rules:
- id: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key
  pattern-regex: rk_live_[0-9a-zA-Z]{24}
  languages:
  - regex
  message: Stripe Restricted API Key detected
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
    category: security
    technology:
    - secrets
    - stripe
    confidence: MEDIUM
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    references:
    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key
    shortlink: https://sg.run/ZvdL
    semgrep.dev:
      rule:
        r_id: 9079
        rv_id: 1262900
        rule_id: 5rUOWq
        version_id: K3TKkKj
        url: https://semgrep.dev/playground/r/K3TKkKj/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key
        origin: community
- id: generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri
  patterns:
  - pattern: $PROTOCOL://$...USERNAME:$...PASSWORD@$END
  - metavariable-regex:
      metavariable: $...USERNAME
      regex: \A({?)([A-Za-z])([A-Za-z0-9_-]){5,31}(}?)\Z
  - metavariable-regex:
      metavariable: $...PASSWORD
      regex: (?!.*[\s])(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~]){6,32}
  - metavariable-regex:
      metavariable: $PROTOCOL
      regex: (.*http.*)|(.*sql.*)|(.*ftp.*)|(.*smtp.*)
  languages:
  - generic
  message: Username and password in URI detected
  severity: ERROR
  metadata:
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
    category: security
    technology:
    - secrets
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri
    shortlink: https://sg.run/8yA4
    semgrep.dev:
      rule:
        r_id: 9084
        rv_id: 1262903
        rule_id: DbUple
        version_id: YDTZeZE
        url: https://semgrep.dev/playground/r/YDTZeZE/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri
        origin: community
- id: go.jwt-go.security.jwt.hardcoded-jwt-key
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  options:
    interfile: true
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    category: security
    technology:
    - jwt
    - secrets
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key
    shortlink: https://sg.run/Rod2
    semgrep.dev:
      rule:
        r_id: 9093
        rv_id: 1262920
        rule_id: GdU7Ny
        version_id: pZT0305
        url: https://semgrep.dev/playground/r/pZT0305/go.jwt-go.security.jwt.hardcoded-jwt-key
        origin: community
  severity: WARNING
  languages:
  - go
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-inside: |
        []byte("$F")
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $TOKEN.SignedString($F)
    - focus-metavariable: $F
- id: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd
  patterns:
  - pattern-either:
    - patterns:
      - pattern: |
          exec.Cmd {...,Path: $CMD,...}
      - pattern-not: |
          exec.Cmd {...,Path: "...",...}
      - pattern-not-inside: |
          $CMD,$ERR := exec.LookPath("...");
          ...
      - pattern-not-inside: |
          $CMD = "...";
          ...
    - patterns:
      - pattern: |
          exec.Cmd {...,Args: $ARGS,...}
      - pattern-not: |
          exec.Cmd {...,Args: []string{...},...}
      - pattern-not-inside: |
          $ARGS = []string{"...",...};
          ...
      - pattern-not-inside: |
          $CMD = "...";
          ...
          $ARGS = []string{$CMD,...};
          ...
      - pattern-not-inside: |
          $CMD = exec.LookPath("...");
          ...
          $ARGS = []string{$CMD,...};
          ...
    - patterns:
      - pattern: |
          exec.Cmd {...,Args: []string{$CMD,...},...}
      - pattern-not: |
          exec.Cmd {...,Args: []string{"...",...},...}
      - pattern-not-inside: |
          $CMD,$ERR := exec.LookPath("...");
          ...
      - pattern-not-inside: |
          $CMD = "...";
          ...
    - patterns:
      - pattern-either:
        - pattern: |
            exec.Cmd {...,Args: []string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...},...}
        - patterns:
          - pattern: |
              exec.Cmd {...,Args: []string{$CMD,"-c",$EXE,...},...}
          - pattern-inside: |
              $CMD,$ERR := exec.LookPath("=~/(sh|bash|ksh|csh|tcsh|zsh)/");
              ...
      - pattern-not: |
          exec.Cmd {...,Args: []string{"...","...","...",...},...}
      - pattern-not-inside: |
          $EXE = "...";
          ...
  - pattern-inside: |
      import "os/exec"
      ...
  message: Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'.
    If unverified user data can reach this call site, this is a code injection vulnerability.
    A malicious actor can inject a malicious script to execute arbitrary code.
  metadata:
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - go
    confidence: MEDIUM
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd
    shortlink: https://sg.run/Dorj
    semgrep.dev:
      rule:
        r_id: 9108
        rv_id: 1262934
        rule_id: 2ZUb8l
        version_id: e1Tyjeg
        url: https://semgrep.dev/playground/r/e1Tyjeg/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd
        origin: community
  severity: ERROR
  languages:
  - go
- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string
  message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()'
    does not escape contents. Be absolutely sure there is no user-controlled data
    in this template. If user data can reach this template, you may have a XSS vulnerability.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://golang.org/pkg/html/template/#HTML
    category: security
    technology:
    - go
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string
    shortlink: https://sg.run/weE0
    semgrep.dev:
      rule:
        r_id: 9129
        rv_id: 1262943
        rule_id: 8GUjDW
        version_id: gETB7Pe
        url: https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string
        origin: community
  languages:
  - go
  severity: WARNING
  patterns:
  - pattern-not: template.HTML("..." + "...")
  - pattern-either:
    - pattern: template.HTML($T + $X, ...)
    - pattern: template.HTML(fmt.$P("...", ...), ...)
    - pattern: |
        $T = "..."
        ...
        $T = $FXN(..., $T, ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = fmt.$P("...", ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T, $ERR = fmt.$P("...", ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = $X + $Y
        ...
        template.HTML($T, ...)
    - pattern: |-
        $T = "..."
        ...
        $OTHER, $ERR = fmt.$P(..., $T, ...)
        ...
        template.HTML($OTHER, ...)
- id: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
  patterns:
  - pattern-inside: |
      func $FUNC(..., $W http.ResponseWriter, ...) {
        ...
        var $TEMPLATE = "..."
        ...
        $W.Write([]byte(fmt.$PRINTF($TEMPLATE, ...)), ...)
        ...
      }
  - pattern-either:
    - pattern: |
        $PARAMS = r.URL.Query()
        ...
        $DATA, $ERR := $PARAMS[...]
        ...
        $INTERM = $ANYTHING(..., $DATA, ...)
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
    - pattern: |
        $PARAMS = r.URL.Query()
        ...
        $DATA, $ERR := $PARAMS[...]
        ...
        $INTERM = $DATA[...]
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
    - pattern: |
        $DATA, $ERR := r.URL.Query()[...]
        ...
        $INTERM = $DATA[...]
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
    - pattern: |
        $DATA, $ERR := r.URL.Query()[...]
        ...
        $INTERM = $ANYTHING(..., $DATA, ...)
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
    - pattern: |
        $PARAMS = r.URL.Query()
        ...
        $DATA, $ERR := $PARAMS[...]
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $DATA, ...)))
  message: Found data going from url query parameters into formatted data written
    to ResponseWriter. This could be XSS and should not be done. If you must do this,
    ensure your data is sanitized or escaped.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - go
    confidence: MEDIUM
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
    shortlink: https://sg.run/Zvon
    semgrep.dev:
      rule:
        r_id: 9135
        rv_id: 1262949
        rule_id: JDUyXB
        version_id: 5PTo1qr
        url: https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
        origin: community
  severity: WARNING
  languages:
  - go
- id: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    technology:
    - java
    - secrets
    - jwt
    category: security
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
    shortlink: https://sg.run/RoDK
    semgrep.dev:
      rule:
        r_id: 9149
        rv_id: 1262980
        rule_id: oqUeAn
        version_id: d6Tyx8j
        url: https://semgrep.dev/playground/r/d6Tyx8j/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
        origin: community
  languages:
  - java
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: |
        (Algorithm $ALG) = $ALGO.$HMAC("$Y");
    - pattern: |
        $SECRET = "$Y";
        ...
        (Algorithm $ALG) = $ALGO.$HMAC($SECRET);
    - pattern: |
        class $CLASS {
          ...
          $TYPE $SECRET = "$Y";
          ...
          $RETURNTYPE $FUNC (...) {
            ...
            (Algorithm $ALG) = $ALGO.$HMAC($SECRET);
            ...
          }
          ...
        }
  - focus-metavariable: $Y
  - metavariable-regex:
      metavariable: $HMAC
      regex: (HMAC384|HMAC256|HMAC512)
- id: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
  metadata:
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN
    references:
    - https://www.owasp.org/index.php/Path_Traversal
    category: security
    technology:
    - jax-rs
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
    shortlink: https://sg.run/DoWj
    semgrep.dev:
      rule:
        r_id: 9152
        rv_id: 1262984
        rule_id: 2ZUb9l
        version_id: 7ZTE3KW
        url: https://semgrep.dev/playground/r/7ZTE3KW/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
        origin: community
  message: Detected a potential path traversal. A malicious actor could control the
    location of this file, to include going backwards in the directory with '../'.
    To address this, ensure that user-controlled variables in file paths are sanitized.
    You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...)
    to only retrieve the file name from the path.
  severity: WARNING
  languages:
  - java
  pattern-either:
  - pattern: |
      $RETURNTYPE $FUNC (..., @PathParam(...) $TYPE $VAR, ...) {
        ...
        new File(..., $VAR, ...);
        ...
      }
  - pattern: |-
      $RETURNTYPE $FUNC (..., @javax.ws.rs.PathParam(...) $TYPE $VAR, ...) {
        ...
        new File(..., $VAR, ...);
        ...
      }
- id: java.jboss.security.session_sqli.find-sql-string-concatenation
  message: In $METHOD, $X is used to construct a SQL query via string concatenation.
  languages:
  - java
  severity: ERROR
  pattern-either:
  - pattern: |
      $RETURN $METHOD(...,String $X,...){
        ...
        Session $SESSION = ...;
        ...
        String $QUERY = ... + $X + ...;
        ...
        PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY);
        ...
        ResultSet $RESULT = $PS.executeQuery();
        ...
      }
  - pattern: |
      $RETURN $METHOD(...,String $X,...){
        ...
        String $QUERY = ... + $X + ...;
        ...
        Session $SESSION = ...;
        ...
        PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY);
        ...
        ResultSet $RESULT = $PS.executeQuery();
        ...
      }
  metadata:
    category: security
    technology:
    - jboss
    confidence: MEDIUM
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation
    shortlink: https://sg.run/W8kA
    semgrep.dev:
      rule:
        r_id: 9153
        rv_id: 1262986
        rule_id: X5U8rQ
        version_id: 8KT5r3v
        url: https://semgrep.dev/playground/r/8KT5r3v/java.jboss.security.session_sqli.find-sql-string-concatenation
        origin: community
- id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
  metadata:
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN
    references:
    - https://www.owasp.org/index.php/Path_Traversal
    category: security
    technology:
    - java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
    shortlink: https://sg.run/oxXN
    semgrep.dev:
      rule:
        r_id: 9160
        rv_id: 1263064
        rule_id: NbUk7X
        version_id: zyTb2rq
        url: https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
        origin: community
  message: Detected a potential path traversal. A malicious actor could control the
    location of this file, to include going backwards in the directory with '../'.
    To address this, ensure that user-controlled variables in file paths are sanitized.
    You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...)
    to only retrieve the file name from the path.
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletRequest $REQ)
      - patterns:
        - pattern-inside: |
            (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
            ...
            for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
              ...
            }
        - pattern: |
            $COOKIE.getValue(...)
      - patterns:
        - pattern-inside: |
            $TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...);
            ...
        - pattern: |
            $PARAM = $VALS[$INDEX];
  pattern-sanitizers:
  - pattern: org.apache.commons.io.FilenameUtils.getName(...)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          (java.io.File $FILE) = ...
      - pattern: |
          (java.io.FileOutputStream $FOS) = ...
      - pattern: |
          new java.io.FileInputStream(...)
  severity: ERROR
  languages:
  - java
- id: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization
  severity: WARNING
  languages:
  - java
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.3 Insecue Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf
    category: security
    technology:
    - java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization
    shortlink: https://sg.run/zvO1
    semgrep.dev:
      rule:
        r_id: 9161
        rv_id: 1263065
        rule_id: kxUk12
        version_id: pZT03A1
        url: https://semgrep.dev/playground/r/pZT03A1/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization
        origin: community
  message: JMS Object messages depend on Java Serialization for marshalling/unmarshalling
    of the message payload when ObjectMessage.getObject() is called. Deserialization
    of untrusted data can lead to security flaws; a remote attacker could via a crafted
    JMS ObjectMessage to execute arbitrary code with the permissions of the application
    listening/consuming JMS Messages. In this case, the JMS MessageListener consume
    an ObjectMessage type received inside the onMessage method, which may lead to
    arbitrary code execution when calling the $Y.getObject method.
  patterns:
  - pattern-inside: |
      public class $JMS_LISTENER implements MessageListener {
        ...
        public void onMessage(Message $JMS_MSG) {
            ...
        }
      }
  - pattern-either:
    - pattern-inside: $X = $Y.getObject(...);
    - pattern-inside: $X = ($Z) $Y.getObject(...);
- id: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
  message: 'Cross-site scripting detected in HttpServletResponse writer with variable
    ''$VAR''. User input was detected going directly from the HttpServletRequest into
    output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml:
    ''Encode.forHtml($VAR)''.'
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
    shortlink: https://sg.run/pxjN
    semgrep.dev:
      rule:
        r_id: 9162
        rv_id: 1263066
        rule_id: wdUJOk
        version_id: 2KTv2EG
        url: https://semgrep.dev/playground/r/2KTv2EG/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
        origin: community
  severity: ERROR
  patterns:
  - pattern-inside: $TYPE $FUNC(..., HttpServletResponse $RESP, ...) { ... }
  - pattern-inside: $VAR = $REQ.getParameter(...); ...
  - pattern-either:
    - pattern: $RESP.getWriter(...).write(..., $VAR, ...);
    - pattern: |
        $WRITER = $RESP.getWriter(...);
        ...
        $WRITER.write(..., $VAR, ...);
  languages:
  - java
- id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://semgrep.dev/blog/2022/xml-security-in-java
    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
    - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf
    - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser
    category: security
    technology:
    - java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
    shortlink: https://sg.run/XBwA
    semgrep.dev:
      rule:
        r_id: 9164
        rv_id: 1263069
        rule_id: OrU35O
        version_id: 1QTypQZ
        url: https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
        origin: community
  message: XML external entities are not explicitly disabled for this XMLInputFactory.
    This could be vulnerable to XML external entity vulnerabilities. Explicitly disable
    external entities by setting "javax.xml.stream.isSupportingExternalEntities" to
    false.
  patterns:
  - pattern-not-inside: |
      $METHOD(...) {
        ...
        $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
        ...
      }
  - pattern-not-inside: |
      $METHOD(...) {
        ...
        $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
        ...
      }
  - pattern-not-inside: |
      $METHOD(...) {
        ...
        $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.FALSE);
        ...
      }
  - pattern-not-inside: |
      $METHOD(...) {
        ...
        $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
        ...
      }
  - pattern-either:
    - pattern: javax.xml.stream.XMLInputFactory.newFactory(...)
    - pattern: new XMLInputFactory(...)
  languages:
  - java
- id: java.lang.security.audit.formatted-sql-string.formatted-sql-string
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.5 Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
    - https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps
    - https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement
    category: security
    technology:
    - java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string
    shortlink: https://sg.run/OPXp
    semgrep.dev:
      rule:
        r_id: 9175
        rv_id: 1409389
        rule_id: QrUzxR
        version_id: ExTeyBP
        url: https://semgrep.dev/playground/r/ExTeyBP/java.lang.security.audit.formatted-sql-string.formatted-sql-string
        origin: community
  options:
    taint_assume_safe_numbers: true
    taint_assume_safe_booleans: true
  message: Detected a formatted string in a SQL statement. This could lead to SQL
    injection if variables in the SQL statement are not properly sanitized. Use a
    prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement
    using 'connection.prepareStatement'.
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletRequest $REQ)
      - patterns:
        - pattern-inside: |
            $ANNOT $FUNC (..., $INPUT, ...) {
              ...
            }
        - pattern: (String $INPUT)
        - focus-metavariable: $INPUT
    label: INPUT
  - patterns:
    - pattern-either:
      - pattern: $X + $INPUT
      - pattern: $X += $INPUT
      - pattern: String.format(..., $INPUT, ...)
      - pattern: String.join(..., $INPUT, ...)
      - pattern: (String $STR).concat($INPUT)
      - pattern: $INPUT.concat(...)
      - patterns:
        - pattern-either:
          - pattern: $STRB.append($INPUT)
          - pattern: new $STRB(..., $INPUT, ...)
        - metavariable-type:
            metavariable: $STRB
            type: StringBuilder
    label: CONCAT
    requires: INPUT
  pattern-propagators:
  - pattern: (StringBuffer $S).append($X)
    from: $X
    to: $S
  - pattern: (StringBuilder $S).append($X)
    from: $X
    to: $S
  pattern-sinks:
  - patterns:
    - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE *$/" ...>)
    - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE %s$/" ...>)
    - pattern-either:
      - pattern: (Statement $S).$SQLFUNC(...)
      - pattern: (PreparedStatement $P).$SQLFUNC(...)
      - pattern: (Connection $C).createStatement(...).$SQLFUNC(...)
      - pattern: (Connection $C).prepareStatement(...).$SQLFUNC(...)
      - pattern: (EntityManager $EM).$SQLFUNC(...)
    - metavariable-regex:
        metavariable: $SQLFUNC
        regex: execute|executeQuery|createQuery|query|addBatch|nativeSQL|create|prepare
    requires: CONCAT
  pattern-sanitizers:
  - patterns:
    - pattern: (CriteriaBuilder $CB).$ANY(...)
  severity: ERROR
  languages:
  - java
- id: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer
  message: Detected a request with potential user-input going into a OutputStream
    or Writer object. This bypasses any view or template environments, including HTML
    escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities.
    Consider using a view technology such as JavaServer Faces (JSFs) which automatically
    escapes HTML views.
  severity: WARNING
  options:
    interfile: true
  metadata:
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    cwe2021-top25: true
    cwe2022-top25: true
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html
    subcategory:
    - vuln
    technology:
    - java
    - servlets
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer
    shortlink: https://sg.run/KlRL
    semgrep.dev:
      rule:
        r_id: 9211
        rv_id: 1263055
        rule_id: j2Uv7B
        version_id: DkTRbXy
        url: https://semgrep.dev/playground/r/DkTRbXy/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer
        origin: community
  languages:
  - java
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletRequest $REQ).$REQFUNC(...)
      - pattern: "(ServletRequest $REQ).$REQFUNC(...) \n"
    - metavariable-regex:
        metavariable: $REQFUNC
        regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletResponse $RESPONSE).getWriter(...).$WRITE(...)
      - pattern: |
          (HttpServletResponse $RESPONSE).getOutputStream(...).$WRITE(...)
      - pattern: |
          (java.io.PrintWriter $WRITER).$WRITE(...)
      - pattern: |
          (PrintWriter $WRITER).$WRITE(...)
      - pattern: |
          (javax.servlet.ServletOutputStream $WRITER).$WRITE(...)
      - pattern: |
          (ServletOutputStream $WRITER).$WRITE(...)
      - pattern: |
          (java.io.OutputStream $WRITER).$WRITE(...)
