavariable: $X type: string - patterns: - - pattern: '$X % $Y - - ' + - pattern: "$X % $Y\n" - metavariable-type: metavariable: $X type: string - message: sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual - SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. - Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL. + severity: ERROR +- fix-regex: + regex: format + replacement: bindparams + id: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + languages: + - python + message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer + inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs + raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with + any function besides "bindparams". Use bindParams to securely bind user-input to SQL statements. metadata: + category: security + confidence: MEDIUM + cwe: + - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - category: security - technology: - - sqlalchemy - confidence: MEDIUM references: - - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text - shortlink: https://sg.run/yP1O + - https://owasp.org/Top10/A03_2021-Injection semgrep.dev: rule: - r_id: 15824 - rv_id: 1263577 - rule_id: r6U2wE - version_id: rxTAKqq - url: https://semgrep.dev/playground/r/rxTAKqq/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text origin: community - languages: - - python - severity: ERROR -- id: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + r_id: 9702 + rule_id: BYUBWo + rv_id: 1263579 + url: + https://semgrep.dev/playground/r/NdTzyL4/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + version_id: NdTzyL4 + shortlink: https://sg.run/J3Xo + source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection + subcategory: + - vuln + technology: + - sqlalchemy + vulnerability_class: + - SQL Injection patterns: - pattern-either: - pattern: "def $FUNC(...,$VAR,...):\n ...\n $SESSION.query(...).$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n" @@ -16051,105 +10160,56 @@ rules: - metavariable-regex: metavariable: $FORMATFUNC regex: (?!bindparams) - message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs - raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL - into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function - besides "bindparams". Use bindParams to securely bind user-input to SQL statements. - fix-regex: - regex: format - replacement: bindparams - languages: - - python severity: WARNING - metadata: - cwe: - - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' - category: security - technology: - - sqlalchemy - owasp: - - A01:2017 - Injection - - A03:2021 - Injection - - A05:2025 - Injection - references: - - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - SQL Injection - source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection - shortlink: https://sg.run/J3Xo - semgrep.dev: - rule: - r_id: 9702 - rv_id: 1263579 - rule_id: BYUBWo - version_id: NdTzyL4 - url: https://semgrep.dev/playground/r/NdTzyL4/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection - origin: community - id: python.twilio.security.twiml-injection.twiml-injection languages: - python - severity: WARNING - message: Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the - injection of additional TwiML commands + message: Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow + the injection of additional TwiML commands metadata: + category: security + confidence: MEDIUM cwe: - 'CWE-91: XML Injection' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2021 - Injection - A05:2025 - Injection - category: security - technology: - - python - - twilio - - twiml - confidence: MEDIUM - likelihood: HIGH - impact: MEDIUM - subcategory: - - vuln references: - https://codeberg.org/fennix/funjection - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection - shortlink: https://sg.run/GdEEy semgrep.dev: rule: + origin: community r_id: 134692 - rv_id: 1263580 rule_id: oqUgjj2 - version_id: kbTzGp1 + rv_id: 1263580 url: https://semgrep.dev/playground/r/kbTzGp1/python.twilio.security.twiml-injection.twiml-injection - origin: community + version_id: kbTzGp1 + shortlink: https://sg.run/GdEEy + source: https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection + subcategory: + - vuln + technology: + - python + - twilio + - twiml + vulnerability_class: + - Other mode: taint - pattern-sources: - - pattern: 'f"..." - - ' - - pattern: '"..." % ... - - ' - - pattern: '"...".format(...) - - ' - - patterns: - - pattern: $ARG - - pattern-inside: "def $F(..., $ARG, ...):\n ...\n" pattern-sanitizers: - pattern: xml.sax.saxutils.escape(...) - pattern: html.escape(...) pattern-sinks: - patterns: - - pattern: '$CLIENT.calls.create(..., twiml=$SINK, ...) - - ' + - pattern: "$CLIENT.calls.create(..., twiml=$SINK, ...)\n" - focus-metavariable: $SINK + pattern-sources: + - pattern: "f\"...\"\n" + - pattern: "\"...\" % ...\n" + - pattern: "\"...\".format(...)\n" + - patterns: + - pattern: $ARG + - pattern-inside: "def $F(..., $ARG, ...):\n ...\n" + severity: WARNING diff --git a/.semgrep/registry/rust-lang-security.yaml b/.semgrep/registry/rust-lang-security.yaml index 0f15f57..ef71446 100644 --- a/.semgrep/registry/rust-lang-security.yaml +++ b/.semgrep/registry/rust-lang-security.yaml @@ -5,201 +5,205 @@ # (the semgrep-registry-update workflow does this on a schedule). rules: - id: rust.lang.security.args-os.args-os + languages: + - rust message: 'args_os should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes."' - pattern: std::env::args_os() metadata: - references: - - https://doc.rust-lang.org/stable/std/env/fn.args_os.html - technology: - - rust category: security - cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' confidence: HIGH - likelihood: LOW + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' impact: LOW - subcategory: audit license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/rust.lang.security.args-os.args-os - shortlink: https://sg.run/G6k6 + likelihood: LOW + references: + - https://doc.rust-lang.org/stable/std/env/fn.args_os.html semgrep.dev: rule: + origin: community r_id: 40104 - rv_id: 946547 rule_id: DbUeEe - version_id: d6TPjBp + rv_id: 946547 url: https://semgrep.dev/playground/r/d6TPjBp/rust.lang.security.args-os.args-os - origin: community - languages: - - rust + version_id: d6TPjBp + shortlink: https://sg.run/G6k6 + source: https://semgrep.dev/r/rust.lang.security.args-os.args-os + subcategory: audit + technology: + - rust + vulnerability_class: + - Other + pattern: std::env::args_os() severity: INFO - id: rust.lang.security.args.args + languages: + - rust message: 'args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes."' - pattern: std::env::args() metadata: - references: - - https://doc.rust-lang.org/stable/std/env/fn.args.html - technology: - - rust category: security - cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' confidence: HIGH - likelihood: LOW + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' impact: LOW - subcategory: audit license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/rust.lang.security.args.args - shortlink: https://sg.run/RADN + likelihood: LOW + references: + - https://doc.rust-lang.org/stable/std/env/fn.args.html semgrep.dev: rule: + origin: community r_id: 40105 - rv_id: 946548 rule_id: WAU6Lk - version_id: ZRT35Ly + rv_id: 946548 url: https://semgrep.dev/playground/r/ZRT35Ly/rust.lang.security.args.args - origin: community - languages: - - rust + version_id: ZRT35Ly + shortlink: https://sg.run/RADN + source: https://semgrep.dev/r/rust.lang.security.args.args + subcategory: audit + technology: + - rust + vulnerability_class: + - Other + pattern: std::env::args() severity: INFO - id: rust.lang.security.current-exe.current-exe + languages: + - rust message: 'current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily."' - pattern: std::env::current_exe() metadata: - references: - - https://doc.rust-lang.org/stable/std/env/fn.current_exe.html#security - technology: - - rust category: security - cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' confidence: HIGH - likelihood: LOW + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' impact: LOW - subcategory: audit license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/rust.lang.security.current-exe.current-exe - shortlink: https://sg.run/AW1B + likelihood: LOW + references: + - https://doc.rust-lang.org/stable/std/env/fn.current_exe.html#security semgrep.dev: rule: + origin: community r_id: 40106 - rv_id: 946549 rule_id: 0oU6nZ - version_id: nWTpz6d + rv_id: 946549 url: https://semgrep.dev/playground/r/nWTpz6d/rust.lang.security.current-exe.current-exe - origin: community - languages: - - rust + version_id: nWTpz6d + shortlink: https://sg.run/AW1B + source: https://semgrep.dev/r/rust.lang.security.current-exe.current-exe + subcategory: audit + technology: + - rust + vulnerability_class: + - Other + pattern: std::env::current_exe() severity: INFO - id: rust.lang.security.insecure-hashes.insecure-hashes + languages: + - rust message: Detected cryptographically insecure hashing function - pattern-either: - - pattern: md2::Md2::new(...) - - pattern: md4::Md4::new(...) - - pattern: md5::Md5::new(...) - - pattern: sha1::Sha1::new(...) metadata: + category: security + confidence: HIGH + cwe: 'CWE-328: Use of Weak Hash' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW references: - https://github.com/RustCrypto/hashes - https://docs.rs/md2/latest/md2/ - https://docs.rs/md4/latest/md4/ - https://docs.rs/md5/latest/md5/ - https://docs.rs/sha-1/latest/sha1/ - technology: - - rust - category: security - cwe: 'CWE-328: Use of Weak Hash' - confidence: HIGH - likelihood: LOW - impact: MEDIUM - subcategory: audit - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/rust.lang.security.insecure-hashes.insecure-hashes - shortlink: https://sg.run/B09R semgrep.dev: rule: + origin: community r_id: 40107 - rv_id: 946550 rule_id: KxUOxA - version_id: ExTg29b + rv_id: 946550 url: https://semgrep.dev/playground/r/ExTg29b/rust.lang.security.insecure-hashes.insecure-hashes - origin: community - languages: - - rust + version_id: ExTg29b + shortlink: https://sg.run/B09R + source: https://semgrep.dev/r/rust.lang.security.insecure-hashes.insecure-hashes + subcategory: audit + technology: + - rust + vulnerability_class: + - Insecure Hashing Algorithm + pattern-either: + - pattern: md2::Md2::new(...) + - pattern: md4::Md4::new(...) + - pattern: md5::Md5::new(...) + - pattern: sha1::Sha1::new(...) severity: WARNING - id: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid + languages: + - rust message: Dangerously accepting invalid TLS information - pattern-either: - - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_hostnames(true) - - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_certs(true) metadata: - references: - - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames - - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs - technology: - - reqwest category: security - cwe: 'CWE-295: Improper Certificate Validation' confidence: HIGH - likelihood: LOW + cwe: 'CWE-295: Improper Certificate Validation' impact: MEDIUM - subcategory: vuln license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid - shortlink: https://sg.run/DqrG + likelihood: LOW + references: + - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames + - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs semgrep.dev: rule: + origin: community r_id: 40108 - rv_id: 946551 rule_id: qNUKDg - version_id: 7ZTrQLJ + rv_id: 946551 url: https://semgrep.dev/playground/r/7ZTrQLJ/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid - origin: community - languages: - - rust + version_id: 7ZTrQLJ + shortlink: https://sg.run/DqrG + source: https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid + subcategory: vuln + technology: + - reqwest + vulnerability_class: + - Improper Authentication + pattern-either: + - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_hostnames(true) + - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_certs(true) severity: WARNING - id: rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive + languages: + - rust message: Set sensitive flag on security headers with 'set_sensitive' to treat data with special care + metadata: + category: security + confidence: MEDIUM + cwe: 'CWE-921: Storage of Sensitive Data in a Mechanism without Access Control' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + references: + - https://docs.rs/reqwest/latest/reqwest/header/struct.HeaderValue.html#method.set_sensitive + semgrep.dev: + rule: + origin: community + r_id: 40109 + rule_id: lBUNEw + rv_id: 946552 + url: https://semgrep.dev/playground/r/LjTXy1d/rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive + version_id: LjTXy1d + shortlink: https://sg.run/WKlE + source: https://semgrep.dev/r/rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive + subcategory: audit + technology: + - reqwest + vulnerability_class: + - Other patterns: - - pattern: 'let mut $HEADERS = header::HeaderMap::new(); - - ... - - let $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) ...