      - pattern: |
          (OutputStream $WRITER).$WRITE(...)
  pattern-sanitizers:
  - pattern-either:
    - pattern: Encode.forHtml(...)
    - pattern: (PolicyFactory $POLICY).sanitize(...)
    - pattern: (AntiSamy $AS).scan(...)
    - pattern: JSoup.clean(...)
    - pattern: org.apache.commons.lang.StringEscapeUtils.escapeHtml(...)
    - pattern: org.springframework.web.util.HtmlUtils.htmlEscape(...)
    - pattern: org.owasp.esapi.ESAPI.encoder().encodeForHTML(...)
- id: java.spring.security.audit.spring-sqli.spring-sqli
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: $ARG
    - pattern-inside: |
        public $T $M (..., String $ARG,...){...}
  pattern-sanitizers:
  - not_conflicting: true
    pattern-either:
    - patterns:
      - focus-metavariable: $A
      - pattern-inside: |
          new $TYPE(...,$A,...);
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - focus-metavariable: $A
        - pattern: |
            new PreparedStatementCreatorFactory($A,...);
      - patterns:
        - focus-metavariable: $A
        - pattern: |
            (JdbcTemplate $T).$M($A,...)
      - patterns:
        - pattern: (String $A)
        - pattern-inside: |
            (JdbcTemplate $T).batchUpdate(...)
      - patterns:
        - focus-metavariable: $A
        - pattern: |
            NamedParameterBatchUpdateUtils.$M($A,...)
      - patterns:
        - focus-metavariable: $A
        - pattern: |
            BatchUpdateUtils.$M($A,...)
  message: Detected a string argument from a public method contract in a raw SQL statement.
    This could lead to SQL injection if variables in the SQL statement are not properly
    sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You
    can obtain a PreparedStatement using 'connection.prepareStatement'.
  languages:
  - java
  severity: WARNING
  options:
    taint_assume_safe_numbers: true
    taint_assume_safe_booleans: true
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    category: security
    technology:
    - spring
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli
    shortlink: https://sg.run/1Z3x
    semgrep.dev:
      rule:
        r_id: 9222
        rv_id: 1263082
        rule_id: eqU8N2
        version_id: ZRTKAWW
        url: https://semgrep.dev/playground/r/ZRTKAWW/java.spring.security.audit.spring-sqli.spring-sqli
        origin: community
- id: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled
  message: $sceProvider is set to false. Disabling Strict Contextual escaping (SCE)
    in an AngularJS application could provide additional attack surface for XSS vulnerabilities.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    references:
    - https://docs.angularjs.org/api/ng/service/$sce
    - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
    category: security
    technology:
    - angular
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled
    shortlink: https://sg.run/N4DG
    semgrep.dev:
      rule:
        r_id: 9227
        rv_id: 1263094
        rule_id: EwU20Z
        version_id: 5PTo1EW
        url: https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  pattern: |
    $sceProvider.enabled(false);
- id: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method
  message: The use of $sce.trustAs can be dangerous if unsanitized user input flows
    through this API.
  metadata:
    references:
    - https://docs.angularjs.org/api/ng/service/$sce
    - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
    category: security
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    technology:
    - angular
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method
    shortlink: https://sg.run/OPW2
    semgrep.dev:
      rule:
        r_id: 9231
        rv_id: 1263098
        rule_id: gxU1QX
        version_id: BjTkZv0
        url: https://semgrep.dev/playground/r/BjTkZv0/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-inside: |
        app.controller(..., function($scope,$sce) {
        ...
        });
    - pattern: $scope.$X
  pattern-sinks:
  - pattern: $sce.trustAs(...)
  - pattern: $sce.trustAsHtml(...)
- id: javascript.browser.security.raw-html-concat.raw-html-concat
  message: User controlled data in a HTML string may result in XSS
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/www-community/attacks/xss/
    category: security
    technology:
    - browser
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat
    shortlink: https://sg.run/4xAx
    semgrep.dev:
      rule:
        r_id: 9244
        rv_id: 1263123
        rule_id: 0oU5b5
        version_id: 2KTv2wp
        url: https://semgrep.dev/playground/r/2KTv2wp/javascript.browser.security.raw-html-concat.raw-html-concat
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: location.href
      - pattern: location.hash
      - pattern: location.search
      - pattern: $WINDOW. ... .location.href
      - pattern: $WINDOW. ... .location.hash
      - pattern: $WINDOW. ... .location.search
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: $STRING + $EXPR
        - pattern-not: $STRING + "..."
        - metavariable-pattern:
            patterns:
            - pattern: <$TAG ...
            - pattern-not: <$TAG ...>...</$TAG>...
            metavariable: $STRING
            language: generic
      - patterns:
        - pattern: $EXPR + $STRING
        - pattern-not: '"..." + $STRING'
        - metavariable-pattern:
            patterns:
            - pattern: '... </$TAG'
            metavariable: $STRING
            language: generic
      - patterns:
        - pattern: '[..., $STRING, ...].join(...)'
        - metavariable-pattern:
            patterns:
            - pattern: <$TAG ...
            metavariable: $STRING
            language: generic
      - patterns:
        - pattern: '[..., $STRING, ...].join(...)'
        - metavariable-pattern:
            patterns:
            - pattern: '... </$TAG'
            metavariable: $STRING
            language: generic
      - patterns:
        - pattern: $VAR += $STRING
        - metavariable-pattern:
            patterns:
            - pattern: <$TAG ...
            metavariable: $STRING
            language: generic
      - patterns:
        - pattern: $VAR += $STRING
        - metavariable-pattern:
            patterns:
            - pattern: '... </$TAG'
            metavariable: $STRING
            language: generic
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          import * as $S from "underscore.string"
          ...
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          $S = require("underscore.string")
          ...
    - pattern-either:
      - pattern: $S.escapeHTML(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "dompurify"
          ...
      - pattern-inside: |
          import { ..., $S,... } from "dompurify"
          ...
      - pattern-inside: |
          import * as $S from "dompurify"
          ...
      - pattern-inside: |
          $S = require("dompurify")
          ...
      - pattern-inside: |
          import $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          import * as $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          $S = require("isomorphic-dompurify")
          ...
    - pattern-either:
      - patterns:
        - pattern-inside: |
            $VALUE = $S(...)
            ...
        - pattern: $VALUE.sanitize(...)
      - patterns:
        - pattern-inside: |
            $VALUE = $S.sanitize
            ...
        - pattern: $S(...)
      - pattern: $S.sanitize(...)
      - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'xss';
          ...
      - pattern-inside: |
          import * as $S from 'xss';
          ...
      - pattern-inside: |
          $S = require("xss")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'sanitize-html';
          ...
      - pattern-inside: |
          import * as $S from "sanitize-html";
          ...
      - pattern-inside: |
          $S = require("sanitize-html")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $S = new Remarkable()
          ...
    - pattern: $S.render(...)
- id: javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection
  message: If unverified user data can reach the `compileScript` method it can result
    in Server-Side Request Forgery vulnerabilities
  metadata:
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    category: security
    technology:
    - chrome-remote-interface
    references:
    - https://github.com/cyrus-and/chrome-remote-interface
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection
    shortlink: https://sg.run/J9kj
    semgrep.dev:
      rule:
        r_id: 9246
        rv_id: 1263126
        rule_id: qNUjnb
        version_id: 1QTypkQ
        url: https://semgrep.dev/playground/r/1QTypkQ/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-inside: function ... (..., $ARG,...) {...}
    - focus-metavariable: $ARG
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          require('chrome-remote-interface');
          ...
      - pattern-inside: |
          import 'chrome-remote-interface';
          ...
    - pattern-either:
      - pattern: |
          $RUNTIME.compileScript({expression: $SINK},...)
      - pattern: |
          $RUNTIME.evaluate({expression: $SINK},...)
      - pattern: |
          $PAGE.navigate({url: $SINK},...)
      - pattern: |
          $RUNTIME.printToPDF({headerTemplate: $SINK},...)
      - pattern: |
          $RUNTIME.printToPDF({footerTemplate: $SINK},...)
      - pattern: |
          $PAGE.setDocumentContent({html: $SINK},...)
    - focus-metavariable: $SINK
- id: javascript.express.security.express-expat-xxe.express-expat-xxe
  message: Make sure that unverified user data can not reach the XML Parser, as it
    can result in XML External or Internal Entity (XXE) Processing vulnerabilities.
  options:
    interfile: true
  metadata:
    interfile: true
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://github.com/astro/node-expat
    category: security
    technology:
    - express
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe
    shortlink: https://sg.run/BkXx
    semgrep.dev:
      rule:
        r_id: 9251
        rv_id: 1263164
        rule_id: zdUkJl
        version_id: o5TbD5l
        url: https://semgrep.dev/playground/r/o5TbD5l/javascript.express.security.express-expat-xxe.express-expat-xxe
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $XML = require('node-expat')
          ...
      - pattern-inside: |
          import $XML from 'node-expat'
          ...
      - pattern-inside: |
          import * as $XML from 'node-expat'
          ...
    - pattern-either:
      - pattern-inside: |
          $PARSER = new $XML.Parser(...);
          ...
    - pattern-either:
      - pattern: $PARSER.parse($QUERY)
      - pattern: $PARSER.write($QUERY)
    - focus-metavariable: $QUERY
- id: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  options:
    interfile: true
  metadata:
    interfile: true
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    category: security
    technology:
    - express
    - secrets
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret
    shortlink: https://sg.run/Do1d
    semgrep.dev:
      rule:
        r_id: 9252
        rv_id: 1263166
        rule_id: pKUOjy
        version_id: pZT03Q0
        url: https://semgrep.dev/playground/r/pZT03Q0/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern-inside: |
        $JWT = require('express-jwt');
        ...
    - pattern-inside: |
        import $JWT from 'express-jwt';
        ...
    - pattern-inside: |
        import * as $JWT from 'express-jwt';
        ...
    - pattern-inside: |
        import { ..., $JWT, ... } from 'express-jwt';
        ...
  - pattern-either:
    - pattern: |
        $JWT({...,secret: "$Y",...},...)
    - pattern: |
        $OPTS = "$Y";
        ...
        $JWT({...,secret: $OPTS},...);
  - focus-metavariable: $Y
- id: javascript.express.security.express-phantom-injection.express-phantom-injection
  message: If unverified user data can reach the `phantom` methods it can result in
    Server-Side Request Forgery vulnerabilities
  metadata:
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    category: security
    technology:
    - express
    references:
    - https://phantomjs.org/page-automation.html
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection
    shortlink: https://sg.run/W8BL
    semgrep.dev:
      rule:
        r_id: 9253
        rv_id: 1263167
        rule_id: 2ZUbx3
        version_id: 2KTv26p
        url: https://semgrep.dev/playground/r/2KTv26p/javascript.express.security.express-phantom-injection.express-phantom-injection
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          require('phantom');
          ...
      - pattern-inside: |
          import 'phantom';
          ...
    - pattern-either:
      - pattern: $PAGE.open($SINK,...)
      - pattern: $PAGE.setContent($SINK,...)
      - pattern: $PAGE.openUrl($SINK,...)
      - pattern: $PAGE.evaluateJavaScript($SINK,...)
      - pattern: $PAGE.property("content",$SINK,...)
    - focus-metavariable: $SINK
- id: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection
  message: If unverified user data can reach the `puppeteer` methods it can result
    in Server-Side Request Forgery vulnerabilities
  metadata:
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    category: security
    technology:
    - express
    references:
    - https://pptr.dev/api/puppeteer.page
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection
    shortlink: https://sg.run/0QJB
    semgrep.dev:
      rule:
        r_id: 9254
        rv_id: 1263168
        rule_id: X5U8Nz
        version_id: X0TzyJY
        url: https://semgrep.dev/playground/r/X0TzyJY/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          require('puppeteer');
          ...
      - pattern-inside: |
          import 'puppeteer';
          ...
    - pattern-either:
      - pattern: $PAGE.goto($SINK,...)
      - pattern: $PAGE.setContent($SINK,...)
      - pattern: $PAGE.evaluate($SINK,...)
      - pattern: $PAGE.evaluate($CODE,$SINK,...)
      - pattern: $PAGE.evaluateHandle($SINK,...)
      - pattern: $PAGE.evaluateHandle($CODE,$SINK,...)
      - pattern: $PAGE.evaluateOnNewDocument($SINK,...)
      - pattern: $PAGE.evaluateOnNewDocument($CODE,$SINK,...)
    - focus-metavariable: $SINK
- id: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection
  message: Make sure that unverified user data can not reach `sandbox`.
  metadata:
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    category: security
    technology:
    - express
    cwe2022-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection
    shortlink: https://sg.run/KlwL
    semgrep.dev:
      rule:
        r_id: 9255
        rv_id: 1263169
        rule_id: j2UvXB
        version_id: jQTn59D
        url: https://semgrep.dev/playground/r/jQTn59D/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
  pattern-sinks:
  - patterns:
    - pattern-inside: |
        $SANDBOX = require('sandbox');
        ...
    - pattern-either:
      - patterns:
        - pattern-inside: |
            $S = new $SANDBOX(...);
            ...
        - pattern: |
            $S.run(...)
      - pattern: |
          new $SANDBOX($OPTS).run(...)
      - pattern: new $SANDBOX().run(...)
- id: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe
  message: Make sure that unverified user data can not reach the XML Parser, as it
    can result in XML External or Internal Entity (XXE) Processing vulnerabilities
  metadata:
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    category: security
    technology:
    - express
    references:
    - https://www.npmjs.com/package/xml2json
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe
    shortlink: https://sg.run/XBD4
    semgrep.dev:
      rule:
        r_id: 9264
        rv_id: 1263174
        rule_id: x8Uneb
        version_id: bZT534J
        url: https://semgrep.dev/playground/r/bZT534J/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
      - pattern: $REQ.files.$ANYTHING.data.toString('utf8')
      - pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
      - pattern: files.$ANYTHING.data.toString('utf8')
      - pattern: files.$ANYTHING['data'].toString('utf8')
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          require('xml2json');
          ...
      - pattern-inside: |
          import 'xml2json';
          ...
    - pattern: $EXPAT.toJson($SINK,...)
    - focus-metavariable: $SINK
- id: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal
  message: Possible writing outside of the destination, make sure that the target
    path is nested in the intended destination
  metadata:
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    category: security
    references:
    - https://owasp.org/www-community/attacks/Path_Traversal
    technology:
    - express
    - node.js
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal
    shortlink: https://sg.run/weRn
    semgrep.dev:
      rule:
        r_id: 9273
        rv_id: 1263141
        rule_id: L1Uyb8
        version_id: ExTExX0
        url: https://semgrep.dev/playground/r/ExTExX0/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
  pattern-sinks:
  - patterns:
    - focus-metavariable: $SINK
    - pattern-either:
      - pattern-inside: |
          $PATH = require('path');
          ...
      - pattern-inside: |
          import $PATH from 'path';
          ...
    - pattern-either:
      - pattern: $PATH.join(...,$SINK,...)
      - pattern: $PATH.resolve(...,$SINK,...)
  - patterns:
    - focus-metavariable: $SINK
    - pattern-inside: |
        import 'path';
        ...
    - pattern-either:
      - pattern: path.join(...,$SINK,...)
      - pattern: path.resolve(...,$SINK,...)
  pattern-sanitizers:
  - pattern: $Y.replace(...)
  - pattern: $Y.indexOf(...)
  - pattern: |
      function ... (...) {
          ...
          <... $Y.indexOf(...) ...>
          ...
      }
  - patterns:
    - pattern: $FUNC(...)
    - metavariable-regex:
        metavariable: $FUNC
        regex: sanitize
- id: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event
  message: Xml Parser is used inside Request Event. Make sure that unverified user
    data can not reach the XML Parser, as it can result in XML External or Internal
    Entity (XXE) Processing vulnerabilities
  metadata:
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    category: security
    technology:
    - express
    references:
    - https://www.npmjs.com/package/xml2json
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event
    shortlink: https://sg.run/x1AA
    semgrep.dev:
      rule:
        r_id: 9274
        rv_id: 1263146
        rule_id: 8GUjkk
        version_id: QkTGqgo
        url: https://semgrep.dev/playground/r/QkTGqgo/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          require('xml2json');
          ...
      - pattern-inside: |
          import 'xml2json';
          ...
    - pattern: $REQ.on('...', function(...) { ... $EXPAT.toJson($INPUT,...); ... })
    - focus-metavariable: $INPUT
- id: javascript.express.security.audit.xss.direct-response-write.direct-response-write
  message: Detected directly writing to a Response object from user-defined input.
    This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting
    (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.
  options:
    interfile: true
  metadata:
    interfile: true
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    category: security
    technology:
    - express
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    source: https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write
    shortlink: https://sg.run/vzGl
    semgrep.dev:
      rule:
        r_id: 9277
        rv_id: 1263150
        rule_id: 3qUPA1
        version_id: JdTzxeg
        url: https://semgrep.dev/playground/r/JdTzxeg/javascript.express.security.audit.xss.direct-response-write.direct-response-write
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)
    - pattern-not-inside: |
        function ... ($REQ, $RES) {
            ...
            $RES.$SET('Content-Type', '$TYPE')
        }
    - pattern-not-inside: |
        $APP.$METHOD(..., function $FUNC($REQ, $RES) {
            ...
            $RES.$SET('Content-Type', '$TYPE')
        })
    - pattern-not-inside: |
        function ... ($REQ, $RES, $NEXT) {
            ...
            $RES.$SET('Content-Type', '$TYPE')
        }
    - pattern-not-inside: |
        function ... ($REQ, $RES) {
            ...
            $RES.set('$TYPE')
        }
    - pattern-not-inside: |
        $APP.$METHOD(..., function $FUNC($REQ, $RES) {
            ...
            $RES.set('$TYPE')
        })
    - pattern-not-inside: |
        function ... ($REQ, $RES, $NEXT) {
            ...
            $RES.set('$TYPE')
        }
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - pattern-not-inside: |
        ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
        {
            ...
            $RES.$SET('Content-Type', '$TYPE')
        }
    - pattern-not-inside: |
        ({ $REQ }: Request,$RES: Response) => {
            ...
            $RES.$SET('Content-Type', '$TYPE')
        }
    - pattern-not-inside: |
        ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
        {
            ...
            $RES.set('$TYPE')
        }
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: body
  pattern-sinks:
  - patterns:
    - pattern-inside: function ... (..., $RES,...) {...}
    - pattern-either:
      - pattern: $RES.write($ARG)
      - pattern: $RES.send($ARG)
    - pattern-not: $RES. ... .set('...'). ... .send($ARG)
    - pattern-not: $RES. ... .type('...'). ... .send($ARG)
    - pattern-not-inside: $RES.$METHOD({ ... })
    - focus-metavariable: $ARG
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          import * as $S from "underscore.string"
          ...
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          $S = require("underscore.string")
          ...
    - pattern-either:
      - pattern: $S.escapeHTML(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "dompurify"
          ...
      - pattern-inside: |
          import { ..., $S,... } from "dompurify"
          ...
      - pattern-inside: |
          import * as $S from "dompurify"
          ...
      - pattern-inside: |
          $S = require("dompurify")
          ...
      - pattern-inside: |
          import $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          import * as $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          $S = require("isomorphic-dompurify")
          ...
    - pattern-either:
      - patterns:
        - pattern-inside: |
            $VALUE = $S(...)
            ...
        - pattern: $VALUE.sanitize(...)
      - patterns:
        - pattern-inside: |
            $VALUE = $S.sanitize
            ...
        - pattern: $S(...)
      - pattern: $S.sanitize(...)
      - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'xss';
          ...
      - pattern-inside: |
          import * as $S from 'xss';
          ...
      - pattern-inside: |
          $S = require("xss")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'sanitize-html';
          ...
      - pattern-inside: |
          import * as $S from "sanitize-html";
          ...
      - pattern-inside: |
          $S = require("sanitize-html")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $S = new Remarkable()
          ...
    - pattern: $S.render(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'express-xss-sanitizer';
          ...
      - pattern-inside: |
          import * as $S from "express-xss-sanitizer";
          ...
      - pattern-inside: |
          const { ..., $S, ... } = require('express-xss-sanitizer');
          ...
      - pattern-inside: |
          var { ..., $S, ... } = require('express-xss-sanitizer');
          ...
      - pattern-inside: |
          let { ...,$S,... } = require('express-xss-sanitizer');
          ...
      - pattern-inside: |
          $S = require("express-xss-sanitizer")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern: $RES. ... .type('$F'). ... .send(...)
    - metavariable-regex:
        metavariable: $F
        regex: (?!.*text/html)
  - patterns:
    - pattern-inside: |
        $X = [...];
        ...
    - pattern: |
        if(<... !$X.includes($SOURCE)...>) {
            ...
            return ...
        }
        ...
    - pattern: $SOURCE
- id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  metadata:
    interfile: true
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    asvs:
      section: 'V3: Session Management Verification Requirements'
      control_id: 3.5.2 Static API keys or secret
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
      version: '4'
    category: security
    technology:
    - jose
    - jwt
    - secrets
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
    shortlink: https://sg.run/Ro1g
    semgrep.dev:
      rule:
        r_id: 9293
        rv_id: 1263182
        rule_id: JDUyRl
        version_id: d6TyxbX
        url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  patterns:
  - pattern-inside: |
      $JOSE = require("jose");
      ...
  - pattern-either:
    - pattern-inside: |
        var {JWT} = $JOSE;
        ...
    - pattern-inside: |
        var {JWK, JWT} = $JOSE;
        ...
    - pattern-inside: |
        const {JWT} = $JOSE;
        ...
    - pattern-inside: |
        const {JWK, JWT} = $JOSE;
        ...
    - pattern-inside: |
        let {JWT} = $JOSE;
        ...
    - pattern-inside: |
        let {JWK, JWT} = $JOSE;
        ...
  - pattern-either:
    - pattern: |
        JWT.verify($P, "...", ...);
    - pattern: |
        JWT.sign($P, "...", ...);
    - pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...);     \n"
    - pattern: |
        $JWT.sign($P, JWK.asKey("..."), ...);
  options:
    symbolic_propagation: true
    interfile: true
- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    asvs:
      section: 'V3: Session Management Verification Requirements'
      control_id: 3.5.2 Static API keys or secret
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
      version: '4'
    category: security
    technology:
    - jwt
    - javascript
    - secrets
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
    shortlink: https://sg.run/4xN9
    semgrep.dev:
      rule:
        r_id: 9300
        rv_id: 1263189
        rule_id: WAUon7
        version_id: gETB75D
        url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: "$X = '...' \n"
    - pattern: "$X = '$Y' \n"
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $JWT.sign($DATA,"...",...);
      - pattern-inside: |
          $JWT.verify($DATA,"...",...);
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $JWT = require("jsonwebtoken")
          ...
      - pattern-inside: |
          import $JWT from "jsonwebtoken"
          ...
      - pattern-inside: |
          import * as $JWT from "jsonwebtoken"
          ...
      - pattern-inside: |
          import {...,$JWT,...} from "jsonwebtoken"
          ...
    - pattern-either:
      - pattern-inside: |
          $JWT.sign($DATA,$VALUE,...);
      - pattern-inside: |
          $JWT.verify($DATA,$VALUE,...);
    - focus-metavariable: $VALUE
- id: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    asvs:
      section: 'V3: Session Management Verification Requirements'
      control_id: 3.5.2 Static API keys or secret
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
      version: '4'
    category: security
    technology:
    - jwt
    - nodejs
    - secrets
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret
    shortlink: https://sg.run/vz70
    semgrep.dev:
      rule:
        r_id: 9333
        rv_id: 1263225
        rule_id: QrUzq6
        version_id: X0TzyoE
        url: https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - by-side-effect: true
    patterns:
    - pattern-either:
      - pattern: |
          {..., clientSecret: "...", ...}
      - pattern: |
          {..., secretOrKey: "...", ...}
      - pattern: |
          {..., consumerSecret: "...", ...}
      - patterns:
        - pattern-inside: |
            $OBJ = {}
            ...
        - pattern-either:
          - pattern: |
              $OBJ.clientSecret = "..."
          - pattern: |
              $OBJ.secretOrKey = "..."
          - pattern: |
              $OBJ.consumerSecret = "..."
        - pattern: $OBJ
      - patterns:
        - pattern-inside: |
            $SECRET = '...'
            ...
        - pattern-either:
          - pattern: |
              {..., clientSecret: $SECRET, ...}
          - pattern: |
              {..., secretOrKey: $SECRET, ...}
          - pattern: |
              {..., consumerSecret: $SECRET, ...}
      - patterns:
        - pattern-inside: |
            $SECRET = '...'
            ...
        - pattern-either:
          - pattern-inside: |
              $VALUE = {..., clientSecret: $SECRET, ...}
              ...
          - pattern-inside: |
              $VALUE = {..., secretOrKey: $SECRET, ...}
              ...
          - pattern-inside: |
              $VALUE = {..., consumerSecret: $SECRET, ...}
              ...
        - pattern: $VALUE
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $F = require("$I").Strategy
          ...
      - pattern-inside: |
          $F = require("$I")
          ...
      - pattern-inside: |
          import { $STRAT as $F } from '$I'
          ...
      - pattern-inside: |
          import $F from '$I'
          ...
    - metavariable-regex:
        metavariable: $I
        regex: (passport-.*)
    - pattern-inside: |
        new $F($VALUE,...)
    - focus-metavariable: $VALUE
- id: python.boto3.security.hardcoded-token.hardcoded-token
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    - https://bento.dev/checks/boto3/hardcoded-access-token/
    - https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    category: security
    technology:
    - boto3
    - secrets
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token
    shortlink: https://sg.run/LwQ6
    semgrep.dev:
      rule:
        r_id: 9439
        rv_id: 1263347
        rule_id: 5rUOwK
        version_id: gETB78n
        url: https://semgrep.dev/playground/r/gETB78n/python.boto3.security.hardcoded-token.hardcoded-token
        origin: community
  languages:
  - python
  severity: WARNING
  mode: taint
  pattern-sources:
  - pattern: |
      "..."
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: $W(...,$TOKEN="$VALUE",...)
      - pattern: $BOTO. ... .$W(...,$TOKEN="$VALUE",...)
    - metavariable-regex:
        metavariable: $TOKEN
        regex: (aws_session_token|aws_access_key_id|aws_secret_access_key)
    - metavariable-pattern:
        language: generic
        metavariable: $VALUE
        patterns:
        - pattern-either:
          - pattern-regex: ^AKI
          - pattern-regex: ^[A-Za-z0-9/+=]+$
    - metavariable-analysis:
        metavariable: $VALUE
        analyzer: entropy
- id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
    shortlink: https://sg.run/9oyr
    semgrep.dev:
      rule:
        r_id: 9467
        rv_id: 1409400
        rule_id: OrU3e6
        version_id: GxTlb9e
        url: https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
        origin: community
  message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`,
    `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code
    execution vulnerabilities.
  languages:
  - python
  severity: ERROR
  mode: taint
  pattern-sources:
  - pattern-either:
    - patterns:
      - pattern-inside: |
          def $INSIDE(..., $PARAM, ...):
            ...
      - pattern-either:
        - pattern: request.$REQFUNC(...)
        - pattern: request.$REQFUNC.get(...)
        - pattern: request.$REQFUNC[...]
  pattern-sinks:
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern: |
            pickle.$PICKLEFUNC(...)
        - pattern: |
            _pickle.$PICKLEFUNC(...)
        - pattern: |
            cPickle.$PICKLEFUNC(...)
        - pattern: |
            shelve.$PICKLEFUNC(...)
      - metavariable-regex:
          metavariable: $PICKLEFUNC
          regex: dumps|dump|load|loads
    - patterns:
      - pattern: dill.$DILLFUNC(...)
      - metavariable-regex:
          metavariable: $DILLFUNC
          regex: dump|dump_session|dumps|load|load_session|loads
    - patterns:
      - pattern: yaml.$YAMLFUNC(...)
      - pattern-not: yaml.$YAMLFUNC(..., Dumper=SafeDumper, ...)
      - pattern-not: yaml.$YAMLFUNC(..., Dumper=yaml.SafeDumper, ...)
      - pattern-not: yaml.$YAMLFUNC(..., Loader=SafeLoader, ...)
      - pattern-not: yaml.$YAMLFUNC(..., Loader=yaml.SafeLoader, ...)
      - metavariable-regex:
          metavariable: $YAMLFUNC
          regex: dump|dump_all|load|load_all
- id: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse
  message: Found user-controlled request data passed into HttpResponse. This could
    be vulnerable to XSS, leading to attackers gaining access to user cookies and
    protected information. Ensure that the request data is properly escaped or sanitzed.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse
    shortlink: https://sg.run/BkvA
    semgrep.dev:
      rule:
        r_id: 9495
        rv_id: 1263398
        rule_id: JDUydR
        version_id: GxTke5K
        url: https://semgrep.dev/playground/r/GxTke5K/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: django.http.HttpResponse(..., $S.format(..., request.$W.get(...), ...),
        ...)
    - pattern: django.http.HttpResponse(..., $S % request.$W.get(...), ...)
    - pattern: django.http.HttpResponse(..., f"...{request.$W.get(...)}...", ...)
    - pattern: django.http.HttpResponse(..., request.$W.get(...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.http.HttpResponse(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.http.HttpResponse(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.http.HttpResponse(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.http.HttpResponse(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: $A = django.http.HttpResponse(..., request.$W.get(...), ...)
    - pattern: return django.http.HttpResponse(..., request.$W.get(...), ...)
    - pattern: django.http.HttpResponse(..., $S.format(..., request.$W(...), ...),
        ...)
    - pattern: django.http.HttpResponse(..., $S % request.$W(...), ...)
    - pattern: django.http.HttpResponse(..., f"...{request.$W(...)}...", ...)
    - pattern: django.http.HttpResponse(..., request.$W(...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.http.HttpResponse(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.http.HttpResponse(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.http.HttpResponse(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.http.HttpResponse(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: $A = django.http.HttpResponse(..., request.$W(...), ...)
    - pattern: return django.http.HttpResponse(..., request.$W(...), ...)
    - pattern: django.http.HttpResponse(..., $S.format(..., request.$W[...], ...),
        ...)
    - pattern: django.http.HttpResponse(..., $S % request.$W[...], ...)
    - pattern: django.http.HttpResponse(..., f"...{request.$W[...]}...", ...)
    - pattern: django.http.HttpResponse(..., request.$W[...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.http.HttpResponse(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.http.HttpResponse(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.http.HttpResponse(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.http.HttpResponse(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: $A = django.http.HttpResponse(..., request.$W[...], ...)
    - pattern: return django.http.HttpResponse(..., request.$W[...], ...)
    - pattern: django.http.HttpResponse(..., $S.format(..., request.$W, ...), ...)
    - pattern: django.http.HttpResponse(..., $S % request.$W, ...)
    - pattern: django.http.HttpResponse(..., f"...{request.$W}...", ...)
    - pattern: django.http.HttpResponse(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.http.HttpResponse(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.http.HttpResponse(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.http.HttpResponse(..., f"...{$DATA}...", ...)
    - pattern: $A = django.http.HttpResponse(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        $A = django.http.HttpResponse(..., $INTERM, ...)
    - pattern: return django.http.HttpResponse(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.http.HttpResponse(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.http.HttpResponse(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        django.http.HttpResponse(..., $INTERM, ...)
- id: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest
  message: Found user-controlled request data passed into a HttpResponseBadRequest.
    This could be vulnerable to XSS, leading to attackers gaining access to user cookies
    and protected information. Ensure that the request data is properly escaped or
    sanitzed.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest
    shortlink: https://sg.run/DoZP
    semgrep.dev:
      rule:
        r_id: 9496
        rv_id: 1263399
        rule_id: 5rUOX1
        version_id: RGT0LY6
        url: https://semgrep.dev/playground/r/RGT0LY6/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W.get(...),
        ...), ...)
    - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W.get(...), ...)
    - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W.get(...)}...",
        ...)
    - pattern: django.http.HttpResponseBadRequest(..., request.$W.get(...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.http.HttpResponseBadRequest(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.http.HttpResponseBadRequest(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.http.HttpResponseBadRequest(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W.get(...), ...)
    - pattern: return django.http.HttpResponseBadRequest(..., request.$W.get(...),
        ...)
    - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W(...),
        ...), ...)
    - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W(...), ...)
    - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W(...)}...",
        ...)
    - pattern: django.http.HttpResponseBadRequest(..., request.$W(...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.http.HttpResponseBadRequest(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.http.HttpResponseBadRequest(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.http.HttpResponseBadRequest(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W(...), ...)
    - pattern: return django.http.HttpResponseBadRequest(..., request.$W(...), ...)
    - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W[...],
        ...), ...)
    - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W[...], ...)
    - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W[...]}...",
        ...)
    - pattern: django.http.HttpResponseBadRequest(..., request.$W[...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.http.HttpResponseBadRequest(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.http.HttpResponseBadRequest(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.http.HttpResponseBadRequest(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W[...], ...)
    - pattern: return django.http.HttpResponseBadRequest(..., request.$W[...], ...)
    - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W,
        ...), ...)
    - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W, ...)
    - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W}...", ...)
    - pattern: django.http.HttpResponseBadRequest(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.http.HttpResponseBadRequest(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.http.HttpResponseBadRequest(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.http.HttpResponseBadRequest(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        django.http.HttpResponseBadRequest(..., $INTERM, ...)
    - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W, ...)
    - pattern: return django.http.HttpResponseBadRequest(..., request.$W, ...)
- id: python.django.security.injection.request-data-fileresponse.request-data-fileresponse
  message: Found user-controlled request data being passed into a file open, which
    is them passed as an argument into the FileResponse. This is dangerous because
    an attacker could specify an arbitrary file to read, which could result in leaking
    important data. Be sure to validate or sanitize the user-inputted filename in
    the request data before using it in FileResponse.
  metadata:
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse
    shortlink: https://sg.run/W862
    semgrep.dev:
      rule:
        r_id: 9497
        rv_id: 1263400
        rule_id: GdU7QR
        version_id: A8Tgd1K
        url: https://semgrep.dev/playground/r/A8Tgd1K/python.django.security.injection.request-data-fileresponse.request-data-fileresponse
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: django.http.FileResponse(..., request.$W.get(...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.http.FileResponse(..., open($DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = open($DATA, ...)
        ...
        django.http.FileResponse(..., $INTERM, ...)
    - pattern: $A = django.http.FileResponse(..., request.$W.get(...), ...)
    - pattern: return django.http.FileResponse(..., request.$W.get(...), ...)
    - pattern: django.http.FileResponse(..., request.$W(...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.http.FileResponse(..., open($DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = open($DATA, ...)
        ...
        django.http.FileResponse(..., $INTERM, ...)
    - pattern: $A = django.http.FileResponse(..., request.$W(...), ...)
    - pattern: return django.http.FileResponse(..., request.$W(...), ...)
    - pattern: django.http.FileResponse(..., request.$W[...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.http.FileResponse(..., open($DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = open($DATA, ...)
        ...
        django.http.FileResponse(..., $INTERM, ...)
    - pattern: $A = django.http.FileResponse(..., request.$W[...], ...)
    - pattern: return django.http.FileResponse(..., request.$W[...], ...)
    - pattern: django.http.FileResponse(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.http.FileResponse(..., open($DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = open($DATA, ...)
        ...
        django.http.FileResponse(..., $INTERM, ...)
    - pattern: $A = django.http.FileResponse(..., request.$W, ...)
    - pattern: return django.http.FileResponse(..., request.$W, ...)
- id: python.django.security.injection.command.command-injection-os-system.command-injection-os-system
  message: Request data detected in os.system. This could be vulnerable to a command
    injection and should be avoided. If this must be done, use the 'subprocess' module
    instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection
    for more information.
  metadata:
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/www-community/attacks/Command_Injection
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system
    shortlink: https://sg.run/Gen2
    semgrep.dev:
      rule:
        r_id: 9504
        rv_id: 1263387
        rule_id: KxUbp2
        version_id: ExTExPo
        url: https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system
        origin: community
  languages:
  - python
  severity: ERROR
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: os.system(..., request.$W.get(...), ...)
    - pattern: os.system(..., $S.format(..., request.$W.get(...), ...), ...)
    - pattern: os.system(..., $S % request.$W.get(...), ...)
    - pattern: os.system(..., f"...{request.$W.get(...)}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        os.system(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        os.system(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        os.system(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        os.system(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        os.system(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: $A = os.system(..., request.$W.get(...), ...)
    - pattern: $A = os.system(..., $S.format(..., request.$W.get(...), ...), ...)
    - pattern: $A = os.system(..., $S % request.$W.get(...), ...)
    - pattern: $A = os.system(..., f"...{request.$W.get(...)}...", ...)
    - pattern: return os.system(..., request.$W.get(...), ...)
    - pattern: return os.system(..., $S.format(..., request.$W.get(...), ...), ...)
    - pattern: return os.system(..., $S % request.$W.get(...), ...)
    - pattern: return os.system(..., f"...{request.$W.get(...)}...", ...)
    - pattern: os.system(..., request.$W(...), ...)
    - pattern: os.system(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: os.system(..., $S % request.$W(...), ...)
    - pattern: os.system(..., f"...{request.$W(...)}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        os.system(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        os.system(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        os.system(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        os.system(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        os.system(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: $A = os.system(..., request.$W(...), ...)
    - pattern: $A = os.system(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: $A = os.system(..., $S % request.$W(...), ...)
    - pattern: $A = os.system(..., f"...{request.$W(...)}...", ...)
    - pattern: return os.system(..., request.$W(...), ...)
    - pattern: return os.system(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: return os.system(..., $S % request.$W(...), ...)
    - pattern: return os.system(..., f"...{request.$W(...)}...", ...)
    - pattern: os.system(..., request.$W[...], ...)
    - pattern: os.system(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: os.system(..., $S % request.$W[...], ...)
    - pattern: os.system(..., f"...{request.$W[...]}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        os.system(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        os.system(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        os.system(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        os.system(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        os.system(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: $A = os.system(..., request.$W[...], ...)
    - pattern: $A = os.system(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: $A = os.system(..., $S % request.$W[...], ...)
    - pattern: $A = os.system(..., f"...{request.$W[...]}...", ...)
    - pattern: return os.system(..., request.$W[...], ...)
    - pattern: return os.system(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: return os.system(..., $S % request.$W[...], ...)
    - pattern: return os.system(..., f"...{request.$W[...]}...", ...)
    - pattern: os.system(..., request.$W, ...)
    - pattern: os.system(..., $S.format(..., request.$W, ...), ...)
    - pattern: os.system(..., $S % request.$W, ...)