>; - - ... - - $HEADERS.insert($HEADER, $HEADER_VALUE); - - ' - - pattern-not: 'let mut $HEADERS = header::HeaderMap::new(); - - ... - - let $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) ...>; - - ... - - $HEADER_VALUE.set_sensitive(true); - - ... - - $HEADERS.insert($HEADER, $HEADER_VALUE); - - ' + - pattern: "let mut $HEADERS = header::HeaderMap::new();\n...\nlet $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) + ...>;\n...\n$HEADERS.insert($HEADER, $HEADER_VALUE);\n" + - pattern-not: "let mut $HEADERS = header::HeaderMap::new();\n...\nlet $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) + ...>;\n...\n$HEADER_VALUE.set_sensitive(true);\n...\n$HEADERS.insert($HEADER, $HEADER_VALUE);\n" - metavariable-pattern: metavariable: $FROM_FUNC pattern-either: @@ -213,163 +217,131 @@ rules: pattern-either: - pattern: header::AUTHORIZATION - pattern: '"Authorization"' - metadata: - references: - - https://docs.rs/reqwest/latest/reqwest/header/struct.HeaderValue.html#method.set_sensitive - technology: - - reqwest - category: security - cwe: 'CWE-921: Storage of Sensitive Data in a Mechanism without Access Control' - confidence: MEDIUM - likelihood: LOW - impact: LOW - subcategory: audit - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive - shortlink: https://sg.run/WKlE - semgrep.dev: - rule: - r_id: 40109 - rv_id: 946552 - rule_id: lBUNEw - version_id: LjTXy1d - url: https://semgrep.dev/playground/r/LjTXy1d/rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive - origin: community - languages: - - rust severity: INFO - id: rust.lang.security.rustls-dangerous.rustls-dangerous + languages: + - rust message: Dangerous client config used, ensure SSL verification - pattern-either: - - pattern: rustls::client::DangerousClientConfig - - pattern: $CLIENT.dangerous().set_certificate_verifier(...) - - pattern: 'let $CLIENT = rustls::client::ClientConfig::dangerous(...); - - ... - - $CLIENT.set_certificate_verifier(...); - - ' metadata: - references: - - https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html - - https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous - technology: - - rustls category: security - cwe: 'CWE-295: Improper Certificate Validation' confidence: HIGH - likelihood: LOW + cwe: 'CWE-295: Improper Certificate Validation' impact: MEDIUM - subcategory: vuln license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous - shortlink: https://sg.run/01Rw + likelihood: LOW + references: + - https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html + - https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous semgrep.dev: rule: + origin: community r_id: 40110 - rv_id: 946553 rule_id: YGU8LK - version_id: 8KTKjdO + rv_id: 946553 url: https://semgrep.dev/playground/r/8KTKjdO/rust.lang.security.rustls-dangerous.rustls-dangerous - origin: community - languages: - - rust + version_id: 8KTKjdO + shortlink: https://sg.run/01Rw + source: https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous + subcategory: vuln + technology: + - rustls + vulnerability_class: + - Improper Authentication + pattern-either: + - pattern: rustls::client::DangerousClientConfig + - pattern: $CLIENT.dangerous().set_certificate_verifier(...) + - pattern: "let $CLIENT = rustls::client::ClientConfig::dangerous(...);\n...\n$CLIENT.set_certificate_verifier(...);\n" severity: WARNING - id: rust.lang.security.ssl-verify-none.ssl-verify-none + languages: + - rust message: SSL verification disabled, this allows for MitM attacks - pattern: $BUILDER.set_verify(openssl::ssl::SSL_VERIFY_NONE) metadata: - references: - - https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify - technology: - - openssl category: security - cwe: 'CWE-295: Improper Certificate Validation' confidence: HIGH - likelihood: LOW + cwe: 'CWE-295: Improper Certificate Validation' impact: MEDIUM - subcategory: vuln license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none - shortlink: https://sg.run/K2Pn + likelihood: LOW + references: + - https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify semgrep.dev: rule: + origin: community r_id: 40111 - rv_id: 946554 rule_id: 6JU0Bl - version_id: gETe1bo + rv_id: 946554 url: https://semgrep.dev/playground/r/gETe1bo/rust.lang.security.ssl-verify-none.ssl-verify-none - origin: community - languages: - - rust + version_id: gETe1bo + shortlink: https://sg.run/K2Pn + source: https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none + subcategory: vuln + technology: + - openssl + vulnerability_class: + - Improper Authentication + pattern: $BUILDER.set_verify(openssl::ssl::SSL_VERIFY_NONE) severity: WARNING - id: rust.lang.security.temp-dir.temp-dir - message: 'temp_dir should not be used for security operations. From the docs: ''The temporary directory may be shared among + languages: + - rust + message: "temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file. Creating a file or directory with a fixed or predictable - name may result in “insecure temporary file” security vulnerabilities.''' - pattern: std::env::temp_dir() + name may result in “insecure temporary file” security vulnerabilities.'" metadata: - references: - - https://doc.rust-lang.org/stable/std/env/fn.temp_dir.html - technology: - - rust category: security - cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' confidence: HIGH - likelihood: LOW + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' impact: LOW - subcategory: audit license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/rust.lang.security.temp-dir.temp-dir - shortlink: https://sg.run/qzEO + likelihood: LOW + references: + - https://doc.rust-lang.org/stable/std/env/fn.temp_dir.html semgrep.dev: rule: + origin: community r_id: 40112 - rv_id: 946555 rule_id: oqU5AO - version_id: QkTZz4Y + rv_id: 946555 url: https://semgrep.dev/playground/r/QkTZz4Y/rust.lang.security.temp-dir.temp-dir - origin: community - languages: - - rust + version_id: QkTZz4Y + shortlink: https://sg.run/qzEO + source: https://semgrep.dev/r/rust.lang.security.temp-dir.temp-dir + subcategory: audit + technology: + - rust + vulnerability_class: + - Other + pattern: std::env::temp_dir() severity: INFO - id: rust.lang.security.unsafe-usage.unsafe-usage + languages: + - rust message: Detected 'unsafe' usage, please audit for secure usage - pattern: unsafe { ... } metadata: - references: - - https://doc.rust-lang.org/std/keyword.unsafe.html - technology: - - rust category: security - cwe: 'CWE-242: Use of Inherently Dangerous Function' confidence: HIGH - likelihood: LOW + cwe: 'CWE-242: Use of Inherently Dangerous Function' impact: LOW - subcategory: audit license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Dangerous Method or Function - source: https://semgrep.dev/r/rust.lang.security.unsafe-usage.unsafe-usage - shortlink: https://sg.run/lqgo + likelihood: LOW + references: + - https://doc.rust-lang.org/std/keyword.unsafe.html semgrep.dev: rule: + origin: community r_id: 40113 - rv_id: 946556 rule_id: zdUezd - version_id: 3ZTOPoZ + rv_id: 946556 url: https://semgrep.dev/playground/r/3ZTOPoZ/rust.lang.security.unsafe-usage.unsafe-usage - origin: community - languages: - - rust + version_id: 3ZTOPoZ + shortlink: https://sg.run/lqgo + source: https://semgrep.dev/r/rust.lang.security.unsafe-usage.unsafe-usage + subcategory: audit + technology: + - rust + vulnerability_class: + - Dangerous Method or Function + pattern: unsafe { ... } severity: INFO diff --git a/.semgrep/registry/rust.yaml b/.semgrep/registry/rust.yaml index 38023b6..6fe105b 100644 --- a/.semgrep/registry/rust.yaml +++ b/.semgrep/registry/rust.yaml @@ -5,51 +5,6 @@ # (the semgrep-registry-update workflow does this on a schedule). rules: - id: generic.unicode.security.bidi.contains-bidirectional-characters - patterns: - - pattern-either: - - pattern-regex: ‪ - - pattern-regex: ‫ - - pattern-regex: ‭ - - pattern-regex: ‮ - - pattern-regex: ⁦ - - pattern-regex: ⁧ - - pattern-regex: ⁨ - - pattern-regex: ‬ - - pattern-regex: ⁩ - message: This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages - such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different - from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this - code in an editor that can reveal hidden Unicode characters. - metadata: - cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' - category: security - technology: - - unicode - references: - - https://trojansource.codes/ - confidence: LOW - owasp: - - A03:2021 - Injection - - A05:2025 - Injection - cwe2022-top25: true - subcategory: - - audit - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters - shortlink: https://sg.run/nK4r - semgrep.dev: - rule: - r_id: 14880 - rv_id: 1262904 - rule_id: d8UeX4 - version_id: JdTzxzn - url: https://semgrep.dev/playground/r/JdTzxzn/generic.unicode.security.bidi.contains-bidirectional-characters - origin: community languages: - bash - c @@ -69,203 +24,252 @@ rules: - sh - typescript - yaml + message: This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left + languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner + that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, + please review this code in an editor that can reveal hidden Unicode characters. + metadata: + category: security + confidence: LOW + cwe: + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + owasp: + - A03:2021 - Injection + - A05:2025 - Injection + references: + - https://trojansource.codes/ + semgrep.dev: + rule: + origin: community + r_id: 14880 + rule_id: d8UeX4 + rv_id: 1262904 + url: https://semgrep.dev/playground/r/JdTzxzn/generic.unicode.security.bidi.contains-bidirectional-characters + version_id: JdTzxzn + shortlink: https://sg.run/nK4r + source: https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters + subcategory: + - audit + technology: + - unicode + vulnerability_class: + - Code Injection + patterns: + - pattern-either: + - pattern-regex: ‪ + - pattern-regex: ‫ + - pattern-regex: ‭ + - pattern-regex: ‮ + - pattern-regex: ⁦ + - pattern-regex: ⁧ + - pattern-regex: ⁨ + - pattern-regex: ‬ + - pattern-regex: ⁩ severity: WARNING - id: rust.lang.security.args-os.args-os + languages: + - rust message: 'args_os should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes."' - pattern: std::env::args_os() metadata: - references: - - https://doc.rust-lang.org/stable/std/env/fn.args_os.html - technology: - - rust category: security - cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' confidence: HIGH - likelihood: LOW + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' impact: LOW - subcategory: audit license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/rust.lang.security.args-os.args-os - shortlink: https://sg.run/G6k6 + likelihood: LOW + references: + - https://doc.rust-lang.org/stable/std/env/fn.args_os.html semgrep.dev: rule: + origin: community r_id: 40104 - rv_id: 946547 rule_id: DbUeEe - version_id: d6TPjBp + rv_id: 946547 url: https://semgrep.dev/playground/r/d6TPjBp/rust.lang.security.args-os.args-os - origin: community - languages: - - rust + version_id: d6TPjBp + shortlink: https://sg.run/G6k6 + source: https://semgrep.dev/r/rust.lang.security.args-os.args-os + subcategory: audit + technology: + - rust + vulnerability_class: + - Other + pattern: std::env::args_os() severity: INFO - id: rust.lang.security.args.args + languages: + - rust message: 'args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes."' - pattern: std::env::args() metadata: - references: - - https://doc.rust-lang.org/stable/std/env/fn.args.html - technology: - - rust category: security - cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' confidence: HIGH - likelihood: LOW + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' impact: LOW - subcategory: audit license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/rust.lang.security.args.args - shortlink: https://sg.run/RADN + likelihood: LOW + references: + - https://doc.rust-lang.org/stable/std/env/fn.args.html semgrep.dev: rule: + origin: community r_id: 40105 - rv_id: 946548 rule_id: WAU6Lk - version_id: ZRT35Ly + rv_id: 946548 url: https://semgrep.dev/playground/r/ZRT35Ly/rust.lang.security.args.args - origin: community - languages: - - rust + version_id: ZRT35Ly + shortlink: https://sg.run/RADN + source: https://semgrep.dev/r/rust.lang.security.args.args + subcategory: audit + technology: + - rust + vulnerability_class: + - Other + pattern: std::env::args() severity: INFO - id: rust.lang.security.current-exe.current-exe + languages: + - rust message: 'current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily."' - pattern: std::env::current_exe() metadata: - references: - - https://doc.rust-lang.org/stable/std/env/fn.current_exe.html#security - technology: - - rust category: security - cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' confidence: HIGH - likelihood: LOW + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' impact: LOW - subcategory: audit license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/rust.lang.security.current-exe.current-exe - shortlink: https://sg.run/AW1B + likelihood: LOW + references: + - https://doc.rust-lang.org/stable/std/env/fn.current_exe.html#security semgrep.dev: rule: + origin: community r_id: 40106 - rv_id: 946549 rule_id: 0oU6nZ - version_id: nWTpz6d + rv_id: 946549 url: https://semgrep.dev/playground/r/nWTpz6d/rust.lang.security.current-exe.current-exe - origin: community - languages: - - rust + version_id: nWTpz6d + shortlink: https://sg.run/AW1B + source: https://semgrep.dev/r/rust.lang.security.current-exe.current-exe + subcategory: audit + technology: + - rust + vulnerability_class: + - Other + pattern: std::env::current_exe() severity: INFO - id: rust.lang.security.insecure-hashes.insecure-hashes + languages: + - rust message: Detected cryptographically insecure hashing function - pattern-either: - - pattern: md2::Md2::new(...) - - pattern: md4::Md4::new(...) - - pattern: md5::Md5::new(...) - - pattern: sha1::Sha1::new(...) metadata: + category: security + confidence: HIGH + cwe: 'CWE-328: Use of Weak Hash' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW references: - https://github.com/RustCrypto/hashes - https://docs.rs/md2/latest/md2/ - https://docs.rs/md4/latest/md4/ - https://docs.rs/md5/latest/md5/ - https://docs.rs/sha-1/latest/sha1/ - technology: - - rust - category: security - cwe: 'CWE-328: Use of Weak Hash' - confidence: HIGH - likelihood: LOW - impact: MEDIUM - subcategory: audit - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Insecure Hashing Algorithm - source: https://semgrep.dev/r/rust.lang.security.insecure-hashes.insecure-hashes - shortlink: https://sg.run/B09R semgrep.dev: rule: + origin: community r_id: 40107 - rv_id: 946550 rule_id: KxUOxA - version_id: ExTg29b + rv_id: 946550 url: https://semgrep.dev/playground/r/ExTg29b/rust.lang.security.insecure-hashes.insecure-hashes - origin: community - languages: - - rust + version_id: ExTg29b + shortlink: https://sg.run/B09R + source: https://semgrep.dev/r/rust.lang.security.insecure-hashes.insecure-hashes + subcategory: audit + technology: + - rust + vulnerability_class: + - Insecure Hashing Algorithm + pattern-either: + - pattern: md2::Md2::new(...) + - pattern: md4::Md4::new(...) + - pattern: md5::Md5::new(...) + - pattern: sha1::Sha1::new(...) severity: WARNING - id: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid + languages: + - rust message: Dangerously accepting invalid TLS information - pattern-either: - - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_hostnames(true) - - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_certs(true) metadata: - references: - - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames - - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs - technology: - - reqwest category: security - cwe: 'CWE-295: Improper Certificate Validation' confidence: HIGH - likelihood: LOW + cwe: 'CWE-295: Improper Certificate Validation' impact: MEDIUM - subcategory: vuln license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid - shortlink: https://sg.run/DqrG + likelihood: LOW + references: + - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames + - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs semgrep.dev: rule: + origin: community r_id: 40108 - rv_id: 946551 rule_id: qNUKDg - version_id: 7ZTrQLJ + rv_id: 946551 url: https://semgrep.dev/playground/r/7ZTrQLJ/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid - origin: community - languages: - - rust + version_id: 7ZTrQLJ + shortlink: https://sg.run/DqrG + source: https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid + subcategory: vuln + technology: + - reqwest + vulnerability_class: + - Improper Authentication + pattern-either: + - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_hostnames(true) + - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_certs(true) severity: WARNING - id: rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive + languages: + - rust message: Set sensitive flag on security headers with 'set_sensitive' to treat data with special care + metadata: + category: security + confidence: MEDIUM + cwe: 'CWE-921: Storage of Sensitive Data in a Mechanism without Access Control' + impact: LOW + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW + references: + - https://docs.rs/reqwest/latest/reqwest/header/struct.HeaderValue.html#method.set_sensitive + semgrep.dev: + rule: + origin: community + r_id: 40109 + rule_id: lBUNEw + rv_id: 946552 + url: https://semgrep.dev/playground/r/LjTXy1d/rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive + version_id: LjTXy1d + shortlink: https://sg.run/WKlE + source: https://semgrep.dev/r/rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive + subcategory: audit + technology: + - reqwest + vulnerability_class: + - Other patterns: - - pattern: 'let mut $HEADERS = header::HeaderMap::new(); - - ... - - let $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) ...>; - - ... - - $HEADERS.insert($HEADER, $HEADER_VALUE); - - ' - - pattern-not: 'let mut $HEADERS = header::HeaderMap::new(); - - ... - - let $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) ...>; - - ... - - $HEADER_VALUE.set_sensitive(true); - - ... - - $HEADERS.insert($HEADER, $HEADER_VALUE); - - ' + - pattern: "let mut $HEADERS = header::HeaderMap::new();\n...\nlet $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) + ...>;\n...\n$HEADERS.insert($HEADER, $HEADER_VALUE);\n" + - pattern-not: "let mut $HEADERS = header::HeaderMap::new();\n...\nlet $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) + ...>;\n...\n$HEADER_VALUE.set_sensitive(true);\n...\n$HEADERS.insert($HEADER, $HEADER_VALUE);\n" - metavariable-pattern: metavariable: $FROM_FUNC pattern-either: @@ -279,163 +283,131 @@ rules: pattern-either: - pattern: header::AUTHORIZATION - pattern: '"Authorization"' - metadata: - references: - - https://docs.rs/reqwest/latest/reqwest/header/struct.HeaderValue.html#method.set_sensitive - technology: - - reqwest - category: security - cwe: 'CWE-921: Storage of Sensitive Data in a Mechanism without Access Control' - confidence: MEDIUM - likelihood: LOW - impact: LOW - subcategory: audit - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive - shortlink: https://sg.run/WKlE - semgrep.dev: - rule: - r_id: 40109 - rv_id: 946552 - rule_id: lBUNEw - version_id: LjTXy1d - url: https://semgrep.dev/playground/r/LjTXy1d/rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive - origin: community - languages: - - rust severity: INFO - id: rust.lang.security.rustls-dangerous.rustls-dangerous + languages: + - rust message: Dangerous client config used, ensure SSL verification - pattern-either: - - pattern: rustls::client::DangerousClientConfig - - pattern: $CLIENT.dangerous().set_certificate_verifier(...) - - pattern: 'let $CLIENT = rustls::client::ClientConfig::dangerous(...); - - ... - - $CLIENT.set_certificate_verifier(...); - - ' metadata: - references: - - https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html - - https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous - technology: - - rustls category: security - cwe: 'CWE-295: Improper Certificate Validation' confidence: HIGH - likelihood: LOW + cwe: 'CWE-295: Improper Certificate Validation' impact: MEDIUM - subcategory: vuln license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous - shortlink: https://sg.run/01Rw + likelihood: LOW + references: + - https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html + - https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous semgrep.dev: rule: + origin: community r_id: 40110 - rv_id: 946553 rule_id: YGU8LK - version_id: 8KTKjdO + rv_id: 946553 url: https://semgrep.dev/playground/r/8KTKjdO/rust.lang.security.rustls-dangerous.rustls-dangerous - origin: community - languages: - - rust + version_id: 8KTKjdO + shortlink: https://sg.run/01Rw + source: https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous + subcategory: vuln + technology: + - rustls + vulnerability_class: + - Improper Authentication + pattern-either: + - pattern: rustls::client::DangerousClientConfig + - pattern: $CLIENT.dangerous().set_certificate_verifier(...) + - pattern: "let $CLIENT = rustls::client::ClientConfig::dangerous(...);\n...\n$CLIENT.set_certificate_verifier(...);\n" severity: WARNING - id: rust.lang.security.ssl-verify-none.ssl-verify-none + languages: + - rust message: SSL verification disabled, this allows for MitM attacks - pattern: $BUILDER.set_verify(openssl::ssl::SSL_VERIFY_NONE) metadata: - references: - - https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify - technology: - - openssl category: security - cwe: 'CWE-295: Improper Certificate Validation' confidence: HIGH - likelihood: LOW + cwe: 'CWE-295: Improper Certificate Validation' impact: MEDIUM - subcategory: vuln license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authentication - source: https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none - shortlink: https://sg.run/K2Pn + likelihood: LOW + references: + - https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify semgrep.dev: rule: + origin: community r_id: 40111 - rv_id: 946554 rule_id: 6JU0Bl - version_id: gETe1bo + rv_id: 946554 url: https://semgrep.dev/playground/r/gETe1bo/rust.lang.security.ssl-verify-none.ssl-verify-none - origin: community - languages: - - rust + version_id: gETe1bo + shortlink: https://sg.run/K2Pn + source: https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none + subcategory: vuln + technology: + - openssl + vulnerability_class: + - Improper Authentication + pattern: $BUILDER.set_verify(openssl::ssl::SSL_VERIFY_NONE) severity: WARNING - id: rust.lang.security.temp-dir.temp-dir - message: 'temp_dir should not be used for security operations. From the docs: ''The temporary directory may be shared among + languages: + - rust + message: "temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file. Creating a file or directory with a fixed or predictable - name may result in “insecure temporary file” security vulnerabilities.''' - pattern: std::env::temp_dir() + name may result in “insecure temporary file” security vulnerabilities.'" metadata: - references: - - https://doc.rust-lang.org/stable/std/env/fn.temp_dir.html - technology: - - rust category: security - cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' confidence: HIGH - likelihood: LOW + cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision' impact: LOW - subcategory: audit license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Other - source: https://semgrep.dev/r/rust.lang.security.temp-dir.temp-dir - shortlink: https://sg.run/qzEO + likelihood: LOW + references: + - https://doc.rust-lang.org/stable/std/env/fn.temp_dir.html semgrep.dev: rule: + origin: community r_id: 40112 - rv_id: 946555 rule_id: oqU5AO - version_id: QkTZz4Y + rv_id: 946555 url: https://semgrep.dev/playground/r/QkTZz4Y/rust.lang.security.temp-dir.temp-dir - origin: community - languages: - - rust + version_id: QkTZz4Y + shortlink: https://sg.run/qzEO + source: https://semgrep.dev/r/rust.lang.security.temp-dir.temp-dir + subcategory: audit + technology: + - rust + vulnerability_class: + - Other + pattern: std::env::temp_dir() severity: INFO - id: rust.lang.security.unsafe-usage.unsafe-usage + languages: + - rust message: Detected 'unsafe' usage, please audit for secure usage - pattern: unsafe { ... } metadata: - references: - - https://doc.rust-lang.org/std/keyword.unsafe.html - technology: - - rust category: security - cwe: 'CWE-242: Use of Inherently Dangerous Function' confidence: HIGH - likelihood: LOW + cwe: 'CWE-242: Use of Inherently Dangerous Function' impact: LOW - subcategory: audit license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Dangerous Method or Function - source: https://semgrep.dev/r/rust.lang.security.unsafe-usage.unsafe-usage - shortlink: https://sg.run/lqgo + likelihood: LOW + references: + - https://doc.rust-lang.org/std/keyword.unsafe.html semgrep.dev: rule: + origin: community r_id: 40113 - rv_id: 946556 rule_id: zdUezd - version_id: 3ZTOPoZ + rv_id: 946556 url: https://semgrep.dev/playground/r/3ZTOPoZ/rust.lang.security.unsafe-usage.unsafe-usage - origin: community - languages: - - rust + version_id: 3ZTOPoZ + shortlink: https://sg.run/lqgo + source: https://semgrep.dev/r/rust.lang.security.unsafe-usage.unsafe-usage + subcategory: audit + technology: + - rust + vulnerability_class: + - Dangerous Method or Function + pattern: unsafe { ... } severity: INFO diff --git a/.semgrep/registry/security-audit.yaml b/.semgrep/registry/security-audit.yaml index c3c2c01..c16fcc0 100644 --- a/.semgrep/registry/security-audit.yaml +++ b/.semgrep/registry/security-audit.yaml @@ -5,44 +5,17 @@ # (the semgrep-registry-update workflow does this on a schedule). rules: - id: c.lang.security.double-free.double-free - patterns: - - pattern-not: 'free($VAR); - - ... - - $VAR = NULL; - - ... - - free($VAR); - - ' - - pattern-not: 'free($VAR); - - ... - - $VAR = malloc(...); - - ... - - free($VAR); - - ' - - pattern-inside: 'free($VAR); - - ... - - $FREE($VAR); - - ' - - metavariable-pattern: - metavariable: $FREE - pattern: free - - focus-metavariable: $FREE + languages: + - c message: Variable '$VAR' was freed twice. This can lead to undefined behavior. metadata: + category: security + confidence: LOW cwe: - 'CWE-415: Double Free' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2021 - Injection - A01:2017 - Injection @@ -50,468 +23,426 @@ rules: references: - https://cwe.mitre.org/data/definitions/415.html - https://owasp.org/www-community/vulnerabilities/Doubly_freeing_memory - category: security - technology: - - c - confidence: LOW - subcategory: - - vuln - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Memory Issues - source: https://semgrep.dev/r/c.lang.security.double-free.double-free - shortlink: https://sg.run/eLl0 semgrep.dev: rule: + origin: community r_id: 8832 - rv_id: 1262604 rule_id: JDUyw8 - version_id: RGT0L3W + rv_id: 1262604 url: https://semgrep.dev/playground/r/RGT0L3W/c.lang.security.double-free.double-free - origin: community - languages: - - c + version_id: RGT0L3W + shortlink: https://sg.run/eLl0 + source: https://semgrep.dev/r/c.lang.security.double-free.double-free + subcategory: + - vuln + technology: + - c + vulnerability_class: + - Memory Issues + patterns: + - pattern-not: "free($VAR);\n...\n$VAR = NULL;\n...\nfree($VAR);\n" + - pattern-not: "free($VAR);\n...\n$VAR = malloc(...);\n...\nfree($VAR);\n" + - pattern-inside: "free($VAR);\n...\n$FREE($VAR);\n" + - metavariable-pattern: + metavariable: $FREE + pattern: free + - focus-metavariable: $FREE severity: ERROR - id: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn - pattern: gets(...) - message: Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' - or 'gets_s()' instead. + languages: + - c + message: Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use + 'fgets()' or 'gets_s()' instead. metadata: - cwe: - - 'CWE-676: Use of Potentially Dangerous Function' - references: - - https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s category: security - technology: - - c confidence: MEDIUM - subcategory: - - audit - likelihood: LOW + cwe: + - 'CWE-676: Use of Potentially Dangerous Function' impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Dangerous Method or Function - source: https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn - shortlink: https://sg.run/dKqX + likelihood: LOW + references: + - https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s semgrep.dev: rule: + origin: community r_id: 8834 - rv_id: 945170 rule_id: GdU7OE - version_id: YDTvRlQ + rv_id: 945170 url: https://semgrep.dev/playground/r/YDTvRlQ/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn - origin: community - languages: - - c + version_id: YDTvRlQ + shortlink: https://sg.run/dKqX + source: https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn + subcategory: + - audit + technology: + - c + vulnerability_class: + - Dangerous Method or Function + pattern: gets(...) severity: ERROR - id: c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn - message: Avoid using user-controlled format strings passed into 'sprintf', 'printf' and 'vsprintf'. These functions put - you at risk of buffer overflow vulnerabilities through the use of format string exploits. Instead, use 'snprintf' and - 'vsnprintf'. + languages: + - c + message: Avoid using user-controlled format strings passed into 'sprintf', 'printf' and 'vsprintf'. These functions + put you at risk of buffer overflow vulnerabilities through the use of format string exploits. Instead, use + 'snprintf' and 'vsnprintf'. metadata: + category: security + confidence: LOW cwe: - 'CWE-134: Use of Externally-Controlled Format String' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM references: - https://doc.castsoftware.com/display/SBX/Never+use+sprintf%28%29+or+vsprintf%28%29+functions - https://www.cvedetails.com/cwe-details/134/Uncontrolled-Format-String.html - category: security - technology: - - c - confidence: LOW - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Validation - source: https://semgrep.dev/r/c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn - shortlink: https://sg.run/ZvJx semgrep.dev: rule: + origin: community r_id: 8835 - rv_id: 945172 rule_id: ReUgWx - version_id: o5TZeB2 + rv_id: 945172 url: https://semgrep.dev/playground/r/o5TZeB2/c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn - origin: community - languages: - - c - severity: WARNING + version_id: o5TZeB2 + shortlink: https://sg.run/ZvJx + source: https://semgrep.dev/r/c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn + subcategory: + - vuln + technology: + - c + vulnerability_class: + - Improper Validation patterns: - pattern-either: - - pattern: '$FUNC($BUFFER, argv[$NUM], ...); - - ... - - vsprintf(..., $BUFFER, ...); - - ' + - pattern: "$FUNC($BUFFER, argv[$NUM], ...);\n...\nvsprintf(..., $BUFFER, ...);\n" - pattern: vsprintf(..., argv[$NUM], ...) - - pattern: '$FUNC($BUFFER, argv[$NUM], ...); - - ... - - sprintf(..., $BUFFER, ...); - - ' + - pattern: "$FUNC($BUFFER, argv[$NUM], ...);\n...\nsprintf(..., $BUFFER, ...);\n" - pattern: sprintf(...,argv[$NUM],...) - - pattern: '$FUNC($BUFFER, argv[$NUM], ...); - - ... - - printf(..., $BUFFER, ...); - - ' + - pattern: "$FUNC($BUFFER, argv[$NUM], ...);\n...\nprintf(..., $BUFFER, ...);\n" - pattern: printf(...,argv[$NUM],...) - metavariable-comparison: - metavariable: $NUM comparison: int($NUM) > 0 + metavariable: $NUM + severity: WARNING - id: c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn - pattern: scanf(...) - message: Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to - buffer overflows. Use 'fgets()' instead for reading input. + languages: + - c + message: Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead + to buffer overflows. Use 'fgets()' instead for reading input. metadata: - cwe: - - 'CWE-676: Use of Potentially Dangerous Function' - references: - - http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html category: security - technology: - - c confidence: LOW - subcategory: - - audit - likelihood: LOW + cwe: + - 'CWE-676: Use of Potentially Dangerous Function' impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Dangerous Method or Function - source: https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn - shortlink: https://sg.run/nd1g + likelihood: LOW + references: + - http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html semgrep.dev: rule: + origin: community r_id: 8836 - rv_id: 945173 rule_id: AbUzPd - version_id: zyTlkWW + rv_id: 945173 url: https://semgrep.dev/playground/r/zyTlkWW/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn - origin: community - languages: - - c + version_id: zyTlkWW + shortlink: https://sg.run/nd1g + source: https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn + subcategory: + - audit + technology: + - c + vulnerability_class: + - Dangerous Method or Function + pattern: scanf(...) severity: WARNING - id: c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn - pattern-either: - - pattern: strcat(...) - - pattern: strncat(...) - message: Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can lead - to buffer overflow vulns. Fix this by using strcat_s instead. + languages: + - c + message: Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can + lead to buffer overflow vulns. Fix this by using strcat_s instead. metadata: + category: security + confidence: LOW cwe: - 'CWE-676: Use of Potentially Dangerous Function' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW references: - https://nvd.nist.gov/vuln/detail/CVE-2019-12553 - https://techblog.mediaservice.net/2020/04/cve-2020-2851-stack-based-buffer-overflow-in-cde-libdtsvc/ - category: security - technology: - - c - confidence: LOW - subcategory: - - audit - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Dangerous Method or Function - source: https://semgrep.dev/r/c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn - shortlink: https://sg.run/EkRP semgrep.dev: rule: + origin: community r_id: 8837 - rv_id: 945174 rule_id: BYUNjA - version_id: pZTNOXb + rv_id: 945174 url: https://semgrep.dev/playground/r/pZTNOXb/c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn - origin: community - languages: - - c + version_id: pZTNOXb + shortlink: https://sg.run/EkRP + source: https://semgrep.dev/r/c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn + subcategory: + - audit + technology: + - c + vulnerability_class: + - Dangerous Method or Function + pattern-either: + - pattern: strcat(...) + - pattern: strncat(...) severity: WARNING - id: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn - pattern-either: - - pattern: strcpy(...) - - pattern: strncpy(...) - message: Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the - size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, - which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s - instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available). + languages: + - c + message: Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm + the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer + overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by + using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be + available). metadata: + category: security + confidence: LOW cwe: - 'CWE-676: Use of Potentially Dangerous Function' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW references: - https://cwe.mitre.org/data/definitions/676 - https://nvd.nist.gov/vuln/detail/CVE-2019-11365 - category: security - technology: - - c - confidence: LOW - subcategory: - - audit - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Dangerous Method or Function - source: https://semgrep.dev/r/c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn - shortlink: https://sg.run/7oNk semgrep.dev: rule: + origin: community r_id: 8838 - rv_id: 945175 rule_id: DbUpo5 + rv_id: 945175 + url: + https://semgrep.dev/playground/r/2KTYb7Y/c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn version_id: 2KTYb7Y - url: https://semgrep.dev/playground/r/2KTYb7Y/c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn - origin: community - languages: - - c + shortlink: https://sg.run/7oNk + source: https://semgrep.dev/r/c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn + subcategory: + - audit + technology: + - c + vulnerability_class: + - Dangerous Method or Function + pattern-either: + - pattern: strcpy(...) + - pattern: strncpy(...) severity: WARNING - id: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn - pattern: strtok(...) - message: Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter - character. Use 'strtok_r()' instead. + languages: + - c + message: Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the + delimiter character. Use 'strtok_r()' instead. metadata: + category: security + confidence: LOW cwe: - 'CWE-676: Use of Potentially Dangerous Function' + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW references: - https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged - https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS - https://stackoverflow.com/a/40335556 - category: security - technology: - - c - confidence: LOW - subcategory: - - audit - likelihood: LOW - impact: HIGH - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Dangerous Method or Function - source: https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn - shortlink: https://sg.run/LwqG semgrep.dev: rule: + origin: community r_id: 8839 - rv_id: 1028278 rule_id: WAUo5v - version_id: qkTx1oq + rv_id: 1028278 url: https://semgrep.dev/playground/r/qkTx1oq/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn - origin: community - languages: - - c + version_id: qkTx1oq + shortlink: https://sg.run/LwqG + source: https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn + subcategory: + - audit + technology: + - c + vulnerability_class: + - Dangerous Method or Function + pattern: strtok(...) severity: WARNING - id: c.lang.security.random-fd-exhaustion.random-fd-exhaustion - pattern-either: - - patterns: - - pattern: '$FD = open("/dev/urandom", ...); - - ... - - read($FD, ...); - - ' - - pattern-not: '$FD = open("/dev/urandom", ...); - - ... - - $BYTES_READ = read($FD, ...); - - ' - - patterns: - - pattern: '$FD = open("/dev/random", ...); - - ... - - read($FD, ...); - - ' - - pattern-not: '$FD = open("/dev/random", ...); - - ... - - $BYTES_READ = read($FD, ...); - - ' - message: Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' - function. + languages: + - c + message: Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the + 'getrandom()' function. metadata: - cwe: - - 'CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling' - references: - - https://lwn.net/Articles/606141/ category: security - technology: - - c confidence: MEDIUM - subcategory: - - audit - likelihood: LOW + cwe: + - 'CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling' impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Denial-of-Service (DoS) - source: https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion - shortlink: https://sg.run/8yNj + likelihood: LOW + references: + - https://lwn.net/Articles/606141/ semgrep.dev: rule: + origin: community r_id: 8840 - rv_id: 945177 rule_id: 0oU5k4 - version_id: jQTzvry + rv_id: 945177 url: https://semgrep.dev/playground/r/jQTzvry/c.lang.security.random-fd-exhaustion.random-fd-exhaustion - origin: community - languages: - - c + version_id: jQTzvry + shortlink: https://sg.run/8yNj + source: https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion + subcategory: + - audit + technology: + - c + vulnerability_class: + - Denial-of-Service (DoS) + pattern-either: + - patterns: + - pattern: "$FD = open(\"/dev/urandom\", ...);\n...\nread($FD, ...);\n" + - pattern-not: "$FD = open(\"/dev/urandom\", ...);\n...\n$BYTES_READ = read($FD, ...);\n" + - patterns: + - pattern: "$FD = open(\"/dev/random\", ...);\n...\nread($FD, ...);\n" + - pattern-not: "$FD = open(\"/dev/random\", ...);\n...\n$BYTES_READ = read($FD, ...);\n" severity: WARNING - id: c.lang.security.use-after-free.use-after-free - patterns: - - pattern-either: - - pattern: $VAR->$ACCESSOR - - pattern: (*$VAR).$ACCESSOR - - pattern: $VAR[$NUM] - - pattern-inside: free($VAR); ... - - pattern-not-inside: $VAR = NULL; ... - - pattern-not-inside: free($VAR); ... $VAR = malloc(...); ... + languages: + - c message: Variable '$VAR' was used after being freed. This can lead to undefined behavior. metadata: - cwe: - - 'CWE-416: Use After Free' - references: - - https://cwe.mitre.org/data/definitions/416.html - - https://ctf-wiki.github.io/ctf-wiki/pwn/linux/glibc-heap/use_after_free/ category: security - technology: - - c confidence: LOW - cwe2022-top25: true + cwe: + - 'CWE-416: Use After Free' cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW + cwe2022-top25: true impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Memory Issues - source: https://semgrep.dev/r/c.lang.security.use-after-free.use-after-free - shortlink: https://sg.run/gL6e + likelihood: LOW + references: + - https://cwe.mitre.org/data/definitions/416.html + - https://ctf-wiki.github.io/ctf-wiki/pwn/linux/glibc-heap/use_after_free/ semgrep.dev: rule: + origin: community r_id: 8841 - rv_id: 945178 rule_id: KxUb9l - version_id: 1QToKPy + rv_id: 945178 url: https://semgrep.dev/playground/r/1QToKPy/c.lang.security.use-after-free.use-after-free - origin: community - languages: - - c + version_id: 1QToKPy + shortlink: https://sg.run/gL6e + source: https://semgrep.dev/r/c.lang.security.use-after-free.use-after-free + subcategory: + - vuln + technology: + - c + vulnerability_class: + - Memory Issues + patterns: + - pattern-either: + - pattern: $VAR->$ACCESSOR + - pattern: (*$VAR).$ACCESSOR + - pattern: $VAR[$NUM] + - pattern-inside: free($VAR); ... + - pattern-not-inside: $VAR = NULL; ... + - pattern-not-inside: free($VAR); ... $VAR = malloc(...); ... severity: WARNING - id: dockerfile.security.last-user-is-root.last-user-is-root - patterns: - - pattern: USER root - - pattern-not-inside: - patterns: - - pattern: 'USER root - - ... - - USER $X - - ' - - metavariable-pattern: - metavariable: $X - patterns: - - pattern-not: root - message: The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the - container they will have root access. Switch back to another user after running commands as 'root'. - severity: ERROR languages: - dockerfile + message: The last user in the container is 'root'. This is a security hazard because if an attacker gains control of + the container they will have root access. Switch back to another user after running commands as 'root'. metadata: - cwe: - - 'CWE-269: Improper Privilege Management' - source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3002 - references: - - https://github.com/hadolint/hadolint/wiki/DL3002 category: security - technology: - - dockerfile confidence: MEDIUM + cwe: + - 'CWE-269: Improper Privilege Management' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design - subcategory: - - audit - likelihood: MEDIUM - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Improper Authorization - source: https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root - shortlink: https://sg.run/5Z43 + references: + - https://github.com/hadolint/hadolint/wiki/DL3002 semgrep.dev: rule: + origin: community r_id: 20147 - rv_id: 1262658 rule_id: ReU2n5 - version_id: 6xT29Eg + rv_id: 1262658 url: https://semgrep.dev/playground/r/6xT29Eg/dockerfile.security.last-user-is-root.last-user-is-root - origin: community -- id: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var + version_id: 6xT29Eg + shortlink: https://sg.run/5Z43 + source: https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root + source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3002 + subcategory: + - audit + technology: + - dockerfile + vulnerability_class: + - Improper Authorization + patterns: + - pattern: USER root + - pattern-not-inside: + patterns: + - pattern: "USER root\n...\nUSER $X\n" + - metavariable-pattern: + metavariable: $X + patterns: + - pattern-not: root + severity: ERROR +- fix-regex: + regex: '{{(.*?)}}' + replacement: '"{{\1}}"' + id: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var + languages: + - generic message: 'Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}".' metadata: + category: security + confidence: LOW cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss - category: security - technology: - - html-templates - confidence: LOW - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var - shortlink: https://sg.run/weNX semgrep.dev: rule: + origin: community r_id: 9029 - rv_id: 1501833 rule_id: gxU1jy + rv_id: 1501833 + url: + https://semgrep.dev/playground/r/1QT3R1A/generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var version_id: 1QT3R1A - url: https://semgrep.dev/playground/r/1QT3R1A/generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var - origin: community - languages: - - generic + shortlink: https://sg.run/weNX + source: https://semgrep.dev/r/generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var + subcategory: + - audit + technology: + - html-templates + vulnerability_class: + - Cross-Site-Scripting (XSS) paths: include: - '*.html' - '*.mustache' - '*.hbs' - '*.twig' - severity: WARNING patterns: - pattern-inside: <$TAG ...> - pattern-not-inside: ="..." @@ -519,18 +450,25 @@ rules: - pattern-not-inside: ='...' - pattern-not-inside: ='{{ ... }}' - pattern: '{{ ... }}' - fix-regex: - regex: '{{(.*?)}}' - replacement: '"{{\1}}"' + severity: WARNING - id: generic.html-templates.security.var-in-href.var-in-href - message: Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to - input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to - safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding - library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting - the Content Security Policy (CSP) header. + languages: + - generic + message: Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor + to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use + 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using + Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links + (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. metadata: + category: security + confidence: LOW cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection @@ -540,38 +478,28 @@ rules: - https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#url - https://github.com/pugjs/pug/issues/2952 - https://content-security-policy.com/ - category: security - technology: - - html-templates - confidence: LOW - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/generic.html-templates.security.var-in-href.var-in-href - shortlink: https://sg.run/x1kP semgrep.dev: rule: + origin: community r_id: 9030 - rv_id: 1501834 rule_id: QrUzD1 - version_id: 9lTqGx9 + rv_id: 1501834 url: https://semgrep.dev/playground/r/9lTqGx9/generic.html-templates.security.var-in-href.var-in-href - origin: community - languages: - - generic - paths: + version_id: 9lTqGx9 + shortlink: https://sg.run/x1kP + source: https://semgrep.dev/r/generic.html-templates.security.var-in-href.var-in-href + subcategory: + - audit + technology: + - html-templates + vulnerability_class: + - Cross-Site-Scripting (XSS) + paths: include: - '*.html' - '*.mustache' - '*.hbs' - '*.twig' - severity: WARNING patterns: - pattern-inside: - pattern-either: @@ -583,15 +511,26 @@ rules: - pattern-not-inside: href = '{{ url_for(...) ... }}' - pattern-not-inside: href = "/{{ ... }}" - pattern-not-inside: href = '/{{ ... }}' + severity: WARNING - id: generic.html-templates.security.var-in-script-tag.var-in-script-tag - message: Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping - does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on - the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific - encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template - tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`). + languages: + - generic + message: Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML + escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need + this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, + use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using + the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., + `document.getElementById`). metadata: + category: security + confidence: LOW cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection @@ -600,71 +539,53 @@ rules: - https://adamj.eu/tech/2020/02/18/safely-including-data-for-javascript-in-a-django-template/?utm_campaign=Django%2BNewsletter&utm_medium=rss&utm_source=Django_Newsletter_12A - https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough - https://github.com/ESAPI/owasp-esapi-js - category: security - technology: - - html-templates - confidence: LOW - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/generic.html-templates.security.var-in-script-tag.var-in-script-tag - shortlink: https://sg.run/eLWE semgrep.dev: rule: + origin: community r_id: 9032 - rv_id: 1501836 rule_id: 4bUkpl + rv_id: 1501836 + url: + https://semgrep.dev/playground/r/rxTlpQE/generic.html-templates.security.var-in-script-tag.var-in-script-tag version_id: rxTlpQE - url: https://semgrep.dev/playground/r/rxTlpQE/generic.html-templates.security.var-in-script-tag.var-in-script-tag - origin: community - languages: - - generic + shortlink: https://sg.run/eLWE + source: https://semgrep.dev/r/generic.html-templates.security.var-in-script-tag.var-in-script-tag + subcategory: + - audit + technology: + - html-templates + vulnerability_class: + - Cross-Site-Scripting (XSS) paths: include: - '*.mustache' - '*.hbs' - '*.html' - '*.twig' - severity: WARNING patterns: - pattern-inside: - pattern-not-inside: ", $X.CASE_INSENSITIVE); - - $V = $P.matcher(...).replaceAll("");' + - pattern: "$P = $X.compile(\"\", $X.CASE_INSENSITIVE);\n$V = $P.matcher(...).replaceAll(\"\");" + severity: WARNING - id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal + languages: + - java + message: Detected a potential path traversal. A malicious actor could control the location of this file, to include + going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths + are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) + to only retrieve the file name from the path. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' + - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN references: - https://www.owasp.org/index.php/Path_Traversal - category: security - technology: - - java - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Path Traversal - source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal - shortlink: https://sg.run/oxXN semgrep.dev: rule: + origin: community r_id: 9160 - rv_id: 1263064 rule_id: NbUk7X + rv_id: 1263064 + url: + https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal version_id: zyTb2rq - url: https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal - origin: community - message: Detected a potential path traversal. A malicious actor could control the location of this file, to include going - backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. - You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve - the file name from the path. + shortlink: https://sg.run/oxXN + source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Path Traversal mode: taint - pattern-sources: - - patterns: - - pattern-either: - - pattern: '(HttpServletRequest $REQ) - - ' - - patterns: - - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie\ - \ $COOKIE: $COOKIES) {\n ...\n}\n" - - pattern: '$COOKIE.getValue(...) - - ' - - patterns: - - pattern-inside: '$TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...); - - ... - - ' - - pattern: '$PARAM = $VALS[$INDEX]; - - ' pattern-sanitizers: - pattern: org.apache.commons.io.FilenameUtils.getName(...) pattern-sinks: - patterns: - pattern-either: - - pattern: '(java.io.File $FILE) = ... - - ' - - pattern: '(java.io.FileOutputStream $FOS) = ... - - ' - - pattern: 'new java.io.FileInputStream(...) - - ' + - pattern: "(java.io.File $FILE) = ...\n" + - pattern: "(java.io.FileOutputStream $FOS) = ...\n" + - pattern: "new java.io.FileInputStream(...)\n" + pattern-sources: + - patterns: + - pattern-either: + - pattern: "(HttpServletRequest $REQ)\n" + - patterns: + - pattern-inside: "(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);\n...\nfor (javax.servlet.http.Cookie + $COOKIE: $COOKIES) {\n ...\n}\n" + - pattern: "$COOKIE.getValue(...)\n" + - patterns: + - pattern-inside: "$TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...);\n...\n" + - pattern: "$PARAM = $VALS[$INDEX];\n" severity: ERROR +- id: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss languages: - java -- id: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss - message: 'Cross-site scripting detected in HttpServletResponse writer with variable ''$VAR''. User input was detected going + message: "Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: - ''Encode.forHtml($VAR)''.' + 'Encode.forHtml($VAR)'." metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' + - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET - category: security - technology: - - java references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site-Scripting (XSS) - source: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss - shortlink: https://sg.run/pxjN semgrep.dev: rule: + origin: community r_id: 9162 - rv_id: 1263066 rule_id: wdUJOk + rv_id: 1263066 + url: + https://semgrep.dev/playground/r/2KTv2EG/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss version_id: 2KTv2EG - url: https://semgrep.dev/playground/r/2KTv2EG/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss - origin: community - severity: ERROR + shortlink: https://sg.run/pxjN + source: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET + subcategory: + - vuln + technology: + - java + vulnerability_class: + - Cross-Site-Scripting (XSS) patterns: - pattern-inside: $TYPE $FUNC(..., HttpServletResponse $RESP, ...) { ... } - pattern-inside: $VAR = $REQ.getParameter(...); ... - pattern-either: - pattern: $RESP.getWriter(...).write(..., $VAR, ...); - - pattern: '$WRITER = $RESP.getWriter(...); - - ... - - $WRITER.write(..., $VAR, ...); - - ' + - pattern: "$WRITER = $RESP.getWriter(...);\n...\n$WRITER.write(..., $VAR, ...);\n" + severity: ERROR +- id: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled languages: - java -- id: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled - severity: ERROR + message: XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity + attacks. Disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" to false. metadata: + asvs: + control_id: 5.5.2 Insecue XML Deserialization + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding + version: '4' + category: security + confidence: LOW cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - asvs: - section: V5 Validation, Sanitization and Encoding - control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention - version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf - category: security - technology: - - java - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: HIGH - confidence: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled - shortlink: https://sg.run/2x75 semgrep.dev: rule: + origin: community r_id: 9163 - rv_id: 1263068 rule_id: x8Unkq + rv_id: 1263068 + url: + https://semgrep.dev/playground/r/jQTn5Jv/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled version_id: jQTn5Jv - url: https://semgrep.dev/playground/r/jQTn5Jv/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled - origin: community - message: XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. - Disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" to false. + shortlink: https://sg.run/2x75 + source: + https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled + subcategory: + - audit + technology: + - java + vulnerability_class: + - XML Injection patterns: - pattern-either: - - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities", + - pattern: (javax.xml.stream.XMLInputFactory + $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities", true); + - pattern: (javax.xml.stream.XMLInputFactory + $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, true); + - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD, true); - - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, - true); - - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD, true); - - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities", - Boolean.TRUE); - - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, + - pattern: (javax.xml.stream.XMLInputFactory + $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.TRUE); + - pattern: (javax.xml.stream.XMLInputFactory + $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.TRUE); + - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD, Boolean.TRUE); - - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD, Boolean.TRUE); + severity: ERROR +- id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe languages: - java -- id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe - severity: WARNING + message: XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML + external entity vulnerabilities. Explicitly disable external entities by setting + "javax.xml.stream.isSupportingExternalEntities" to false. metadata: + asvs: + control_id: 5.5.2 Insecue XML Deserialization + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention + section: V5 Validation, Sanitization and Encoding + version: '4' + category: security + confidence: MEDIUM cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration - asvs: - section: V5 Validation, Sanitization and Encoding - control_id: 5.5.2 Insecue XML Deserialization - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention - version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser - category: security - technology: - - java - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - vuln - likelihood: LOW - impact: HIGH - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - XML Injection - source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe - shortlink: https://sg.run/XBwA semgrep.dev: rule: + origin: community r_id: 9164 - rv_id: 1263069 rule_id: OrU35O + rv_id: 1263069 + url: + https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe version_id: 1QTypQZ - url: https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe - origin: community - message: XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external - entity vulnerabilities. Explicitly disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" - to false. + shortlink: https://sg.run/XBwA + source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe + subcategory: + - vuln + technology: + - java + vulnerability_class: + - XML Injection patterns: - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(\"javax.xml.stream.isSupportingExternalEntities\"\ , false);\n ...\n}\n" - - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES,\ - \ false);\n ...\n}\n" + - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, + false);\n ...\n}\n" - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(\"javax.xml.stream.isSupportingExternalEntities\"\ , Boolean.FALSE);\n ...\n}\n" - - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES,\ - \ Boolean.FALSE);\n ...\n}\n" + - pattern-not-inside: "$METHOD(...) {\n ...\n $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, + Boolean.FALSE);\n ...