    - pattern: os.system(..., f"...{request.$W}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        os.system(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        os.system(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        os.system(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        os.system(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        os.system(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: $A = os.system(..., request.$W, ...)
    - pattern: $A = os.system(..., $S.format(..., request.$W, ...), ...)
    - pattern: $A = os.system(..., $S % request.$W, ...)
    - pattern: $A = os.system(..., f"...{request.$W}...", ...)
    - pattern: return os.system(..., request.$W, ...)
    - pattern: return os.system(..., $S.format(..., request.$W, ...), ...)
    - pattern: return os.system(..., $S % request.$W, ...)
    - pattern: return os.system(..., f"...{request.$W}...", ...)
- id: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open
  message: Found request data in a call to 'open'. Ensure the request data is validated
    or sanitized, otherwise it could result in path traversal attacks and therefore
    sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath
    or the pathlib library.
  metadata:
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://owasp.org/www-community/attacks/Path_Traversal
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open
    shortlink: https://sg.run/W8qg
    semgrep.dev:
      rule:
        r_id: 9509
        rv_id: 1263396
        rule_id: oqUe7z
        version_id: JdTzxAw
        url: https://semgrep.dev/playground/r/JdTzxAw/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: open(..., request.$W.get(...), ...)
    - pattern: open(..., $S.format(..., request.$W.get(...), ...), ...)
    - pattern: open(..., $S % request.$W.get(...), ...)
    - pattern: open(..., f"...{request.$W.get(...)}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        open(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        open(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        open(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        open(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        open(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: $A = open(..., request.$W.get(...), ...)
    - pattern: $A = open(..., $S.format(..., request.$W.get(...), ...), ...)
    - pattern: $A = open(..., $S % request.$W.get(...), ...)
    - pattern: $A = open(..., f"...{request.$W.get(...)}...", ...)
    - pattern: return open(..., request.$W.get(...), ...)
    - pattern: return open(..., $S.format(..., request.$W.get(...), ...), ...)
    - pattern: return open(..., $S % request.$W.get(...), ...)
    - pattern: return open(..., f"...{request.$W.get(...)}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        with open(..., $DATA, ...) as $FD:
          ...
    - pattern: open(..., request.$W(...), ...)
    - pattern: open(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: open(..., $S % request.$W(...), ...)
    - pattern: open(..., f"...{request.$W(...)}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        open(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W(...)
        ...
        open(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W(...)
        ...
        open(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W(...)
        ...
        open(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W(...)
        ...
        open(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: $A = open(..., request.$W(...), ...)
    - pattern: $A = open(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: $A = open(..., $S % request.$W(...), ...)
    - pattern: $A = open(..., f"...{request.$W(...)}...", ...)
    - pattern: return open(..., request.$W(...), ...)
    - pattern: return open(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: return open(..., $S % request.$W(...), ...)
    - pattern: return open(..., f"...{request.$W(...)}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        with open(..., $DATA, ...) as $FD:
          ...
    - pattern: open(..., request.$W[...], ...)
    - pattern: open(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: open(..., $S % request.$W[...], ...)
    - pattern: open(..., f"...{request.$W[...]}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        open(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W[...]
        ...
        open(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W[...]
        ...
        open(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W[...]
        ...
        open(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W[...]
        ...
        open(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: $A = open(..., request.$W[...], ...)
    - pattern: $A = open(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: $A = open(..., $S % request.$W[...], ...)
    - pattern: $A = open(..., f"...{request.$W[...]}...", ...)
    - pattern: return open(..., request.$W[...], ...)
    - pattern: return open(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: return open(..., $S % request.$W[...], ...)
    - pattern: return open(..., f"...{request.$W[...]}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        with open(..., $DATA, ...) as $FD:
          ...
    - pattern: open(..., request.$W, ...)
    - pattern: open(..., $S.format(..., request.$W, ...), ...)
    - pattern: open(..., $S % request.$W, ...)
    - pattern: open(..., f"...{request.$W}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        open(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W
        ...
        open(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W
        ...
        open(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W
        ...
        open(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: |
        $DATA = request.$W
        ...
        open(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        open(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        with open(..., $INTERM, ...) as $FD:
          ...
    - pattern: $A = open(..., request.$W, ...)
    - pattern: $A = open(..., $S.format(..., request.$W, ...), ...)
    - pattern: $A = open(..., $S % request.$W, ...)
    - pattern: $A = open(..., f"...{request.$W}...", ...)
    - pattern: return open(..., request.$W, ...)
    - pattern: return open(..., $S.format(..., request.$W, ...), ...)
    - pattern: return open(..., $S % request.$W, ...)
    - pattern: return open(..., f"...{request.$W}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        with open(..., $DATA, ...) as $FD:
          ...
- id: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where
  message: User-controlled data from a request is passed to 'extra()'. This could
    lead to a SQL injection and therefore protected information could be leaked. Instead,
    use parameterized queries or escape the user-controlled data by using `params`
    and not using quote placeholders in the SQL string.
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where
    shortlink: https://sg.run/0Ql5
    semgrep.dev:
      rule:
        r_id: 9510
        rv_id: 1263402
        rule_id: zdUkx1
        version_id: DkTRb4l
        url: https://semgrep.dev/playground/r/DkTRb4l/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W.get(...),
        ...), ...], ...)
    - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W.get(...), ...],
        ...)
    - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W.get(...)}...",
        ...], ...)
    - pattern: $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $MODEL.objects.extra(..., where=[..., $DATA, ...], ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...],
        ...)
    - pattern: return $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...],
        ...)
    - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W(...),
        ...), ...], ...)
    - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W(...), ...], ...)
    - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W(...)}...", ...],
        ...)
    - pattern: $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $MODEL.objects.extra(..., where=[..., $DATA, ...], ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...)
    - pattern: return $MODEL.objects.extra(..., where=[..., request.$W(...), ...],
        ...)
    - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W[...],
        ...), ...], ...)
    - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W[...], ...], ...)
    - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W[...]}...", ...],
        ...)
    - pattern: $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $MODEL.objects.extra(..., where=[..., $DATA, ...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...)
    - pattern: return $MODEL.objects.extra(..., where=[..., request.$W[...], ...],
        ...)
    - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W, ...),
        ...], ...)
    - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W, ...], ...)
    - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W}...", ...],
        ...)
    - pattern: $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)
    - pattern: |
        $DATA = request.$W
        ...
        $MODEL.objects.extra(..., where=[..., $DATA, ...], ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W
        ...
        $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W
        ...
        $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W
        ...
        $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W
        ...
        $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)
    - pattern: return $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)
    - pattern: |
        $DATA = request.$W
        ...
        $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- id: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql
  message: User-controlled data from request is passed to 'RawSQL()'. This could lead
    to a SQL injection and therefore protected information could be leaked. Instead,
    use parameterized queries or escape the user-controlled data by using `params`
    and not using quote placeholders in the SQL string.
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql
    shortlink: https://sg.run/Kl4X
    semgrep.dev:
      rule:
        r_id: 9511
        rv_id: 1263403
        rule_id: pKUOBp
        version_id: WrTqK2L
        url: https://semgrep.dev/playground/r/WrTqK2L/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W.get(...),
        ...), ...)
    - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W.get(...),
        ...)
    - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W.get(...)}...",
        ...)
    - pattern: django.db.models.expressions.RawSQL(..., request.$W.get(...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.db.models.expressions.RawSQL(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.db.models.expressions.RawSQL(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.db.models.expressions.RawSQL(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W.get(...),
        ...)
    - pattern: return django.db.models.expressions.RawSQL(..., request.$W.get(...),
        ...)
    - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W(...),
        ...), ...)
    - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W(...), ...)
    - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W(...)}...",
        ...)
    - pattern: django.db.models.expressions.RawSQL(..., request.$W(...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.db.models.expressions.RawSQL(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.db.models.expressions.RawSQL(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.db.models.expressions.RawSQL(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W(...), ...)
    - pattern: return django.db.models.expressions.RawSQL(..., request.$W(...), ...)
    - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W[...],
        ...), ...)
    - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W[...], ...)
    - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W[...]}...",
        ...)
    - pattern: django.db.models.expressions.RawSQL(..., request.$W[...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.db.models.expressions.RawSQL(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.db.models.expressions.RawSQL(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.db.models.expressions.RawSQL(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W[...], ...)
    - pattern: return django.db.models.expressions.RawSQL(..., request.$W[...], ...)
    - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W,
        ...), ...)
    - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W, ...)
    - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W}...", ...)
    - pattern: django.db.models.expressions.RawSQL(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.db.models.expressions.RawSQL(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.db.models.expressions.RawSQL(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.db.models.expressions.RawSQL(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        django.db.models.expressions.RawSQL(..., $INTERM, ...)
    - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W, ...)
    - pattern: return django.db.models.expressions.RawSQL(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        django.db.models.expressions.RawSQL($INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        django.db.models.expressions.RawSQL($INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        django.db.models.expressions.RawSQL($INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        django.db.models.expressions.RawSQL($INTERM, ...)
- id: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute
  message: User-controlled data from a request is passed to 'execute()'. This could
    lead to a SQL injection and therefore protected information could be leaked. Instead,
    use django's QuerySets, which are built with query parameterization and therefore
    not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute
    shortlink: https://sg.run/qx7y
    semgrep.dev:
      rule:
        r_id: 9512
        rv_id: 1263404
        rule_id: 2ZUbDL
        version_id: 0bTKzRj
        url: https://semgrep.dev/playground/r/0bTKzRj/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: $CURSOR.execute(..., $S.format(..., request.$W.get(...), ...), ...)
    - pattern: $CURSOR.execute(..., $S % request.$W.get(...), ...)
    - pattern: $CURSOR.execute(..., f"...{request.$W.get(...)}...", ...)
    - pattern: $CURSOR.execute(..., request.$W.get(...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $CURSOR.execute(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $CURSOR.execute(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $CURSOR.execute(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $CURSOR.execute(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: $A = $CURSOR.execute(..., request.$W.get(...), ...)
    - pattern: return $CURSOR.execute(..., request.$W.get(...), ...)
    - pattern: $CURSOR.execute(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: $CURSOR.execute(..., $S % request.$W(...), ...)
    - pattern: $CURSOR.execute(..., f"...{request.$W(...)}...", ...)
    - pattern: $CURSOR.execute(..., request.$W(...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $CURSOR.execute(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $CURSOR.execute(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $CURSOR.execute(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $CURSOR.execute(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: $A = $CURSOR.execute(..., request.$W(...), ...)
    - pattern: return $CURSOR.execute(..., request.$W(...), ...)
    - pattern: $CURSOR.execute(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: $CURSOR.execute(..., $S % request.$W[...], ...)
    - pattern: $CURSOR.execute(..., f"...{request.$W[...]}...", ...)
    - pattern: $CURSOR.execute(..., request.$W[...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $CURSOR.execute(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $CURSOR.execute(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $CURSOR.execute(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $CURSOR.execute(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: $A = $CURSOR.execute(..., request.$W[...], ...)
    - pattern: return $CURSOR.execute(..., request.$W[...], ...)
    - pattern: $CURSOR.execute(..., $S.format(..., request.$W, ...), ...)
    - pattern: $CURSOR.execute(..., $S % request.$W, ...)
    - pattern: $CURSOR.execute(..., f"...{request.$W}...", ...)
    - pattern: $CURSOR.execute(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $CURSOR.execute(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $CURSOR.execute(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $CURSOR.execute(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $CURSOR.execute(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        $CURSOR.execute(..., $INTERM, ...)
    - pattern: $A = $CURSOR.execute(..., request.$W, ...)
    - pattern: return $CURSOR.execute(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $CURSOR.execute($STR % (..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $CURSOR.execute($STR % (..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $CURSOR.execute($STR % (..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $CURSOR.execute($STR % (..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        $CURSOR.execute($INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        $CURSOR.execute($INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        $CURSOR.execute($INTERM, ...)
    - pattern: |-
        $DATA = request.$W
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        $CURSOR.execute($INTERM, ...)
- id: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw
  message: Data that is possible user-controlled from a python request is passed to
    `raw()`. This could lead to SQL injection and attackers gaining access to protected
    information. Instead, use django's QuerySets, which are built with query parameterization
    and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw
    shortlink: https://sg.run/l2v9
    semgrep.dev:
      rule:
        r_id: 9513
        rv_id: 1263405
        rule_id: X5U8v5
        version_id: K3TKkBW
        url: https://semgrep.dev/playground/r/K3TKkBW/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W.get(...), ...), ...)
    - pattern: $MODEL.objects.raw(..., $S % request.$W.get(...), ...)
    - pattern: $MODEL.objects.raw(..., f"...{request.$W.get(...)}...", ...)
    - pattern: $MODEL.objects.raw(..., request.$W.get(...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $MODEL.objects.raw(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $MODEL.objects.raw(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $MODEL.objects.raw(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $MODEL.objects.raw(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: $A = $MODEL.objects.raw(..., request.$W.get(...), ...)
    - pattern: return $MODEL.objects.raw(..., request.$W.get(...), ...)
    - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: $MODEL.objects.raw(..., $S % request.$W(...), ...)
    - pattern: $MODEL.objects.raw(..., f"...{request.$W(...)}...", ...)
    - pattern: $MODEL.objects.raw(..., request.$W(...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $MODEL.objects.raw(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $MODEL.objects.raw(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $MODEL.objects.raw(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $MODEL.objects.raw(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: $A = $MODEL.objects.raw(..., request.$W(...), ...)
    - pattern: return $MODEL.objects.raw(..., request.$W(...), ...)
    - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: $MODEL.objects.raw(..., $S % request.$W[...], ...)
    - pattern: $MODEL.objects.raw(..., f"...{request.$W[...]}...", ...)
    - pattern: $MODEL.objects.raw(..., request.$W[...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $MODEL.objects.raw(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $MODEL.objects.raw(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $MODEL.objects.raw(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $MODEL.objects.raw(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: $A = $MODEL.objects.raw(..., request.$W[...], ...)
    - pattern: return $MODEL.objects.raw(..., request.$W[...], ...)
    - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W, ...), ...)
    - pattern: $MODEL.objects.raw(..., $S % request.$W, ...)
    - pattern: $MODEL.objects.raw(..., f"...{request.$W}...", ...)
    - pattern: $MODEL.objects.raw(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $MODEL.objects.raw(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $MODEL.objects.raw(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $MODEL.objects.raw(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $MODEL.objects.raw(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        $MODEL.objects.raw(..., $INTERM, ...)
    - pattern: $A = $MODEL.objects.raw(..., request.$W, ...)
    - pattern: return $MODEL.objects.raw(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $MODEL.objects.raw($STR % (..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $MODEL.objects.raw($STR % (..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $MODEL.objects.raw($STR % (..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $MODEL.objects.raw($STR % (..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        $MODEL.objects.raw($INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        $MODEL.objects.raw($INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        $MODEL.objects.raw($INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % (..., $DATA, ...)
        ...
        $MODEL.objects.raw($INTERM, ...)
- id: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests
  message: Data from request object is passed to a new server-side request. This could
    lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes
    and hosts are validated against an allowlist, do not forward the response to the
    user, and ensure proper authentication and transport-layer security in the proxied
    request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
    to learn more about SSRF vulnerabilities.
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    references:
    - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests
    shortlink: https://sg.run/YvY4
    semgrep.dev:
      rule:
        r_id: 9514
        rv_id: 1263406
        rule_id: j2UvEw
        version_id: qkTR7zn
        url: https://semgrep.dev/playground/r/qkTR7zn/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests
        origin: community
  languages:
  - python
  severity: ERROR
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: requests.$METHOD(..., $S.format(..., request.$W.get(...), ...), ...)
    - pattern: requests.$METHOD(..., $S % request.$W.get(...), ...)
    - pattern: requests.$METHOD(..., f"...{request.$W.get(...)}...", ...)
    - pattern: requests.$METHOD(..., request.$W.get(...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        requests.$METHOD(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        requests.$METHOD(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        requests.$METHOD(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        requests.$METHOD(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        requests.$METHOD(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: $A = requests.$METHOD(..., request.$W.get(...), ...)
    - pattern: return requests.$METHOD(..., request.$W.get(...), ...)
    - pattern: requests.$METHOD(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: requests.$METHOD(..., $S % request.$W(...), ...)
    - pattern: requests.$METHOD(..., f"...{request.$W(...)}...", ...)
    - pattern: requests.$METHOD(..., request.$W(...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        requests.$METHOD(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        requests.$METHOD(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        requests.$METHOD(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        requests.$METHOD(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        requests.$METHOD(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: $A = requests.$METHOD(..., request.$W(...), ...)
    - pattern: return requests.$METHOD(..., request.$W(...), ...)
    - pattern: requests.$METHOD(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: requests.$METHOD(..., $S % request.$W[...], ...)
    - pattern: requests.$METHOD(..., f"...{request.$W[...]}...", ...)
    - pattern: requests.$METHOD(..., request.$W[...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        requests.$METHOD(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        requests.$METHOD(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        requests.$METHOD(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        requests.$METHOD(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        requests.$METHOD(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: $A = requests.$METHOD(..., request.$W[...], ...)
    - pattern: return requests.$METHOD(..., request.$W[...], ...)
    - pattern: requests.$METHOD(..., $S.format(..., request.$W, ...), ...)
    - pattern: requests.$METHOD(..., $S % request.$W, ...)
    - pattern: requests.$METHOD(..., f"...{request.$W}...", ...)
    - pattern: requests.$METHOD(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        requests.$METHOD(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        requests.$METHOD(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        requests.$METHOD(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        requests.$METHOD(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        requests.$METHOD(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        requests.$METHOD(..., $INTERM, ...)
    - pattern: $A = requests.$METHOD(..., request.$W, ...)
    - pattern: return requests.$METHOD(..., request.$W, ...)
- id: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib
  message: Data from request object is passed to a new server-side request. This could
    lead to a server-side request forgery (SSRF), which could result in attackers
    gaining access to private organization data. To mitigate, ensure that schemes
    and hosts are validated against an allowlist, do not forward the response to the
    user, and ensure proper authentication and transport-layer security in the proxied
    request.
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    references:
    - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib
    shortlink: https://sg.run/6n2B
    semgrep.dev:
      rule:
        r_id: 9515
        rv_id: 1263407
        rule_id: 10UKDo
        version_id: l4TJRwD
        url: https://semgrep.dev/playground/r/l4TJRwD/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib
        origin: community
  languages:
  - python
  severity: ERROR
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: urllib.request.urlopen(..., $S.format(..., request.$W.get(...), ...),
        ...)
    - pattern: urllib.request.urlopen(..., $S % request.$W.get(...), ...)
    - pattern: urllib.request.urlopen(..., f"...{request.$W.get(...)}...", ...)
    - pattern: urllib.request.urlopen(..., request.$W.get(...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        urllib.request.urlopen(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        urllib.request.urlopen(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        urllib.request.urlopen(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        urllib.request.urlopen(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: $A = urllib.request.urlopen(..., request.$W.get(...), ...)
    - pattern: return urllib.request.urlopen(..., request.$W.get(...), ...)
    - pattern: urllib.request.urlopen(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: urllib.request.urlopen(..., $S % request.$W(...), ...)
    - pattern: urllib.request.urlopen(..., f"...{request.$W(...)}...", ...)
    - pattern: urllib.request.urlopen(..., request.$W(...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        urllib.request.urlopen(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        urllib.request.urlopen(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        urllib.request.urlopen(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        urllib.request.urlopen(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: $A = urllib.request.urlopen(..., request.$W(...), ...)
    - pattern: return urllib.request.urlopen(..., request.$W(...), ...)
    - pattern: urllib.request.urlopen(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: urllib.request.urlopen(..., $S % request.$W[...], ...)
    - pattern: urllib.request.urlopen(..., f"...{request.$W[...]}...", ...)
    - pattern: urllib.request.urlopen(..., request.$W[...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        urllib.request.urlopen(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        urllib.request.urlopen(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        urllib.request.urlopen(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        urllib.request.urlopen(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: $A = urllib.request.urlopen(..., request.$W[...], ...)
    - pattern: return urllib.request.urlopen(..., request.$W[...], ...)
    - pattern: urllib.request.urlopen(..., $S.format(..., request.$W, ...), ...)
    - pattern: urllib.request.urlopen(..., $S % request.$W, ...)
    - pattern: urllib.request.urlopen(..., f"...{request.$W}...", ...)
    - pattern: urllib.request.urlopen(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        urllib.request.urlopen(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        urllib.request.urlopen(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        urllib.request.urlopen(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        urllib.request.urlopen(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        urllib.request.urlopen(..., $INTERM, ...)
    - pattern: $A = urllib.request.urlopen(..., request.$W, ...)
    - pattern: return urllib.request.urlopen(..., request.$W, ...)
- id: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string
  message: Detected Flask route directly returning a formatted string. This is subject
    to cross-site scripting if user input can reach the string. Consider using the
    template engine instead and rendering pages with 'render_template()'.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - flask
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string
    shortlink: https://sg.run/Zv6o
    semgrep.dev:
      rule:
        r_id: 9535
        rv_id: 1263416
        rule_id: QrUz49
        version_id: WrTqKAz
        url: https://semgrep.dev/playground/r/WrTqKAz/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string
        origin: community
  languages:
  - python
  severity: WARNING
  mode: taint
  pattern-sources:
  - pattern-either:
    - patterns:
      - pattern-inside: |
          @$APP.route(...)
          def $FUNC(..., $PARAM, ...):
            ...
      - pattern: $PARAM
    - pattern: |
        request.$FUNC.get(...)
    - pattern: |
        request.$FUNC(...)
    - pattern: request.$FUNC[...]
  pattern-sinks:
  - patterns:
    - pattern-not-inside: return "..."
    - pattern-either:
      - pattern: return "...".format(...)
      - pattern: return "..." % ...
      - pattern: return "..." + ...
      - pattern: return ... + "..."
      - pattern: return f"...{...}..."
      - patterns:
        - pattern: return $X
        - pattern-either:
          - pattern-inside: |
              $X = "...".format(...)
              ...
          - pattern-inside: |
              $X = "..." % ...
              ...
          - pattern-inside: |
              $X = "..." + ...
              ...
          - pattern-inside: |
              $X = ... + "..."
              ...
          - pattern-inside: |
              $X = f"...{...}..."
              ...
        - pattern-not-inside: |
            $X = "..."
            ...
- id: python.flask.security.injection.os-system-injection.os-system-injection
  languages:
  - python
  severity: ERROR
  message: User data detected in os.system. This could be vulnerable to a command
    injection and should be avoided. If this must be done, use the 'subprocess' module
    instead and pass the arguments as a list.
  metadata:
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/www-community/attacks/Command_Injection
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection
    shortlink: https://sg.run/4xzz
    semgrep.dev:
      rule:
        r_id: 9544
        rv_id: 1263429
        rule_id: BYUN99
        version_id: 1QTypw7
        url: https://semgrep.dev/playground/r/1QTypw7/python.flask.security.injection.os-system-injection.os-system-injection
        origin: community
  pattern-either:
  - patterns:
    - pattern: os.system(...)
    - pattern-either:
      - pattern-inside: |
          @$APP.route($ROUTE, ...)
          def $FUNC(..., $ROUTEVAR, ...):
            ...
            os.system(..., <... $ROUTEVAR ...>, ...)
      - pattern-inside: |
          @$APP.route($ROUTE, ...)
          def $FUNC(..., $ROUTEVAR, ...):
            ...
            $INTERM = <... $ROUTEVAR ...>
            ...
            os.system(..., <... $INTERM ...>, ...)
  - pattern: os.system(..., <... flask.request.$W.get(...) ...>, ...)
  - pattern: os.system(..., <... flask.request.$W[...] ...>, ...)
  - pattern: os.system(..., <... flask.request.$W(...) ...>, ...)
  - pattern: os.system(..., <... flask.request.$W ...>, ...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W.get(...) ...>
        ...
        os.system(<... $INTERM ...>)
    - pattern: os.system(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W[...] ...>
        ...
        os.system(<... $INTERM ...>)
    - pattern: os.system(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W(...) ...>
        ...
        os.system(<... $INTERM ...>)
    - pattern: os.system(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W ...>
        ...
        os.system(<... $INTERM ...>)
    - pattern: os.system(...)
- id: python.flask.security.injection.path-traversal-open.path-traversal-open
  languages:
  - python
  severity: ERROR
  message: Found request data in a call to 'open'. Ensure the request data is validated
    or sanitized, otherwise it could result in path traversal attacks.
  metadata:
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://owasp.org/www-community/attacks/Path_Traversal
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open
    shortlink: https://sg.run/PJRW
    semgrep.dev:
      rule:
        r_id: 9545
        rv_id: 1263430
        rule_id: DbUpOQ
        version_id: 9lT4b94
        url: https://semgrep.dev/playground/r/9lT4b94/python.flask.security.injection.path-traversal-open.path-traversal-open
        origin: community
  pattern-either:
  - patterns:
    - pattern: open(...)
    - pattern-either:
      - pattern-inside: |
          @$APP.route($ROUTE, ...)
          def $FUNC(..., $ROUTEVAR, ...):
            ...
            open(..., <... $ROUTEVAR ...>, ...)
      - pattern-inside: |
          @$APP.route($ROUTE, ...)
          def $FUNC(..., $ROUTEVAR, ...):
            ...
            with open(..., <... $ROUTEVAR ...>, ...) as $FD:
              ...
      - pattern-inside: |
          @$APP.route($ROUTE, ...)
          def $FUNC(..., $ROUTEVAR, ...):
            ...
            $INTERM = <... $ROUTEVAR ...>
            ...
            open(..., <... $INTERM ...>, ...)
  - pattern: open(..., <... flask.request.$W.get(...) ...>, ...)
  - pattern: open(..., <... flask.request.$W[...] ...>, ...)
  - pattern: open(..., <... flask.request.$W(...) ...>, ...)
  - pattern: open(..., <... flask.request.$W ...>, ...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W.get(...) ...>
        ...
        open(<... $INTERM ...>, ...)
    - pattern: open(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W[...] ...>
        ...
        open(<... $INTERM ...>, ...)
    - pattern: open(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W(...) ...>
        ...
        open(<... $INTERM ...>, ...)
    - pattern: open(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W ...>
        ...
        open(<... $INTERM ...>, ...)
    - pattern: open(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W.get(...) ...>
        ...
        with open(<... $INTERM ...>, ...) as $F:
          ...
    - pattern: open(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W[...] ...>
        ...
        with open(<... $INTERM ...>, ...) as $F:
          ...
    - pattern: open(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W(...) ...>
        ...
        with open(<... $INTERM ...>, ...) as $F:
          ...
    - pattern: open(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W ...>
        ...
        with open(<... $INTERM ...>, ...) as $F:
          ...
    - pattern: open(...)
- id: python.flask.security.injection.ssrf-requests.ssrf-requests
  languages:
  - python
  severity: ERROR
  message: Data from request object is passed to a new server-side request. This could
    lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes
    and hosts are validated against an allowlist, do not forward the response to the
    user, and ensure proper authentication and transport-layer security in the proxied
    request.
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    references:
    - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests
    shortlink: https://sg.run/J9LW
    semgrep.dev:
      rule:
        r_id: 9546
        rv_id: 1263432
        rule_id: WAUoRx
        version_id: rxTAKJn
        url: https://semgrep.dev/playground/r/rxTAKJn/python.flask.security.injection.ssrf-requests.ssrf-requests
        origin: community
  pattern-either:
  - patterns:
    - pattern: requests.$FUNC(...)
    - pattern-either:
      - pattern-inside: |
          @$APP.$ROUTE_METHOD($ROUTE, ...)
          def $ROUTE_FUNC(..., $ROUTEVAR, ...):
            ...
            requests.$FUNC(..., <... $ROUTEVAR ...>, ...)
      - pattern-inside: |
          @$APP.$ROUTE_METHOD($ROUTE, ...)
          def $ROUTE_FUNC(..., $ROUTEVAR, ...):
            ...
            $INTERM = <... $ROUTEVAR ...>
            ...
            requests.$FUNC(..., <... $INTERM ...>, ...)
    - metavariable-regex:
        metavariable: $ROUTE_METHOD
        regex: ^(route|get|post|put|delete|patch)$
  - pattern: requests.$FUNC(..., <... flask.request.$W.get(...) ...>, ...)
  - pattern: requests.$FUNC(..., <... flask.request.$W[...] ...>, ...)
  - pattern: requests.$FUNC(..., <... flask.request.$W(...) ...>, ...)
  - pattern: requests.$FUNC(..., <... flask.request.$W ...>, ...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W.get(...) ...>
        ...
        requests.$FUNC(<... $INTERM ...>, ...)
    - pattern: requests.$FUNC(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W[...] ...>
        ...
        requests.$FUNC(<... $INTERM ...>, ...)
    - pattern: requests.$FUNC(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W(...) ...>
        ...
        requests.$FUNC(<... $INTERM ...>, ...)
    - pattern: requests.$FUNC(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W ...>
        ...
        requests.$FUNC(<... $INTERM ...>, ...)
    - pattern: requests.$FUNC(...)
- id: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
  patterns:
  - pattern-either:
    - patterns:
      - pattern: |
          jwt.decode(..., options={..., "verify_signature": $BOOL, ...}, ...)
      - metavariable-pattern:
          metavariable: $BOOL
          pattern: |
            False
      - focus-metavariable: $BOOL
    - patterns:
      - pattern: |
          $OPTS = {..., "verify_signature": $BOOL, ...}
          ...
          jwt.decode(..., options=$OPTS, ...)
      - metavariable-pattern:
          metavariable: $BOOL
          pattern: |
            False
      - focus-metavariable: $BOOL
  message: Detected JWT token decoded with 'verify=False'. This bypasses any integrity
    checks for the token which means the token could be tampered with by malicious
    actors. Ensure that the JWT token is verified.
  metadata:
    owasp:
    - A02:2017 - Broken Authentication
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    cwe:
    - 'CWE-287: Improper Authentication'
    references:
    - https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96
    category: security
    technology:
    - jwt
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
    shortlink: https://sg.run/6nyB
    semgrep.dev:
      rule:
        r_id: 9559
        rv_id: 1263454
        rule_id: 10UKjo
        version_id: 5PTo12w
        url: https://semgrep.dev/playground/r/5PTo12w/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
        origin: community
  fix: |
    True
  severity: ERROR
  languages:
  - python
- id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
  patterns:
  - pattern: subprocess.$FUNC(..., shell=$TRUE, ...)
  - metavariable-pattern:
      metavariable: $TRUE
      pattern: "True \n"
  - pattern-not: subprocess.$FUNC("...", shell=True, ...)
  - focus-metavariable: $TRUE
  message: Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous
    because this call will spawn the command using a shell process. Doing so propagates
    current shell settings and variables, which makes it much easier for a malicious
    actor to execute commands. Use 'shell=False' instead.
  fix: |
    False
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    references:
    - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess
    - https://docs.python.org/3/library/subprocess.html
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - secure default
    likelihood: HIGH
    impact: LOW
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
    shortlink: https://sg.run/J92w
    semgrep.dev:
      rule:
        r_id: 9646
        rv_id: 1263518
        rule_id: DbUpz2
        version_id: 0bTKzDK
        url: https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
    - https://nvd.nist.gov/vuln/detail/CVE-2017-18342
    category: security
    technology:
    - pyyaml
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
    shortlink: https://sg.run/we9Y
    semgrep.dev:
      rule:
        r_id: 9673
        rv_id: 1263530
        rule_id: ZqU5jZ
        version_id: 1QTyprw
        url: https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
        origin: community
  languages:
  - python
  message: Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`,
    `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe
    methods of deserializing YAML. An attacker with control over the YAML input could
    create special YAML input that allows the attacker to run arbitrary Python code.
    This would allow the attacker to steal files, download and install malware, or
    otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead.
  fix-regex:
    regex: unsafe_load
    replacement: safe_load
    count: 1
  severity: ERROR
  patterns:
  - pattern-inside: |
      import yaml
      ...
  - pattern-not-inside: |
      $YAML = ruamel.yaml.YAML(...)
      ...
  - pattern-either:
    - pattern: yaml.unsafe_load(...)
    - pattern: yaml.load(..., Loader=yaml.Loader, ...)
    - pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...)
    - pattern: yaml.load(..., Loader=yaml.CLoader, ...)
    - pattern: yaml.load_all(..., Loader=yaml.Loader, ...)
    - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...)
    - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...)
- id: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ
    category: security
    technology:
    - ruamel.yaml
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel
    shortlink: https://sg.run/x1rz
    semgrep.dev:
      rule:
        r_id: 9674
        rv_id: 1263531
        rule_id: nJUzqK
        version_id: 9lT4bvG
        url: https://semgrep.dev/playground/r/9lT4bvG/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel
        origin: community
  languages:
  - python
  message: Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create
    arbitrary Python objects. A malicious actor could exploit this to run arbitrary
    code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead.
  severity: ERROR
  pattern-either:
  - pattern: ruamel.yaml.YAML(..., typ='unsafe', ...)
  - pattern: ruamel.yaml.YAML(..., typ='base', ...)
- id: python.lang.security.deserialization.pickle.avoid-shelve
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve
    shortlink: https://sg.run/dKkZ
    semgrep.dev:
      rule:
        r_id: 9678
        rv_id: 1263535
        rule_id: 8GUje2
        version_id: NdTzyb4
        url: https://semgrep.dev/playground/r/NdTzyb4/python.lang.security.deserialization.pickle.avoid-shelve
        origin: community
  languages:
  - python
  message: Avoid using `shelve`, which uses `pickle`, which is known to lead to code
    execution vulnerabilities. When unpickling, the serialized data could be manipulated
    to run arbitrary code. Instead, consider serializing the relevant data as JSON
    or a similar text-based serialization format.
  severity: WARNING
  pattern: shelve.$FUNC(...)
- id: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection
  patterns:
  - pattern-either:
    - pattern: |
        def $FUNC(...,$VAR,...):
          ...
          $SESSION.query(...).$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
    - pattern: |
        def $FUNC(...,$VAR,...):
          ...
          $SESSION.query.join(...).$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
    - pattern: |
        def $FUNC(...,$VAR,...):
          ...
          $SESSION.query.$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
    - pattern: |
        def $FUNC(...,$VAR,...):
          ...
          query.$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
  - metavariable-regex:
      metavariable: $SQLFUNC
      regex: (group_by|order_by|distinct|having|filter)
  - metavariable-regex:
      metavariable: $FORMATFUNC
      regex: (?!bindparams)
  message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause
    sql injections if the developer inputs raw SQL into the before-mentioned clauses.
    This pattern captures relevant cases in which the developer inputs raw SQL into
    the distinct, having, group_by, order_by or filter clauses and injects user-input
    into the raw SQL with any function besides "bindparams". Use bindParams to securely
    bind user-input to SQL statements.
  fix-regex:
    regex: format
    replacement: bindparams
  languages:
  - python
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    category: security
    technology:
    - sqlalchemy
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection
    shortlink: https://sg.run/J3Xo
    semgrep.dev:
      rule:
        r_id: 9702
        rv_id: 1263579
        rule_id: BYUBWo
        version_id: NdTzyL4
        url: https://semgrep.dev/playground/r/NdTzyL4/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection
        origin: community
- id: ruby.lang.security.bad-deserialization.bad-deserialization
  mode: taint
  pattern-sources:
  - pattern-either:
    - pattern: params
    - pattern: cookies
  pattern-sinks:
  - pattern-either:
    - pattern: |
        CSV.load(...)
    - pattern: |
        Marshal.load(...)
    - pattern: |
        Marshal.restore(...)
    - pattern: |
        Oj.object_load(...)
    - pattern: |
        Oj.load($X)
  message: Checks for unsafe deserialization. Objects in Ruby can be serialized into
    strings, then later loaded from strings. However, uses of load and object_load
    can cause remote code execution. Loading user input with MARSHAL or CSV can potentially
    be dangerous. Use JSON in a secure fashion instead.
  metadata:
    references:
    - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb
    category: security
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    technology:
    - ruby
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization
    shortlink: https://sg.run/DJj2
    semgrep.dev:
      rule:
        r_id: 9708
        rv_id: 1263595
        rule_id: lBUdQg
        version_id: 3ZT4Xqp
        url: https://semgrep.dev/playground/r/3ZT4Xqp/ruby.lang.security.bad-deserialization.bad-deserialization
        origin: community
  languages:
  - ruby
  severity: ERROR
- id: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
  patterns:
  - pattern-inside: |
      class $CONTROLLER < ApplicationController
        ...
        http_basic_authenticate_with ..., :password => "$SECRET", ...
      end
  - focus-metavariable: $SECRET
  message: Detected hardcoded password used in basic authentication in a controller
    class. Including this password in version control could expose this credential.
    Consider refactoring to use environment variables or configuration files.
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/basic_auth/index.markdown
    category: security
    technology:
    - ruby
    - secrets
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
    shortlink: https://sg.run/6r0w
    semgrep.dev:
      rule:
        r_id: 9715
        rv_id: 1263606
        rule_id: X5UZWK
        version_id: 0bTKzNK
        url: https://semgrep.dev/playground/r/0bTKzNK/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
        origin: community
  languages:
  - ruby
- id: ruby.lang.security.no-eval.ruby-eval
  message: Use of eval with user-controllable input detected. This can lead  to attackers
    running arbitrary code. Ensure external data does not  reach here, otherwise this
    is a security vulnerability. Consider  other ways to do this without eval.
  severity: WARNING
  metadata:
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe2022-top25: true
    cwe2021-top25: true
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_evaluation.rb
    subcategory:
    - vuln
    technology:
    - ruby
    - rails
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval
    shortlink: https://sg.run/bDwZ
    semgrep.dev:
      rule:
        r_id: 9726
        rv_id: 1263615
        rule_id: OrUGNk
        version_id: A8TgdDv
        url: https://semgrep.dev/playground/r/A8TgdDv/ruby.lang.security.no-eval.ruby-eval
        origin: community
  languages:
  - ruby
  mode: taint
  pattern-sources:
  - pattern-either:
    - pattern: params
    - pattern: cookies
    - patterns:
      - pattern: |
          RubyVM::InstructionSequence.compile(...)
      - pattern-not: |
          RubyVM::InstructionSequence.compile("...")
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: $X.eval
      - pattern: $X.class_eval
      - pattern: $X.instance_eval
      - pattern: $X.module_eval
      - pattern: $X.eval(...)
      - pattern: $X.class_eval(...)
      - pattern: $X.instance_eval(...)
      - pattern: $X.module_eval(...)
      - pattern: eval(...)
      - pattern: class_eval(...)