\n}\n" - pattern-either: - pattern: javax.xml.stream.XMLInputFactory.newFactory(...) - pattern: new XMLInputFactory(...) + severity: WARNING +- id: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization languages: - java -- id: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization - severity: ERROR + message: Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. + This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an + integer ID to look up your object, or consider alternative serialization schemes such as JSON. metadata: + category: security + confidence: LOW cwe: - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures @@ -5556,39 +4836,29 @@ rules: - https://youtu.be/t_aw1mDNhzI - https://github.com/qtc-de/remote-method-guesser - https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331 - category: security - technology: - - rmi - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: HIGH - confidence: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization - shortlink: https://sg.run/zvnl semgrep.dev: rule: + origin: community r_id: 9217 - rv_id: 1263072 rule_id: NbUkw5 + rv_id: 1263072 + url: + https://semgrep.dev/playground/r/rxTAKN2/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization version_id: rxTAKN2 - url: https://semgrep.dev/playground/r/rxTAKN2/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization - origin: community - message: Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This - object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID - to look up your object, or consider alternative serialization schemes such as JSON. - languages: - - java + shortlink: https://sg.run/zvnl + source: + https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization + subcategory: + - audit + technology: + - rmi + vulnerability_class: + - 'Insecure Deserialization ' patterns: - pattern: "interface $INTERFACE extends Remote {\n $RETURNTYPE $METHOD($PARAMTYPE $PARAM) throws RemoteException;\n}\n" - metavariable-pattern: - metavariable: $PARAMTYPE language: generic + metavariable: $PARAMTYPE patterns: - pattern-not: String - pattern-not: java.lang.String @@ -5616,43 +4886,43 @@ rules: - pattern-not: short - pattern-not: Short - pattern-not: java.lang.Short + severity: ERROR - id: java.spring.security.audit.spel-injection.spel-injection - message: A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that - unfiltered values fall into this risky code evaluation. + languages: + - java + message: A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid + that unfiltered values fall into this risky code evaluation. metadata: + category: security + confidence: LOW cwe: - - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' + - "CWE-94: Improper Control of Generation of Code ('Code Injection')" + cwe2022-top25: true + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A03:2021 - Injection - A05:2025 - Injection - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPEL_INJECTION - category: security - technology: - - spring references: - https://owasp.org/Top10/A03_2021-Injection - cwe2022-top25: true - subcategory: - - audit - likelihood: LOW - impact: HIGH - confidence: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Code Injection - source: https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection - shortlink: https://sg.run/XBp4 semgrep.dev: rule: + origin: community r_id: 9220 - rv_id: 1263075 rule_id: x8Un7b - version_id: kbTzG5Y + rv_id: 1263075 url: https://semgrep.dev/playground/r/kbTzG5Y/java.spring.security.audit.spel-injection.spel-injection - origin: community - severity: WARNING - languages: - - java + version_id: kbTzG5Y + shortlink: https://sg.run/XBp4 + source: https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPEL_INJECTION + subcategory: + - audit + technology: + - spring + vulnerability_class: + - Code Injection patterns: - pattern-either: - pattern-inside: "class $CLASS {\n ...\n ExpressionParser $PARSER;\n ...\n}\n" @@ -5667,84 +4937,88 @@ rules: - pattern: "$X $METHOD(...) {\n ...\n $PARSER.parseExpression(...);\n ...\n}\n" - pattern-not: "$X $METHOD(...) {\n ...\n $PARSER.parseExpression(\"...\");\n ...\n}\n" - pattern-not: "$X $METHOD(...) {\n ...\n String $S = \"...\";\n ...\n $PARSER.parseExpression($S);\n ...\n}\n" + severity: WARNING - id: java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled + languages: + - java message: CSRF protection is disabled for this configuration. This is a security risk. metadata: - cwe: - - 'CWE-352: Cross-Site Request Forgery (CSRF)' - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_PROTECTION_DISABLED asvs: - section: V4 Access Control control_id: 4.2.2 CSRF - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control + section: V4 Access Control version: '4' category: security - technology: - - spring - references: - - https://owasp.org/Top10/A01_2021-Broken_Access_Control - cwe2022-top25: true + confidence: LOW + cwe: + - 'CWE-352: Cross-Site Request Forgery (CSRF)' cwe2021-top25: true - subcategory: - - audit - likelihood: LOW + cwe2022-top25: true impact: MEDIUM - confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site Request Forgery (CSRF) - source: https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled - shortlink: https://sg.run/jRnl + likelihood: LOW + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control semgrep.dev: rule: + origin: community r_id: 9221 - rv_id: 1263080 rule_id: OrU3gK + rv_id: 1263080 + url: + https://semgrep.dev/playground/r/vdT06dL/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled version_id: vdT06dL - url: https://semgrep.dev/playground/r/vdT06dL/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled - origin: community + shortlink: https://sg.run/jRnl + source: https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_PROTECTION_DISABLED + subcategory: + - audit + technology: + - spring + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + pattern: $OBJ.csrf(...).disable(...) severity: WARNING +- id: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect languages: - java - pattern: $OBJ.csrf(...).disable(...) -- id: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect - message: Application redirects a user to a destination URL specified by a user supplied parameter that is not validated. + message: Application redirects a user to a destination URL specified by a user supplied parameter that is not + validated. metadata: + category: security + confidence: MEDIUM cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT - category: security - technology: - - spring references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - subcategory: - - vuln - likelihood: MEDIUM - impact: MEDIUM - confidence: MEDIUM - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect - shortlink: https://sg.run/9oXz semgrep.dev: rule: + origin: community r_id: 9223 - rv_id: 1263083 rule_id: v8Un7w + rv_id: 1263083 + url: + https://semgrep.dev/playground/r/nWT2Lk0/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect version_id: nWT2Lk0 - url: https://semgrep.dev/playground/r/nWT2Lk0/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect - origin: community - severity: WARNING - languages: - - java + shortlink: https://sg.run/9oXz + source: https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT + subcategory: + - vuln + technology: + - spring + vulnerability_class: + - Open Redirect pattern-either: - pattern: "$X $METHOD(...,String $URL,...) {\n return \"redirect:\" + $URL;\n}\n" - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n String $REDIR = \"redirect:\" + $URL;\n ...\n return $REDIR;\n\ @@ -5752,664 +5026,515 @@ rules: - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n new ModelAndView(\"redirect:\" + $URL);\n ...\n}\n" - pattern: "$X $METHOD(...,String $URL,...) {\n ...\n String $REDIR = \"redirect:\" + $URL;\n ...\n new ModelAndView($REDIR);\n\ \ ...\n}" -- id: java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping - patterns: - - pattern-inside: '@RequestMapping(...) - - $RETURNTYPE $METHOD(...) { ... } - - ' - - pattern-not-inside: '@RequestMapping(..., method = $X, ...) - - $RETURNTYPE $METHOD(...) { ... } - - ' - - pattern: 'RequestMapping - - ' - message: Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not - enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly - specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add - the 'method' field and specify the HTTP method (such as 'RequestMethod.POST'). severity: WARNING +- id: java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping + languages: + - java + message: Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are + not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is + not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. + To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST'). metadata: + category: security + confidence: LOW cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control - source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING references: - https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING - category: security - technology: - - spring - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cross-Site Request Forgery (CSRF) - source: https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping - shortlink: https://sg.run/2xlq semgrep.dev: rule: + origin: community r_id: 9219 - rv_id: 1263089 rule_id: wdUJ7q + rv_id: 1263089 + url: + https://semgrep.dev/playground/r/QkTGq2l/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping version_id: QkTGq2l - url: https://semgrep.dev/playground/r/QkTGq2l/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping - origin: community - languages: - - java + shortlink: https://sg.run/2xlq + source: https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping + source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING + subcategory: + - audit + technology: + - spring + vulnerability_class: + - Cross-Site Request Forgery (CSRF) + patterns: + - pattern-inside: "@RequestMapping(...)\n$RETURNTYPE $METHOD(...) { ... }\n" + - pattern-not-inside: "@RequestMapping(..., method = $X, ...)\n$RETURNTYPE $METHOD(...) { ... }\n" + - pattern: "RequestMapping\n" + severity: WARNING - id: javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect - message: It looks like '$UNK' is read from user input and it is used to as a redirect. Ensure '$UNK' is not externally controlled, - otherwise this is an open redirect. + languages: + - javascript + - typescript + message: It looks like '$UNK' is read from user input and it is used to as a redirect. Ensure '$UNK' is not externally + controlled, otherwise this is an open redirect. metadata: - owasp: - - A01:2021 - Broken Access Control - - A01:2025 - Broken Access Control - cwe: - - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' asvs: - section: V5 Validation, Sanitization and Encoding control_id: 5.5.1 Insecue Redirect - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation + section: V5 Validation, Sanitization and Encoding version: '4' category: security - technology: - - express - subcategory: - - audit - likelihood: LOW - impact: LOW confidence: LOW - references: - - https://owasp.org/Top10/A01_2021-Broken_Access_Control + cwe: + - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" + impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Open Redirect - source: https://semgrep.dev/r/javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect - shortlink: https://sg.run/OPv2 + likelihood: LOW + owasp: + - A01:2021 - Broken Access Control + - A01:2025 - Broken Access Control + references: + - https://owasp.org/Top10/A01_2021-Broken_Access_Control semgrep.dev: rule: + origin: community r_id: 9275 - rv_id: 1263147 rule_id: gxU12X + rv_id: 1263147 + url: + https://semgrep.dev/playground/r/3ZT4Xev/javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect version_id: 3ZT4Xev - url: https://semgrep.dev/playground/r/3ZT4Xev/javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect - origin: community - languages: - - javascript - - typescript - severity: WARNING + shortlink: https://sg.run/OPv2 + source: + https://semgrep.dev/r/javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect + subcategory: + - audit + technology: + - express + vulnerability_class: + - Open Redirect patterns: - pattern-either: - - pattern-inside: '$UNK = query.$B; - - ... - - ' - - pattern-inside: '$UNK = $A.query.$B; - - ... - - ' - - pattern-inside: '$UNK = req.$SOMETHING; - - ... - - ' + - pattern-inside: "$UNK = query.$B;\n...\n" + - pattern-inside: "$UNK = $A.query.$B;\n...\n" + - pattern-inside: "$UNK = req.$SOMETHING;\n...\n" - pattern: $RES.redirect(..., <... $UNK ...>, ...) + severity: WARNING - id: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection - message: Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious - attacker could tamper with the gRPC message, which could compromise the machine. + languages: + - javascript + - typescript + message: Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A + malicious attacker could tamper with the gRPC message, which could compromise the machine. metadata: + category: security + confidence: LOW + cwe: + - 'CWE-502: Deserialization of Untrusted Data' + cwe2021-top25: true + cwe2022-top25: true + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: LOW owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures - cwe: - - 'CWE-502: Deserialization of Untrusted Data' - category: security - technology: - - grpc references: - https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security - cwe2022-top25: true - cwe2021-top25: true - subcategory: - - audit - likelihood: LOW - impact: MEDIUM - confidence: LOW - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - 'Insecure Deserialization ' - source: https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection - shortlink: https://sg.run/5QkD semgrep.dev: rule: + origin: community r_id: 9291 - rv_id: 1263180 rule_id: lBU9D8 + rv_id: 1263180 + url: + https://semgrep.dev/playground/r/e1TyjAl/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection version_id: e1TyjAl - url: https://semgrep.dev/playground/r/e1TyjAl/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection - origin: community + shortlink: https://sg.run/5QkD + source: + https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection + subcategory: + - audit + technology: + - grpc + vulnerability_class: + - 'Insecure Deserialization ' + pattern-either: + - pattern: "require('grpc');\n...