      - pattern: module_eval(...)
      - pattern: instance_eval(...)
    - pattern-not: $M("...",...)
- id: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust
  message: Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting
    (XSS) vulnerability if this comes from user-provided input. If you have to use
    `$TRUST`, ensure it does not come from user-input or use the appropriate prevention
    mechanism e.g. input validation or sanitization depending on the context.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    references:
    - https://angular.io/api/platform-browser/DomSanitizer
    - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    confidence: MEDIUM
    category: security
    technology:
    - angular
    - browser
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust
    shortlink: https://sg.run/KWxP
    semgrep.dev:
      rule:
        r_id: 9755
        rv_id: 1263902
        rule_id: oqUzgA
        version_id: 5PTo1zk
        url: https://semgrep.dev/playground/r/5PTo1zk/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust
        origin: community
  languages:
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          function ...({..., $X: string, ...}) { ... }
      - pattern-inside: |
          function ...(..., $X: string, ...) { ... }
    - focus-metavariable: $X
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: $X.$TRUST($Y)
    - focus-metavariable: $Y
    - pattern-not: |
        $X.$TRUST(`...`)
    - pattern-not: |
        $X.$TRUST("...")
    - metavariable-regex:
        metavariable: $TRUST
        regex: (bypassSecurityTrustHtml|bypassSecurityTrustStyle|bypassSecurityTrustScript|bypassSecurityTrustUrl|bypassSecurityTrustResourceUrl)
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          import * as $S from "underscore.string"
          ...
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          $S = require("underscore.string")
          ...
    - pattern-either:
      - pattern: $S.escapeHTML(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "dompurify"
          ...
      - pattern-inside: |
          import { ..., $S,... } from "dompurify"
          ...
      - pattern-inside: |
          import * as $S from "dompurify"
          ...
      - pattern-inside: |
          $S = require("dompurify")
          ...
      - pattern-inside: |
          import $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          import * as $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          $S = require("isomorphic-dompurify")
          ...
    - pattern-either:
      - patterns:
        - pattern-inside: |
            $VALUE = $S(...)
            ...
        - pattern: $VALUE.sanitize(...)
      - patterns:
        - pattern-inside: |
            $VALUE = $S.sanitize
            ...
        - pattern: $S(...)
      - pattern: $S.sanitize(...)
      - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'xss';
          ...
      - pattern-inside: |
          import * as $S from 'xss';
          ...
      - pattern-inside: |
          $S = require("xss")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'sanitize-html';
          ...
      - pattern-inside: |
          import * as $S from "sanitize-html";
          ...
      - pattern-inside: |
          $S = require("sanitize-html")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern: sanitizer.sanitize(...)
    - pattern-not: sanitizer.sanitize(SecurityContext.NONE, ...);
- id: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml
  message: Detection of dangerouslySetInnerHTML from non-constant definition. This
    can inadvertently expose users to cross-site scripting (XSS) attacks if this comes
    from user-provided input. If you have to use dangerouslySetInnerHTML, consider
    using a sanitization library such as DOMPurify to sanitize your HTML.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html
    category: security
    confidence: MEDIUM
    technology:
    - react
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml
    shortlink: https://sg.run/rAx6
    semgrep.dev:
      rule:
        r_id: 9769
        rv_id: 1263912
        rule_id: x8UWvK
        version_id: l4TJR0v
        url: https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml
        origin: community
  languages:
  - typescript
  - javascript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          function ...({..., $X, ...}) { ... }
      - pattern-inside: |
          function ...(..., $X, ...) { ... }
    - focus-metavariable: $X
    - pattern-not-inside: |
        $F. ... .$SANITIZEUNC(...)
  pattern-sinks:
  - patterns:
    - focus-metavariable: $X
    - pattern-either:
      - pattern: |
          {...,dangerouslySetInnerHTML: {__html: $X},...}
      - pattern: |
          <$Y ... dangerouslySetInnerHTML={{__html: $X}} />
    - pattern-not: |
        <$Y ... dangerouslySetInnerHTML={{__html: "..."}} />
    - pattern-not: |
        {...,dangerouslySetInnerHTML:{__html: "..."},...}
    - metavariable-pattern:
        patterns:
        - pattern-not: |
            {...}
        metavariable: $X
    - pattern-not: |
        <... {__html: "..."} ...>
    - pattern-not: |
        <... {__html: `...`} ...>
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          import * as $S from "underscore.string"
          ...
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          $S = require("underscore.string")
          ...
    - pattern-either:
      - pattern: $S.escapeHTML(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "dompurify"
          ...
      - pattern-inside: |
          import { ..., $S,... } from "dompurify"
          ...
      - pattern-inside: |
          import * as $S from "dompurify"
          ...
      - pattern-inside: |
          $S = require("dompurify")
          ...
      - pattern-inside: |
          import $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          import * as $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          $S = require("isomorphic-dompurify")
          ...
    - pattern-either:
      - patterns:
        - pattern-inside: |
            $VALUE = $S(...)
            ...
        - pattern: $VALUE.sanitize(...)
      - patterns:
        - pattern-inside: |
            $VALUE = $S.sanitize
            ...
        - pattern: $S(...)
      - pattern: $S.sanitize(...)
      - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'xss';
          ...
      - pattern-inside: |
          import * as $S from 'xss';
          ...
      - pattern-inside: |
          $S = require("xss")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'sanitize-html';
          ...
      - pattern-inside: |
          import * as $S from "sanitize-html";
          ...
      - pattern-inside: |
          $S = require("sanitize-html")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $S = new Remarkable()
          ...
    - pattern: $S.render(...)
- id: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method
  message: Detection of $HTML from non-constant definition. This can inadvertently
    expose users to cross-site scripting (XSS) attacks if this comes from user-provided
    input. If you have to use $HTML, consider using a sanitization library such as
    DOMPurify to sanitize your HTML.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln
    - https://developer.mozilla.org/en-US/docs/Web/API/Document/write
    - https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML
    category: security
    confidence: MEDIUM
    technology:
    - react
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method
    shortlink: https://sg.run/E5x8
    semgrep.dev:
      rule:
        r_id: 9781
        rv_id: 1263916
        rule_id: QrU68w
        version_id: GxTkeRl
        url: https://semgrep.dev/playground/r/GxTkeRl/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method
        origin: community
  languages:
  - typescript
  - javascript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          function ...({..., $X, ...}) { ... }
      - pattern-inside: |
          function ...(..., $X, ...) { ... }
    - focus-metavariable: $X
    - pattern-either:
      - pattern: $X.$Y
      - pattern: $X[...]
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: "this.window.document. ... .$HTML('...',$SINK) \n"
      - pattern: "window.document. ... .$HTML('...',$SINK) \n"
      - pattern: "document.$HTML($SINK)  \n"
    - metavariable-regex:
        metavariable: $HTML
        regex: (writeln|write)
    - focus-metavariable: $SINK
  - patterns:
    - pattern-either:
      - pattern: "$PROP. ... .$HTML('...',$SINK) \n"
    - metavariable-regex:
        metavariable: $HTML
        regex: (insertAdjacentHTML)
    - focus-metavariable: $SINK
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          import * as $S from "underscore.string"
          ...
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          $S = require("underscore.string")
          ...
    - pattern-either:
      - pattern: $S.escapeHTML(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "dompurify"
          ...
      - pattern-inside: |
          import { ..., $S,... } from "dompurify"
          ...
      - pattern-inside: |
          import * as $S from "dompurify"
          ...
      - pattern-inside: |
          $S = require("dompurify")
          ...
      - pattern-inside: |
          import $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          import * as $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          $S = require("isomorphic-dompurify")
          ...
    - pattern-either:
      - patterns:
        - pattern-inside: |
            $VALUE = $S(...)
            ...
        - pattern: $VALUE.sanitize(...)
      - patterns:
        - pattern-inside: |
            $VALUE = $S.sanitize
            ...
        - pattern: $S(...)
      - pattern: $S.sanitize(...)
      - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'xss';
          ...
      - pattern-inside: |
          import * as $S from 'xss';
          ...
      - pattern-inside: |
          $S = require("xss")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'sanitize-html';
          ...
      - pattern-inside: |
          import * as $S from "sanitize-html";
          ...
      - pattern-inside: |
          $S = require("sanitize-html")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $S = new Remarkable()
          ...
    - pattern: $S.render(...)
- id: typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property
  message: Detection of $HTML from non-constant definition. This can inadvertently
    expose users to cross-site scripting (XSS) attacks if this comes from user-provided
    input. If you have to use $HTML, consider using a sanitization library such as
    DOMPurify to sanitize your HTML.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html
    category: security
    confidence: MEDIUM
    technology:
    - react
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property
    shortlink: https://sg.run/70Zv
    semgrep.dev:
      rule:
        r_id: 9782
        rv_id: 1263917
        rule_id: 3qUBl4
        version_id: RGT0Lln
        url: https://semgrep.dev/playground/r/RGT0Lln/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property
        origin: community
  languages:
  - typescript
  - javascript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          function ...({..., $X, ...}) { ... }
      - pattern-inside: |
          function ...(..., $X, ...) { ... }
    - focus-metavariable: $X
    - pattern-either:
      - pattern: $X.$Y
      - pattern: $X[...]
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $BODY = $REACT.useRef(...)
          ...
      - pattern-inside: |
          $BODY = useRef(...)
          ...
      - pattern-inside: |
          $BODY = findDOMNode(...)
          ...
      - pattern-inside: |
          $BODY = createRef(...)
          ...
      - pattern-inside: |
          $BODY = $REACT.findDOMNode(...)
          ...
      - pattern-inside: |
          $BODY = $REACT.createRef(...)
          ...
    - pattern-either:
      - pattern: "$BODY. ... .$HTML = $SINK \n"
      - pattern: "$BODY.$HTML = $SINK  \n"
    - metavariable-regex:
        metavariable: $HTML
        regex: (innerHTML|outerHTML)
    - focus-metavariable: $SINK
  - patterns:
    - pattern-either:
      - pattern: ReactDOM.findDOMNode(...).$HTML = $SINK
    - metavariable-regex:
        metavariable: $HTML
        regex: (innerHTML|outerHTML)
    - focus-metavariable: $SINK
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          import * as $S from "underscore.string"
          ...
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          $S = require("underscore.string")
          ...
    - pattern-either:
      - pattern: $S.escapeHTML(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "dompurify"
          ...
      - pattern-inside: |
          import { ..., $S,... } from "dompurify"
          ...
      - pattern-inside: |
          import * as $S from "dompurify"
          ...
      - pattern-inside: |
          $S = require("dompurify")
          ...
      - pattern-inside: |
          import $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          import * as $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          $S = require("isomorphic-dompurify")
          ...
    - pattern-either:
      - patterns:
        - pattern-inside: |
            $VALUE = $S(...)
            ...
        - pattern: $VALUE.sanitize(...)
      - patterns:
        - pattern-inside: |
            $VALUE = $S.sanitize
            ...
        - pattern: $S(...)
      - pattern: $S.sanitize(...)
      - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'xss';
          ...
      - pattern-inside: |
          import * as $S from 'xss';
          ...
      - pattern-inside: |
          $S = require("xss")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'sanitize-html';
          ...
      - pattern-inside: |
          import * as $S from "sanitize-html";
          ...
      - pattern-inside: |
          $S = require("sanitize-html")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $S = new Remarkable()
          ...
    - pattern: $S.render(...)
- id: ruby.lang.security.dangerous-exec.dangerous-exec
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: |
        def $F(...,$ARG,...)
            ...
        end
    - focus-metavariable: $ARG
  - pattern: params
  - pattern: cookies
  pattern-sinks:
  - patterns:
    - pattern: |
        $EXEC(...)
    - pattern-not: |
        $EXEC("...","...","...",...)
    - pattern-not: |
        $EXEC(["...","...","...",...],...)
    - pattern-not: |
        $EXEC({...},"...","...","...",...)
    - pattern-not: |
        $EXEC({...},["...","...","...",...],...)
    - metavariable-regex:
        metavariable: $EXEC
        regex: ^(system|exec|spawn|Process.exec|Process.spawn|Open3.capture2|Open3.capture2e|Open3.capture3|Open3.popen2|Open3.popen2e|Open3.popen3|IO.popen|Gem::Util.popen|PTY.spawn)$
  message: Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If
    unverified user data can reach this call site, this is a code injection vulnerability.
    A malicious actor can inject a malicious script to execute arbitrary code.
  metadata:
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_execute.rb
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - ruby
    - rails
    references:
    - https://guides.rubyonrails.org/security.html#command-line-injection
    cwe2022-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec
    shortlink: https://sg.run/R8GY
    semgrep.dev:
      rule:
        r_id: 9805
        rv_id: 1409405
        rule_id: WAUZOw
        version_id: WrT7erb
        url: https://semgrep.dev/playground/r/WrT7erb/ruby.lang.security.dangerous-exec.dangerous-exec
        origin: community
  severity: WARNING
  languages:
  - ruby
- id: javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run
  message: Detected non-literal calls to Deno.run(). This could lead to a command
    injection vulnerability.
  metadata:
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - deno
    references:
    - https://deno.land/manual/examples/subprocess#simple-example
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run
    shortlink: https://sg.run/Nrrn
    semgrep.dev:
      rule:
        r_id: 9927
        rv_id: 1409397
        rule_id: x8UWWg
        version_id: PkTe7AP
        url: https://semgrep.dev/playground/r/PkTe7AP/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-inside: function ... (..., $ARG,...) {...}
    - focus-metavariable: $ARG
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          Deno.run({cmd: [$INPUT,...]},...)
      - pattern: |
          Deno.run({cmd: ["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$INPUT,...]},...)
      - patterns:
        - pattern: |
            Deno.run({cmd: [$CMD,"-c",$INPUT,...]},...)
        - pattern-inside: |
            $CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/"
            ...
    - focus-metavariable: $INPUT
- id: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli
  mode: taint
  pattern-propagators:
  - pattern: $X << $Y
    from: $Y
    to: $X
  pattern-sources:
  - pattern-either:
    - pattern: |
        params
    - pattern: |
        cookies
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $CON = PG.connect(...)
          ...
      - pattern-inside: |
          $CON = PG::Connection.open(...)
          ...
      - pattern-inside: |
          $CON = PG::Connection.new(...)
          ...
    - pattern-either:
      - pattern: |
          $CON.$METHOD($X,...)
      - pattern: |
          $CON.$METHOD $X, ...
    - focus-metavariable: $X
    - metavariable-regex:
        metavariable: $METHOD
        regex: ^(exec|exec_params)$
  languages:
  - ruby
  message: 'Detected string concatenation with a non-literal variable in a pg Ruby
    SQL statement. This could lead to SQL injection if the variable is user-controlled
    and not properly sanitized. In order to prevent SQL injection, use parameterized
    queries or prepared statements instead. You can use parameterized queries like
    so: `conn.exec_params(''SELECT $1 AS a, $2 AS b, $3 AS c'', [1, 2, nil])` And
    you can use prepared statements with `exec_prepared`.'
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://www.rubydoc.info/gems/pg/PG/Connection
    category: security
    technology:
    - rails
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli
    shortlink: https://sg.run/kL0o
    semgrep.dev:
      rule:
        r_id: 10328
        rv_id: 1263628
        rule_id: NbUAz7
        version_id: 2KTv2y2
        url: https://semgrep.dev/playground/r/2KTv2y2/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli
        origin: community
  severity: WARNING
- id: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    references:
    - https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide
    category: security
    technology:
    - .net
    confidence: HIGH
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization
    shortlink: https://sg.run/ZeXW
    semgrep.dev:
      rule:
        r_id: 11135
        rv_id: 1262635
        rule_id: bwUOjK
        version_id: nWT2LGp
        url: https://semgrep.dev/playground/r/nWT2LGp/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization
        origin: community
  message: The BinaryFormatter type is dangerous and is not recommended for data processing.
    Applications should stop using BinaryFormatter as soon as possible, even if they
    believe the data they're processing to be trustworthy. BinaryFormatter is insecure
    and can't be made secure
  patterns:
  - pattern-inside: |
      using System.Runtime.Serialization.Formatters.Binary;
      ...
  - pattern: |
      new BinaryFormatter();
- id: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    references:
    - https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution
    category: security
    technology:
    - .net
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization
    shortlink: https://sg.run/E5e5
    semgrep.dev:
      rule:
        r_id: 11137
        rv_id: 1262638
        rule_id: kxURnR
        version_id: LjTkgPk
        url: https://semgrep.dev/playground/r/LjTkgPk/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization
        origin: community
  message: The FsPickler is dangerous and is not recommended for data processing.
    Default configuration tend to insecure deserialization vulnerability.
  patterns:
  - pattern-inside: |
      using MBrace.FsPickler.Json;
      ...
  - pattern: |
      FsPickler.CreateJsonSerializer();
- id: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    references:
    - https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8
    category: security
    technology:
    - .net
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization
    shortlink: https://sg.run/70pG
    semgrep.dev:
      rule:
        r_id: 11138
        rv_id: 1262641
        rule_id: wdU87G
        version_id: QkTGqnA
        url: https://semgrep.dev/playground/r/QkTGqnA/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization
        origin: community
  message: The LosFormatter type is dangerous and is not recommended for data processing.
    Applications should stop using LosFormatter as soon as possible, even if they
    believe the data they're processing to be trustworthy. LosFormatter is insecure
    and can't be made secure
  patterns:
  - pattern-inside: |
      using System.Web.UI;
      ...
  - pattern: |
      new LosFormatter();
- id: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    references:
    - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security
    category: security
    technology:
    - .net
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization
    shortlink: https://sg.run/L0AX
    semgrep.dev:
      rule:
        r_id: 11139
        rv_id: 1262642
        rule_id: x8UW7x
        version_id: 3ZT4X6b
        url: https://semgrep.dev/playground/r/3ZT4X6b/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization
        origin: community
  message: The NetDataContractSerializer type is dangerous and is not recommended
    for data processing. Applications should stop using NetDataContractSerializer
    as soon as possible, even if they believe the data they're processing to be trustworthy.
    NetDataContractSerializer is insecure and can't be made secure
  patterns:
  - pattern-inside: |
      using System.Runtime.Serialization;
      ...
  - pattern: |
      new NetDataContractSerializer();
- id: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    references:
    - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks
    category: security
    technology:
    - .net
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization
    shortlink: https://sg.run/gJnR
    semgrep.dev:
      rule:
        r_id: 11141
        rv_id: 1262644
        rule_id: eqUvND
        version_id: PkTR30n
        url: https://semgrep.dev/playground/r/PkTR30n/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization
        origin: community
  message: The SoapFormatter type is dangerous and is not recommended for data processing.
    Applications should stop using SoapFormatter as soon as possible, even if they
    believe the data they're processing to be trustworthy. SoapFormatter is insecure
    and can't be made secure
  patterns:
  - pattern-inside: |
      using System.Runtime.Serialization.Formatters.Soap;
      ...
  - pattern: |
      new SoapFormatter();
- id: terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional
  languages:
  - hcl
  message: AWS EC2 Instance allowing use of the IMDSv1
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    references:
    - https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service
    - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options
    category: security
    technology:
    - terraform
    - aws
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional
    shortlink: https://sg.run/J3BQ
    semgrep.dev:
      rule:
        r_id: 11302
        rv_id: 1263884
        rule_id: GdU0eA
        version_id: w8TRooE
        url: https://semgrep.dev/playground/r/w8TRooE/terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional
        origin: community
  pattern-either:
  - patterns:
    - pattern: http_tokens = "optional"
    - pattern-inside: |
        metadata_options { ... }
  - patterns:
    - pattern: |
        resource "aws_instance" "$NAME" {
          ...
        }
    - pattern-not: |
        resource "aws_instance" "$NAME" {
          ...
          metadata_options {
            ...
            http_tokens = "required"
            ...
          }
          ...
        }
    - pattern-not: |
        resource "aws_instance" "$NAME" {
          ...
          metadata_options {
            ...
            http_tokens = "optional"
            ...
          }
          ...
        }
    - pattern-not: |
        resource "aws_instance" "$NAME" {
          ...
          metadata_options {
            ...
            http_endpoint = "disabled"
            ...
          }
          ...
        }
  severity: ERROR
- id: javascript.express.security.express-vm-injection.express-vm-injection
  message: Make sure that unverified user data can not reach `$VM`.
  metadata:
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    category: security
    technology:
    - express
    cwe2022-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection
    shortlink: https://sg.run/jkqJ
    semgrep.dev:
      rule:
        r_id: 12821
        rv_id: 1263170
        rule_id: DbUKPX
        version_id: 1QTypXQ
        url: https://semgrep.dev/playground/r/1QTypXQ/javascript.express.security.express-vm-injection.express-vm-injection
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
  pattern-sinks:
  - patterns:
    - pattern-inside: |
        $VM = require('vm');
        ...
    - pattern-either:
      - pattern: |
          $VM.runInContext(...)
      - pattern: |
          $VM.runInNewContext(...)
      - pattern: |
          $VM.compileFunction(...)
      - pattern: |
          $VM.runInThisContext(...)
      - pattern: new $VM.Script(...)
- id: javascript.express.security.express-vm2-injection.express-vm2-injection
  message: Make sure that unverified user data can not reach `vm2`.
  metadata:
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    category: security
    technology:
    - express
    cwe2022-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection
    shortlink: https://sg.run/1GWv
    semgrep.dev:
      rule:
        r_id: 12822
        rv_id: 1263171
        rule_id: WAUPXJ
        version_id: 9lT4bnX
        url: https://semgrep.dev/playground/r/9lT4bnX/javascript.express.security.express-vm2-injection.express-vm2-injection
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
  pattern-sinks:
  - patterns:
    - pattern-inside: |
        require('vm2')
        ...
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern-inside: |
              $VM = new VM(...)
              ...
          - pattern-inside: |
              $VM = new NodeVM(...)
              ...
        - pattern: |
            $VM.run(...)
      - pattern: |
          new VM(...).run(...)
      - pattern: |
          new NodeVM(...).run(...)
      - pattern: |
          new VMScript(...)
      - pattern: |
          new VM(...)
      - pattern: new NodeVM(...)
- id: yaml.github-actions.security.run-shell-injection.run-shell-injection
  languages:
  - yaml
  message: 'Using variable interpolation `${{...}}` with `github` context data in
    a `run:` step could allow an attacker to inject their own code into the runner.
    This would allow them to steal secrets and code. `github` context data can have
    arbitrary user input and should be treated as untrusted. Instead, use an intermediate
    environment variable with `env:` to store the data and use the environment variable
    in the `run:` script. Be sure to use double-quotes the environment variable, like
    this: "$ENVVAR".'
  metadata:
    category: security
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
    - https://securitylab.github.com/research/github-actions-untrusted-input/
    technology:
    - github-actions
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection
    shortlink: https://sg.run/pkzk
    semgrep.dev:
      rule:
        r_id: 13162
        rv_id: 1423395
        rule_id: v8UjQj
        version_id: GxTl1DQ
        url: https://semgrep.dev/playground/r/GxTl1DQ/yaml.github-actions.security.run-shell-injection.run-shell-injection
        origin: community
  patterns:
  - pattern-inside: 'steps: [...]'
  - pattern-inside: |
      - run: ...
        ...
  - pattern: 'run: $SHELL'
  - metavariable-pattern:
      language: generic
      metavariable: $SHELL
      patterns:
      - pattern-either:
        - pattern: ${{ ... github.event.issue.title ... }}
        - pattern: ${{ ... github.event.issue.body ... }}
        - pattern: ${{ ... github.event.pull_request.title ... }}
        - pattern: ${{ ... github.event.pull_request.body ... }}
        - pattern: ${{ ... github.event.comment.body ... }}
        - pattern: ${{ ... github.event.review.body ... }}
        - pattern: ${{ ... github.event.review_comment.body ... }}
        - pattern: ${{ ... github.event.pages ... .page_name ... }}
        - pattern: ${{ ... github.event.head_commit.message ... }}
        - pattern: ${{ ... github.event.head_commit.author.email ... }}
        - pattern: ${{ ... github.event.head_commit.author.name ... }}
        - pattern: ${{ ... github.event.commits ... .author.email ... }}
        - pattern: ${{ ... github.event.commits ... .author.name ... }}
        - pattern: ${{ ... github.event.commits ... .message ... }}
        - pattern: ${{ ... github.event.pull_request.head.ref ... }}
        - pattern: ${{ ... github.event.pull_request.head.label ... }}
        - pattern: ${{ ... github.event.pull_request.head.repo.default_branch ...
            }}
        - pattern: ${{ ... github.ref ... }}
        - pattern: ${{ ... github.base_ref ... }}
        - pattern: ${{ ... github.head_ref ... }}
        - pattern: ${{ ... github.ref_name ... }}
        - pattern: ${{ ... github.workflow ... }}
        - pattern: ${{ ... github.event.inputs ... }}
        - pattern: ${{ ... github.event.discussion.title ... }}
        - pattern: ${{ ... github.event.discussion.body ... }}
        - pattern: ${{ ... github.event.workflow_run.head_branch ... }}
        - pattern: ${{ ... github.event.workflow_run.head_commit.message ... }}
        - pattern: ${{ ... github.event.milestone.title ... }}
        - pattern: ${{ ... github.event.milestone.description ... }}
        - pattern: ${{ ... github.event.project_card.note ... }}
        - pattern: ${{ ... github.event.project.name ... }}
        - pattern: ${{ ... github.event.project_column.name ... }}
        - pattern: ${{ ... github.event.release.name ... }}
        - pattern: ${{ ... github.event.release.body ... }}
        - pattern: ${{ ... github.event.deployment.ref ... }}
        - pattern: ${{ ... inputs ... }}
      - pattern-not: ${{ ... github.event.issue.title && ... }}
      - pattern-not: ${{ ... github.event.issue.body && ... }}
      - pattern-not: ${{ ... github.event.pull_request.title && ... }}
      - pattern-not: ${{ ... github.event.pull_request.body && ... }}
      - pattern-not: ${{ ... github.event.comment.body && ... }}
      - pattern-not: ${{ ... github.event.review.body && ... }}
      - pattern-not: ${{ ... github.event.review_comment.body && ... }}
      - pattern-not: ${{ ... github.event.pages ... .page_name && ... }}
      - pattern-not: ${{ ... github.event.head_commit.message && ... }}
      - pattern-not: ${{ ... github.event.head_commit.author.email && ... }}
      - pattern-not: ${{ ... github.event.head_commit.author.name && ... }}
      - pattern-not: ${{ ... github.event.commits ... .author.email && ... }}
      - pattern-not: ${{ ... github.event.commits ... .author.name && ... }}
      - pattern-not: ${{ ... github.event.commits ... .message && ... }}
      - pattern-not: ${{ ... github.event.pull_request.head.ref && ... }}
      - pattern-not: ${{ ... github.event.pull_request.head.label && ... }}
      - pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch &&
          ... }}
      - pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ...
          }}
      - pattern-not: ${{ ... github.ref && ... }}
      - pattern-not: ${{ ... github.base_ref && ... }}
      - pattern-not: ${{ ... github.head_ref && ... }}
      - pattern-not: ${{ ... github.ref_name && ... }}
      - pattern-not: ${{ ... github.workflow && ... }}
      - pattern-not: ${{ ... github.event.inputs && ... }}
      - pattern-not: ${{ ... github.event.discussion.title && ... }}
      - pattern-not: ${{ ... github.event.discussion.body && ... }}
      - pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }}
      - pattern-not: ${{ ... github.event.milestone.title && ... }}
      - pattern-not: ${{ ... github.event.milestone.description && ... }}
      - pattern-not: ${{ ... github.event.project_card.note && ... }}
      - pattern-not: ${{ ... github.event.project.name && ... }}
      - pattern-not: ${{ ... github.event.project_column.name && ... }}
      - pattern-not: ${{ ... github.event.release.name && ... }}
      - pattern-not: ${{ ... github.event.release.body && ... }}
      - pattern-not: ${{ ... github.event.deployment.ref && ... }}
  severity: ERROR
- id: ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation
  metadata:
    shortDescription: Allowing an attacker to manipulate the session may lead to unintended
      behavior.
    tags:
    - security
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-276: Incorrect Default Permissions'
    references:
    - https://brakemanscanner.org/docs/warning_types/session_manipulation/
    category: security
    technology:
    - rails
    help: |
      ## Remediation
      Session manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.

      ## References
      [Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authorization
    source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation
    shortlink: https://sg.run/86q7
    semgrep.dev:
      rule:
        r_id: 13584
        rv_id: 1263621
        rule_id: BYUdW6
        version_id: qkTR76G
        url: https://semgrep.dev/playground/r/qkTR76G/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation
        origin: community
  message: This gets data from session using user inputs. A malicious user may be
    able to retrieve information from your session that you didn't intend them to.
    Do not use user input as a session key.
  languages:
  - ruby
  severity: WARNING
  mode: taint
  pattern-sources:
  - pattern: params
  - pattern: cookies
  - pattern: request.env
  pattern-sinks:
  - pattern: session[...]
- id: ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access
  metadata:
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
    category: security
    technology:
    - rails
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access
    shortlink: https://sg.run/gYln
    semgrep.dev:
      rule:
        r_id: 13585
        rv_id: 1263622
        rule_id: DbU1dr
        version_id: l4TJRkk
        url: https://semgrep.dev/playground/r/l4TJRkk/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access
        origin: community
  message: Using user input when accessing files is potentially dangerous. A malicious
    actor could use this to modify or access files they have no right to.
  languages:
  - ruby
  severity: WARNING
  mode: taint
  pattern-sources:
  - pattern: params
  - pattern: cookies
  - pattern: request.env
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: Dir.$X(...)
      - pattern: File.$X(...)
      - pattern: IO.$X(...)
      - pattern: Kernel.$X(...)
      - pattern: PStore.$X(...)
      - pattern: Pathname.$X(...)
    - metavariable-pattern:
        metavariable: $X
        patterns:
        - pattern-either:
          - pattern: chdir
          - pattern: chroot
          - pattern: delete
          - pattern: entries
          - pattern: foreach
          - pattern: glob
          - pattern: install
          - pattern: lchmod
          - pattern: lchown
          - pattern: link
          - pattern: load
          - pattern: load_file
          - pattern: makedirs
          - pattern: move
          - pattern: new
          - pattern: open
          - pattern: read
          - pattern: readlines
          - pattern: rename
          - pattern: rmdir
          - pattern: safe_unlink
          - pattern: symlink
          - pattern: syscopy
          - pattern: sysopen
          - pattern: truncate
          - pattern: unlink
- id: ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call
  metadata:
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
    category: security
    technology:
    - rails
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call
    shortlink: https://sg.run/Q9gP
    semgrep.dev:
      rule:
        r_id: 13586
        rv_id: 1263623
        rule_id: WAUyzp
        version_id: YDTZeWL
        url: https://semgrep.dev/playground/r/YDTZeWL/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call
        origin: community
  message: Using user input when accessing files is potentially dangerous. A malicious
    actor could use this to modify or access files they have no right to.
  languages:
  - ruby
  severity: WARNING
  mode: taint
  pattern-sources:
  - pattern: params
  - pattern: cookies
  - pattern: request.env
  pattern-sinks:
  - pattern-either:
    - pattern: Net::FTP.$X(...)
    - patterns:
      - pattern-inside: |
          $FTP = Net::FTP.$OPEN(...)
          ...
          $FTP.$METHOD(...)
      - pattern: $FTP.$METHOD(...)
- id: ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request
  metadata:
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
    category: security
    technology:
    - rails
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request
    shortlink: https://sg.run/3rLb
    semgrep.dev:
      rule:
        r_id: 13587
        rv_id: 1263624
        rule_id: 0oU2x3
        version_id: 6xT29nN
        url: https://semgrep.dev/playground/r/6xT29nN/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request
        origin: community
  message: Using user input when accessing files is potentially dangerous. A malicious
    actor could use this to modify or access files they have no right to.
  languages:
  - ruby
  severity: WARNING
  mode: taint
  pattern-sources:
  - pattern: params
  - pattern: cookies
  - pattern: request.env
  pattern-sinks:
  - pattern-either:
    - patterns:
      - pattern: Net::HTTP::$METHOD.new(...)
      - metavariable-pattern:
          metavariable: $METHOD
          patterns:
          - pattern-either:
            - pattern: Copy
            - pattern: Delete
            - pattern: Get
            - pattern: Head
            - pattern: Lock
            - pattern: Mkcol
            - pattern: Move
            - pattern: Options
            - pattern: Patch
            - pattern: Post
            - pattern: Propfind
            - pattern: Proppatch
            - pattern: Put
            - pattern: Trace
            - pattern: Unlock
    - patterns:
      - pattern: Net::HTTP.$X(...)
      - metavariable-pattern:
          metavariable: $X
          patterns:
          - pattern-either:
            - pattern: get
            - pattern: get2
            - pattern: head
            - pattern: head2
            - pattern: options
            - pattern: patch
            - pattern: post
            - pattern: post2
            - pattern: post_form
            - pattern: put
            - pattern: request
            - pattern: request_get
            - pattern: request_head
            - pattern: request_post
            - pattern: send_request
            - pattern: trace
            - pattern: get_print
            - pattern: get_response
            - pattern: start
- id: ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
    category: security
    technology:
    - rails
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call
    shortlink: https://sg.run/4e8E
    semgrep.dev:
      rule:
        r_id: 13588
        rv_id: 1263625
        rule_id: KxU72k
        version_id: o5TbDq8
        url: https://semgrep.dev/playground/r/o5TbDq8/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call
        origin: community
  message: Using user input when accessing files is potentially dangerous. A malicious
    actor could use this to modify or access files they have no right to.
  languages:
  - ruby
  severity: ERROR
  mode: taint
  pattern-sources:
  - pattern-either:
    - pattern: params[...]
    - pattern: cookies
    - pattern: request.env
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: Kernel.$X(...)
      - patterns:
        - pattern-either:
          - pattern: Shell.$X(...)
          - patterns:
            - pattern-inside: |
                $SHELL = Shell.$ANY(...)
                ...
                $SHELL.$X(...)
            - pattern: $SHELL.$X(...)
    - metavariable-pattern:
        metavariable: $X
        patterns:
        - pattern-either:
          - pattern: cat
          - pattern: chdir
          - pattern: chroot
          - pattern: delete
          - pattern: entries
          - pattern: exec
          - pattern: foreach
          - pattern: glob
          - pattern: install
          - pattern: lchmod
          - pattern: lchown
          - pattern: link
          - pattern: load
          - pattern: load_file
          - pattern: makedirs
          - pattern: move
          - pattern: new
          - pattern: open
          - pattern: read
          - pattern: readlines
          - pattern: rename
          - pattern: rmdir
          - pattern: safe_unlink
          - pattern: symlink
          - pattern: syscopy
          - pattern: sysopen
          - pattern: system
          - pattern: truncate
          - pattern: unlink
- id: ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to
  metadata:
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_link_to.rb
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    references:
    - https://brakemanscanner.org/docs/warning_types/link_to/
    - https://brakemanscanner.org/docs/warning_types/link_to_href/
    category: security
    technology:
    - rails
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to
    shortlink: https://sg.run/JxXQ
    semgrep.dev:
      rule:
        r_id: 13590
        rv_id: 1263632
        rule_id: lBU8Qj
        version_id: 9lT4brj
        url: https://semgrep.dev/playground/r/9lT4brj/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to
        origin: community
  message: This code includes user input in `link_to`. In Rails 2.x, the body of `link_to`
    is not escaped. This means that user input which reaches the body will be executed
    when the HTML is rendered. Even in other versions, values starting with `javascript:`
    or `data:` are not escaped. It is better to create and use a safer function which
    checks the body argument.
  languages:
  - ruby
  severity: WARNING
  mode: taint
  pattern-sources:
  - pattern: params
  - pattern: cookies
  - pattern: request.env
  - pattern-either:
    - pattern: $MODEL.url(...)
    - pattern: $MODEL.uri(...)
    - pattern: $MODEL.link(...)
    - pattern: $MODEL.page(...)
    - pattern: $MODEL.site(...)
  pattern-sinks:
  - pattern: link_to(...)
  pattern-sanitizers:
  - patterns:
    - pattern: |
        "...#{...}..."
    - pattern-not: |
        "#{...}..."
- id: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
  metadata:
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    references:
    - https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/
    category: security
    technology:
    - rails
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
    shortlink: https://sg.run/GO2n
    semgrep.dev:
      rule:
        r_id: 13592
        rv_id: 1263635
        rule_id: 6JU1bL
        version_id: bZT53p0
        url: https://semgrep.dev/playground/r/bZT53p0/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
        origin: community
  message: Avoid rendering user input. It may be possible for a malicious user to
    input a path that lets them access a template they shouldn't. To prevent this,
    check dynamic template paths against a predefined allowlist to make sure it's
    an allowed template.
  languages:
  - ruby
  severity: WARNING
  mode: taint
  pattern-sources:
  - pattern: params
  - pattern: cookies
  - pattern: request.env
  pattern-sinks:
  - patterns:
    - pattern-inside: render($X => $INPUT, ...)
    - pattern: $INPUT
    - metavariable-pattern:
        metavariable: $X
        pattern-either:
        - pattern: action
        - pattern: template
        - pattern: partial
        - pattern: file
- id: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
  languages:
  - python
  severity: WARNING
  metadata:
    category: security
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-276: Incorrect Default Permissions'
    technology:
    - python
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authorization
    source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
    shortlink: https://sg.run/AXY4
    semgrep.dev:
      rule:
        r_id: 13594
        rv_id: 1263482
        rule_id: zdUYqR
        version_id: O9Tpxqr
        url: https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
        origin: community
  message: These permissions `$BITS` are widely permissive and grant access to more
    people than may be necessary. A good default is `0o644` which gives read and write
    access to yourself and read access to everyone else.
  patterns:
  - pattern-inside: os.$METHOD(...)
  - metavariable-pattern:
      metavariable: $METHOD
      patterns:
      - pattern-either:
        - pattern: chmod
        - pattern: lchmod
        - pattern: fchmod
  - pattern-either:
    - patterns:
      - pattern: os.$METHOD($FILE, $BITS, ...)
      - metavariable-comparison:
          metavariable: $BITS
          comparison: $BITS >= 0o650 and $BITS < 0o100000
    - patterns:
      - pattern: os.$METHOD($FILE, $BITS)
      - metavariable-comparison:
          metavariable: $BITS
          comparison: $BITS >= 0o100650
    - patterns:
      - pattern: os.$METHOD($FILE, $BITS, ...)