\n$GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...);\n" + - pattern: "require('grpc');\n...\nnew $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...);\n" + - pattern: "require('grpc');\n...\n$CREDS = <... $CREDENTIALS.createInsecure() ...>;\n...\n$GRPC($ADDR,...,$CREDS,...);" + - pattern: "require('grpc');\n...\n$CREDS = <... $CREDENTIALS.createInsecure() ...>;\n...\nnew $GRPC($ADDR,...,$CREDS,...);" + severity: ERROR +- id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret languages: - javascript - typescript - severity: ERROR - pattern-either: - - pattern: 'require(''grpc''); - - ... - - $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...); - - ' - - pattern: 'require(''grpc''); - - ... - - new $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...); - - ' - - pattern: 'require(''grpc''); - - ... - - $CREDS = <... $CREDENTIALS.createInsecure() ...>; - - ... - - $GRPC($ADDR,...,$CREDS,...);' - - pattern: 'require(''grpc''); - - ... - - $CREDS = <... $CREDENTIALS.createInsecure() ...>; - - ... - - new $GRPC($ADDR,...,$CREDS,...);' -- id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - interfile: true - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures asvs: - section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' version: '4' category: security - technology: - - jose - - jwt - - secrets - cwe2022-top25: true + confidence: HIGH + cwe: + - 'CWE-798: Use of Hard-coded Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: HIGH + interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret - shortlink: https://sg.run/Ro1g + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9293 - rv_id: 1263182 rule_id: JDUyRl - version_id: d6TyxbX + rv_id: 1263182 url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: d6TyxbX + shortlink: https://sg.run/Ro1g + source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret + subcategory: + - vuln + technology: + - jose + - jwt + - secrets + vulnerability_class: + - Hard-coded Secrets + options: + interfile: true + symbolic_propagation: true patterns: - - pattern-inside: '$JOSE = require("jose"); - - ... - - ' + - pattern-inside: "$JOSE = require(\"jose\");\n...\n" - pattern-either: - - pattern-inside: 'var {JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'var {JWK, JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'const {JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'const {JWK, JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'let {JWT} = $JOSE; - - ... - - ' - - pattern-inside: 'let {JWK, JWT} = $JOSE; - - ... - - ' + - pattern-inside: "var {JWT} = $JOSE;\n...\n" + - pattern-inside: "var {JWK, JWT} = $JOSE;\n...\n" + - pattern-inside: "const {JWT} = $JOSE;\n...\n" + - pattern-inside: "const {JWK, JWT} = $JOSE;\n...\n" + - pattern-inside: "let {JWT} = $JOSE;\n...\n" + - pattern-inside: "let {JWK, JWT} = $JOSE;\n...\n" - pattern-either: - - pattern: 'JWT.verify($P, "...", ...); - - ' - - pattern: 'JWT.sign($P, "...", ...); - - ' + - pattern: "JWT.verify($P, \"...\", ...);\n" + - pattern: "JWT.sign($P, \"...\", ...);\n" - pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...); \n" - - pattern: '$JWT.sign($P, JWK.asKey("..."), ...); - - ' - options: - symbolic_propagation: true - interfile: true + - pattern: "$JWT.sign($P, JWK.asKey(\"...\"), ...);\n" + severity: WARNING - id: javascript.jose.security.jwt-none-alg.jwt-none-alg - message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has - already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do - not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + languages: + - javascript + - typescript + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token + has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be + verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: + asvs: + control_id: 3.5.3 Insecue Stateless Session Tokens + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' + version: '4' + category: security + confidence: HIGH cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' + impact: MEDIUM + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - asvs: - section: 'V3: Session Management Verification Requirements' - control_id: 3.5.3 Insecue Stateless Session Tokens - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management - version: '4' - category: security - technology: - - jose - - jwt - subcategory: - - vuln - likelihood: HIGH - impact: MEDIUM - confidence: HIGH references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg - shortlink: https://sg.run/AvRL semgrep.dev: rule: + origin: community r_id: 9294 - rv_id: 1263183 rule_id: 5rUOGN - version_id: ZRTKAyb + rv_id: 1263183 url: https://semgrep.dev/playground/r/ZRTKAyb/javascript.jose.security.jwt-none-alg.jwt-none-alg - origin: community + version_id: ZRTKAyb + shortlink: https://sg.run/AvRL + source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - vuln + technology: + - jose + - jwt + vulnerability_class: + - Cryptographic Issues + pattern-either: + - pattern: "var $JOSE = require(\"jose\");\n...\nvar { JWK, JWT } = $JOSE;\n...\nvar $T = JWT.verify($P, JWK.None,...);\n" + - pattern: "var $JOSE = require(\"jose\");\n...\nvar { JWK, JWT } = $JOSE;\n...\n$T = JWT.verify($P, JWK.None,...);\n" + - pattern: "var $JOSE = require(\"jose\");\n...\nvar { JWK, JWT } = $JOSE;\n...\nJWT.verify($P, JWK.None,...);\n" + severity: ERROR +- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret languages: - javascript - typescript - severity: ERROR - pattern-either: - - pattern: 'var $JOSE = require("jose"); - - ... - - var { JWK, JWT } = $JOSE; - - ... - - var $T = JWT.verify($P, JWK.None,...); - - ' - - pattern: 'var $JOSE = require("jose"); - - ... - - var { JWK, JWT } = $JOSE; - - ... - - $T = JWT.verify($P, JWK.None,...); - - ' - - pattern: 'var $JOSE = require("jose"); - - ... - - var { JWK, JWT } = $JOSE; - - ... - - JWT.verify($P, JWK.None,...); - - ' -- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret - message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks - secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment - variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). + message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this + risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use + environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware + Security Module). metadata: - cwe: - - 'CWE-798: Use of Hard-coded Credentials' - references: - - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - owasp: - - A07:2021 - Identification and Authentication Failures - - A07:2025 - Authentication Failures asvs: - section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' version: '4' category: security - technology: - - jwt - - javascript - - secrets - cwe2022-top25: true + confidence: HIGH + cwe: + - 'CWE-798: Use of Hard-coded Credentials' cwe2021-top25: true - subcategory: - - vuln - likelihood: HIGH + cwe2022-top25: true impact: MEDIUM - confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Hard-coded Secrets - source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret - shortlink: https://sg.run/4xN9 + likelihood: HIGH + owasp: + - A07:2021 - Identification and Authentication Failures + - A07:2025 - Authentication Failures + references: + - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html semgrep.dev: rule: + origin: community r_id: 9300 - rv_id: 1263189 rule_id: WAUon7 - version_id: gETB75D + rv_id: 1263189 url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret - origin: community - languages: - - javascript - - typescript - severity: WARNING + version_id: gETB75D + shortlink: https://sg.run/4xN9 + source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret + subcategory: + - vuln + technology: + - jwt + - javascript + - secrets + vulnerability_class: + - Hard-coded Secrets mode: taint + pattern-sinks: + - patterns: + - pattern-either: + - pattern-inside: "$JWT = require(\"jsonwebtoken\")\n...\n" + - pattern-inside: "import $JWT from \"jsonwebtoken\"\n...\n" + - pattern-inside: "import * as $JWT from \"jsonwebtoken\"\n...\n" + - pattern-inside: "import {...,$JWT,...} from \"jsonwebtoken\"\n...\n" + - pattern-either: + - pattern-inside: "$JWT.sign($DATA,$VALUE,...);\n" + - pattern-inside: "$JWT.verify($DATA,$VALUE,...);\n" + - focus-metavariable: $VALUE pattern-sources: - patterns: - pattern: "$X = '...' \n" - pattern: "$X = '$Y' \n" - patterns: - pattern-either: - - pattern-inside: '$JWT.sign($DATA,"...",...); - - ' - - pattern-inside: '$JWT.verify($DATA,"...",...); - - ' - pattern-sinks: - - patterns: - - pattern-either: - - pattern-inside: '$JWT = require("jsonwebtoken") - - ... - - ' - - pattern-inside: 'import $JWT from "jsonwebtoken" - - ... - - ' - - pattern-inside: 'import * as $JWT from "jsonwebtoken" - - ... - - ' - - pattern-inside: 'import {...,$JWT,...} from "jsonwebtoken" - - ... - - ' - - pattern-either: - - pattern-inside: '$JWT.sign($DATA,$VALUE,...); - - ' - - pattern-inside: '$JWT.verify($DATA,$VALUE,...); - - ' - - focus-metavariable: $VALUE + - pattern-inside: "$JWT.sign($DATA,\"...\",...);\n" + - pattern-inside: "$JWT.verify($DATA,\"...\",...);\n" + severity: WARNING - id: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg - message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has - already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do - not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. + languages: + - javascript + - typescript + message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token + has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be + verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: + asvs: + control_id: 3.5.3 Insecue Stateless Session Tokens + control_url: + https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management + section: 'V3: Session Management Verification Requirements' + version: '4' + category: security + confidence: MEDIUM cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - owasp: + impact: HIGH + license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license + likelihood: MEDIUM + owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures - source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ - asvs: - section: 'V3: Session Management Verification Requirements' - control_id: 3.5.3 Insecue Stateless Session Tokens - control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management - version: '4' - category: security - technology: - - jwt - subcategory: - - vuln - likelihood: MEDIUM - impact: HIGH - confidence: MEDIUM references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license - vulnerability_class: - - Cryptographic Issues - source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg - shortlink: https://sg.run/PJXv semgrep.dev: rule: + origin: community r_id: 9301 - rv_id: 1263190 rule_id: 0oU53g - version_id: QkTGqQo + rv_id: 1263190 url: https://semgrep.dev/playground/r/QkTGqQo/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg - origin: community - languages: - - javascript - - typescript - severity: ERROR + version_id: QkTGqQo + shortlink: https://sg.run/PJXv + source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg + source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ + subcategory: + - vuln + technology: + - jwt + vulnerability_class: + - Cryptographic Issues patterns: - - pattern-inside: '$JWT = require("jsonwebtoken"); - - ... - - ' + - pattern-inside: "$JWT = require(\"jsonwebtoken\");\n...\n" - pattern: $JWT.verify($P, $X, {algorithms:[...,'none',...]},...) + severity: ERROR - id: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag - message: Cannot determine what '$UNK' is and it is used with a '