      - metavariable-pattern:
          metavariable: $BITS
          patterns:
          - pattern-either:
            - pattern: <... stat.S_IWGRP ...>
            - pattern: <... stat.S_IXGRP ...>
            - pattern: <... stat.S_IWOTH ...>
            - pattern: <... stat.S_IXOTH ...>
            - pattern: <... stat.S_IRWXO ...>
            - pattern: <... stat.S_IRWXG ...>
    - patterns:
      - pattern: os.$METHOD($FILE, $EXPR | $MOD, ...)
      - metavariable-comparison:
          metavariable: $MOD
          comparison: $MOD == 0o111
- id: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query
  languages:
  - php
  message: '`$QUERY` Detected string concatenation with a non-literal variable in
    a Doctrine QueryBuilder method. This could lead to SQL injection if the variable
    is user-controlled and not properly sanitized. In order to prevent SQL injection,
    use parameterized queries or prepared statements instead.'
  metadata:
    category: security
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection
    - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
    technology:
    - doctrine
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query
    shortlink: https://sg.run/jwDJ
    semgrep.dev:
      rule:
        r_id: 13965
        rv_id: 1263271
        rule_id: kxUw23
        version_id: 1QTypnG
        url: https://semgrep.dev/playground/r/1QTypnG/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query
        origin: community
  mode: taint
  pattern-sinks:
  - patterns:
    - focus-metavariable: $SINK
    - pattern-either:
      - pattern: $QUERY->add(...,$SINK,...)
      - pattern: $QUERY->select(...,$SINK,...)
      - pattern: $QUERY->addSelect(...,$SINK,...)
      - pattern: $QUERY->delete(...,$SINK,...)
      - pattern: $QUERY->update(...,$SINK,...)
      - pattern: $QUERY->insert(...,$SINK,...)
      - pattern: $QUERY->from(...,$SINK,...)
      - pattern: $QUERY->join(...,$SINK,...)
      - pattern: $QUERY->innerJoin(...,$SINK,...)
      - pattern: $QUERY->leftJoin(...,$SINK,...)
      - pattern: $QUERY->rightJoin(...,$SINK,...)
      - pattern: $QUERY->where(...,$SINK,...)
      - pattern: $QUERY->andWhere(...,$SINK,...)
      - pattern: $QUERY->orWhere(...,$SINK,...)
      - pattern: $QUERY->groupBy(...,$SINK,...)
      - pattern: $QUERY->addGroupBy(...,$SINK,...)
      - pattern: $QUERY->having(...,$SINK,...)
      - pattern: $QUERY->andHaving(...,$SINK,...)
      - pattern: $QUERY->orHaving(...,$SINK,...)
      - pattern: $QUERY->orderBy(...,$SINK,...)
      - pattern: $QUERY->addOrderBy(...,$SINK,...)
      - pattern: $QUERY->set($SINK,...)
      - pattern: $QUERY->setValue($SINK,...)
    - pattern-either:
      - pattern-inside: |
          $Q = $X->createQueryBuilder();
          ...
      - pattern-inside: |
          $Q = new QueryBuilder(...);
          ...
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: sprintf(...)
      - pattern: |
          "...".$SMTH
  severity: WARNING
- id: python.django.security.injection.raw-html-format.raw-html-format
  languages:
  - python
  severity: WARNING
  message: Detected user input flowing into a manually constructed HTML string. You
    may be accidentally bypassing secure methods of rendering HTML by manually constructing
    HTML and this could create a cross-site scripting vulnerability, which could let
    attackers steal sensitive user data. To be sure this is safe, check that the HTML
    is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which
    will safely render HTML instead.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - django
    references:
    - https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render
    - https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format
    shortlink: https://sg.run/oYj1
    semgrep.dev:
      rule:
        r_id: 14360
        rv_id: 1263397
        rule_id: 2ZUPER
        version_id: 5PTo100
        url: https://semgrep.dev/playground/r/5PTo100/python.django.security.injection.raw-html-format.raw-html-format
        origin: community
  mode: taint
  pattern-sanitizers:
  - pattern: django.utils.html.escape(...)
  pattern-sources:
  - patterns:
    - pattern: request.$ANYTHING
    - pattern-not: request.build_absolute_uri
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: '"$HTMLSTR" % ...'
          - pattern: '"$HTMLSTR".format(...)'
          - pattern: '"$HTMLSTR" + ...'
          - pattern: f"$HTMLSTR{...}..."
      - patterns:
        - pattern-inside: |
            $HTML = "$HTMLSTR"
            ...
        - pattern-either:
          - pattern: $HTML % ...
          - pattern: $HTML.format(...)
          - pattern: $HTML + ...
    - metavariable-pattern:
        metavariable: $HTMLSTR
        language: generic
        pattern: <$TAG ...
- id: python.flask.security.injection.raw-html-concat.raw-html-format
  languages:
  - python
  severity: WARNING
  message: Detected user input flowing into a manually constructed HTML string. You
    may be accidentally bypassing secure methods of rendering HTML by manually constructing
    HTML and this could create a cross-site scripting vulnerability, which could let
    attackers steal sensitive user data. To be sure this is safe, check that the HTML
    is rendered safely. Otherwise, use templates (`flask.render_template`) which will
    safely render HTML instead.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - flask
    references:
    - https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format
    shortlink: https://sg.run/Pb7e
    semgrep.dev:
      rule:
        r_id: 14389
        rv_id: 1409401
        rule_id: GdUrJv
        version_id: RGTEN1l
        url: https://semgrep.dev/playground/r/RGTEN1l/python.flask.security.injection.raw-html-concat.raw-html-format
        origin: community
  mode: taint
  pattern-sanitizers:
  - pattern: jinja2.escape(...)
  - pattern: flask.escape(...)
  - patterns:
    - pattern: flask.render_template($TPL, ...)
    - metavariable-regex:
        metavariable: $TPL
        regex: .*\.html
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: flask.request.$ANYTHING
      - patterns:
        - pattern-inside: |
            @$APP.route(...)
            def $FUNC(..., $ROUTEVAR, ...):
              ...
        - pattern: $ROUTEVAR
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: '"$HTMLSTR" % ...'
          - pattern: '"$HTMLSTR".format(...)'
          - pattern: '"$HTMLSTR" + ...'
          - pattern: f"$HTMLSTR{...}..."
      - patterns:
        - pattern-inside: |
            $HTML = "$HTMLSTR"
            ...
        - pattern-either:
          - pattern: $HTML % ...
          - pattern: $HTML.format(...)
          - pattern: $HTML + ...
    - metavariable-pattern:
        metavariable: $HTMLSTR
        language: generic
        pattern: <$TAG ...
- id: go.lang.security.injection.tainted-url-host.tainted-url-host
  languages:
  - go
  message: A request was found to be crafted from user-input `$REQUEST`. This can
    lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing
    sensitive data. It is recommend where possible to not allow user-input to craft
    the base request, but to be treated as part of the path or query parameter. When
    user-input is necessary to craft the request, it is recommended to follow OWASP
    best practices to prevent abuse, including using an allowlist.
  options:
    interfile: true
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    references:
    - https://goteleport.com/blog/ssrf-attacks/
    category: security
    technology:
    - go
    confidence: HIGH
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host
    shortlink: https://sg.run/5DjW
    semgrep.dev:
      rule:
        r_id: 14391
        rv_id: 1262970
        rule_id: AbUQLr
        version_id: yeTxpOj
        url: https://semgrep.dev/playground/r/yeTxpOj/go.lang.security.injection.tainted-url-host.tainted-url-host
        origin: community
  mode: taint
  pattern-sources:
  - label: INPUT
    patterns:
    - pattern-either:
      - pattern: |
          ($REQUEST : *http.Request).$ANYTHING
      - pattern: |
          ($REQUEST : http.Request).$ANYTHING
    - metavariable-regex:
        metavariable: $ANYTHING
        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
  - label: CLEAN
    requires: INPUT
    patterns:
    - pattern-either:
      - pattern: |
          "$URLSTR" + $INPUT
      - patterns:
        - pattern-either:
          - pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...)
          - pattern: fmt.Sprintf("$URLSTR", $INPUT, ...)
          - pattern: fmt.Printf("$URLSTR", $INPUT, ...)
    - metavariable-regex:
        metavariable: $URLSTR
        regex: .*//[a-zA-Z0-10]+\..*
  pattern-sinks:
  - requires: INPUT and not CLEAN
    patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - patterns:
            - pattern-inside: |
                $CLIENT := &http.Client{...}
                ...
            - pattern: $CLIENT.$METHOD($URL, ...)
          - pattern: http.$METHOD($URL, ...)
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(Get|Head|Post|PostForm)$
      - patterns:
        - pattern: |
            http.NewRequest("$METHOD", $URL, ...)
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(GET|HEAD|POST|POSTFORM)$
    - focus-metavariable: $URL
  severity: WARNING
- id: go.lang.security.injection.raw-html-format.raw-html-format
  languages:
  - go
  severity: WARNING
  message: Detected user input flowing into a manually constructed HTML string. You
    may be accidentally bypassing secure methods of rendering HTML by manually constructing
    HTML and this could create a cross-site scripting vulnerability, which could let
    attackers steal sensitive user data. Use the `html/template` package which will
    safely render HTML instead, or inspect that the HTML is rendered safely.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - go
    references:
    - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format
    shortlink: https://sg.run/3r1G
    semgrep.dev:
      rule:
        r_id: 14443
        rv_id: 1262968
        rule_id: PeUonQ
        version_id: 1QTyp2p
        url: https://semgrep.dev/playground/r/1QTyp2p/go.lang.security.injection.raw-html-format.raw-html-format
        origin: community
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          ($REQUEST : *http.Request).$ANYTHING
      - pattern: |
          ($REQUEST : http.Request).$ANYTHING
    - metavariable-regex:
        metavariable: $ANYTHING
        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
  pattern-sanitizers:
  - pattern: html.EscapeString(...)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: fmt.Printf("$HTMLSTR", ...)
      - pattern: fmt.Sprintf("$HTMLSTR", ...)
      - pattern: fmt.Fprintf($W, "$HTMLSTR", ...)
      - pattern: '"$HTMLSTR" + ...'
    - metavariable-pattern:
        metavariable: $HTMLSTR
        language: generic
        pattern: <$TAG ...
- id: ruby.rails.security.injection.raw-html-format.raw-html-format
  languages:
  - ruby
  severity: WARNING
  message: Detected user input flowing into a manually constructed HTML string. You
    may be accidentally bypassing secure methods of rendering HTML by manually constructing
    HTML and this could create a cross-site scripting vulnerability, which could let
    attackers steal sensitive user data. Use the `render template` and make template
    files which will safely render HTML instead, or inspect that the HTML is absolutely
    rendered safely with a function like `sanitize`.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - rails
    references:
    - https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/
    - https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format
    shortlink: https://sg.run/b2JQ
    semgrep.dev:
      rule:
        r_id: 14470
        rv_id: 1409408
        rule_id: kxUwZX
        version_id: qkTvgYY
        url: https://semgrep.dev/playground/r/qkTvgYY/ruby.rails.security.injection.raw-html-format.raw-html-format
        origin: community
  mode: taint
  pattern-sanitizers:
  - pattern-either:
    - pattern: sanitize(...)
    - pattern: strip_tags(...)
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: params
      - pattern: request
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: |
            $HTMLSTR
        - pattern-regex: <\w+.*
      - patterns:
        - pattern-either:
          - pattern: Kernel::sprintf("$HTMLSTR", ...)
          - pattern: |
              "$HTMLSTR" + $EXPR
          - pattern: |
              "$HTMLSTR" % $EXPR
        - metavariable-pattern:
            metavariable: $HTMLSTR
            language: generic
            pattern: <$TAG ...
- id: python.flask.security.injection.tainted-url-host.tainted-url-host
  languages:
  - python
  message: User data flows into the host portion of this manually-constructed URL.
    This could allow an attacker to send data to their own server, potentially exposing
    sensitive data such as cookies or authorization information sent with this request.
    They could also probe internal servers or other resources that the server running
    this code can access. (This is called server-side request forgery, or SSRF.) Do
    not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or
    hardcode the correct host.
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host
    shortlink: https://sg.run/RXpK
    semgrep.dev:
      rule:
        r_id: 14649
        rv_id: 1409403
        rule_id: ReU3Wb
        version_id: BjTy42w
        url: https://semgrep.dev/playground/r/BjTy42w/python.flask.security.injection.tainted-url-host.tainted-url-host
        origin: community
  mode: taint
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: '"$URLSTR" % ...'
        - metavariable-pattern:
            metavariable: $URLSTR
            language: generic
            patterns:
            - pattern-either:
              - pattern: $SCHEME://%s
              - pattern: $SCHEME://%r
      - patterns:
        - pattern: '"$URLSTR".format(...)'
        - metavariable-pattern:
            metavariable: $URLSTR
            language: generic
            pattern: $SCHEME:// { ... }
      - patterns:
        - pattern: '"$URLSTR" + ...'
        - metavariable-regex:
            metavariable: $URLSTR
            regex: .*://$
      - patterns:
        - pattern: f"$URLSTR{...}..."
        - metavariable-regex:
            metavariable: $URLSTR
            regex: .*://$
      - patterns:
        - pattern-inside: |
            $URL = "$URLSTR"
            ...
        - pattern: $URL += ...
        - metavariable-regex:
            metavariable: $URLSTR
            regex: .*://$
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: flask.request.$ANYTHING
      - patterns:
        - pattern-inside: |
            @$APP.route(...)
            def $FUNC(..., $ROUTEVAR, ...):
              ...
        - pattern: $ROUTEVAR
  severity: WARNING
- id: go.lang.security.injection.tainted-sql-string.tainted-sql-string
  languages:
  - go
  message: User data flows into this manually-constructed SQL string. User data can
    be safely inserted into SQL strings using prepared statements or an object-relational
    mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
    injection, which could let an attacker steal or manipulate data from the database.
    Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`)
    or a safe library.
  options:
    interfile: true
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://golang.org/doc/database/sql-injection
    - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/
    category: security
    technology:
    - go
    confidence: HIGH
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string
    shortlink: https://sg.run/PbEq
    semgrep.dev:
      rule:
        r_id: 14689
        rv_id: 1409388
        rule_id: PeUoqy
        version_id: nWTQ5qD
        url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string
        origin: community
  mode: taint
  severity: ERROR
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          ($REQUEST : *http.Request).$ANYTHING
      - pattern: |
          ($REQUEST : http.Request).$ANYTHING
    - metavariable-regex:
        metavariable: $ANYTHING
        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: |
              "$SQLSTR" + ...
          - patterns:
            - pattern-inside: |
                $VAR = "$SQLSTR";
                ...
            - pattern: $VAR += ...
          - patterns:
            - pattern-inside: |
                var $SB strings.Builder
                ...
            - pattern-inside: |
                $SB.WriteString("$SQLSTR")
                ...
                $SB.String(...)
            - pattern: |
                $SB.WriteString(...)
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: (?i)(select|delete|insert|create|update|alter|drop).*
      - patterns:
        - pattern-either:
          - pattern: fmt.Fprintf($F, "$SQLSTR", ...)
          - pattern: fmt.Sprintf("$SQLSTR", ...)
          - pattern: fmt.Printf("$SQLSTR", ...)
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).*
  pattern-sanitizers:
  - pattern-either:
    - pattern: strconv.Atoi(...)
    - pattern: |
        ($X: bool)
- id: javascript.express.security.injection.raw-html-format.raw-html-format
  message: User data flows into the host portion of this manually-constructed HTML.
    This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from
    user-provided input. Consider using a sanitization library such as DOMPurify to
    sanitize the HTML within.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - express
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format
    shortlink: https://sg.run/5DO3
    semgrep.dev:
      rule:
        r_id: 14691
        rv_id: 1263175
        rule_id: 5rUL0X
        version_id: NdTzyQv
        url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - label: EXPRESS
    patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
  - label: EXPRESSTS
    patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
  - label: CLEAN
    by-side-effect: true
    patterns:
    - pattern-either:
      - pattern: $A($SOURCE)
      - pattern: $SANITIZE. ... .$A($SOURCE)
      - pattern: $A. ... .$SANITIZE($SOURCE)
    - focus-metavariable: $SOURCE
    - metavariable-regex:
        metavariable: $A
        regex: (?i)(.*valid|.*sanitiz)
  pattern-sinks:
  - requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN)
    patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: '"$HTMLSTR" + $EXPR'
          - pattern: '"$HTMLSTR".concat(...)'
          - pattern: util.format($HTMLSTR, ...)
        - metavariable-pattern:
            metavariable: $HTMLSTR
            language: generic
            pattern: <$TAG ...
      - patterns:
        - pattern: |
            `...`
        - pattern-regex: |
            .*<\w+.*
- id: ruby.rails.security.injection.tainted-url-host.tainted-url-host
  languages:
  - ruby
  severity: WARNING
  message: User data flows into the host portion of this manually-constructed URL.
    This could allow an attacker to send data to their own server, potentially exposing
    sensitive data such as cookies or authorization information sent with this request.
    They could also probe internal servers or other resources that the server running
    this code can access. (This is called server-side request forgery, or SSRF.) Do
    not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction
    with `SsrfFilter(...)`, or create an allowlist for approved hosts.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - rails
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
    - https://github.com/arkadiyt/ssrf_filter
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host
    shortlink: https://sg.run/RX3g
    semgrep.dev:
      rule:
        r_id: 14705
        rv_id: 1263668
        rule_id: zdUY0W
        version_id: 6xT29BN
        url: https://semgrep.dev/playground/r/6xT29BN/ruby.rails.security.injection.tainted-url-host.tainted-url-host
        origin: community
  mode: taint
  pattern-sanitizers:
  - pattern: SsrfFilter
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: params
      - pattern: request
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: |
            $URLSTR
        - pattern-regex: \w+:\/\/#{.*}
      - patterns:
        - pattern-either:
          - pattern: Kernel::sprintf("$URLSTR", ...)
          - pattern: |
              "$URLSTR" + $EXPR
          - pattern: |
              "$URLSTR" % $EXPR
        - metavariable-pattern:
            metavariable: $URLSTR
            language: generic
            pattern: $SCHEME:// ...
- id: ruby.rails.security.injection.tainted-sql-string.tainted-sql-string
  languages:
  - ruby
  severity: ERROR
  message: Detected user input used to manually construct a SQL string. This is usually
    bad practice because manual construction could accidentally result in a SQL injection.
    An attacker could use a SQL injection to steal or modify contents of the database.
    Instead, use a parameterized query which is available by default in most database
    engines. Alternatively, consider using an object-relational mapper (ORM) such
    as ActiveRecord which will protect your queries.
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - rails
    references:
    - https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string
    shortlink: https://sg.run/Y85o
    semgrep.dev:
      rule:
        r_id: 14714
        rv_id: 1263667
        rule_id: bwU8gl
        version_id: YDTZeLL
        url: https://semgrep.dev/playground/r/YDTZeLL/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string
        origin: community
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: params
      - pattern: request
  pattern-sanitizers:
  - pattern: |
      $PARAMS.slice(...)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - patterns:
            - pattern: |
                $RECORD.where($X,...)
          - pattern: |
              $RECORD.find(..., :conditions => $X,...)
        - focus-metavariable: $X
      - patterns:
        - pattern: |
            "$SQLVERB#{$EXPR}..."
        - pattern-not-inside: |
            $FUNC("...",  "...#{$EXPR}...",...)
        - focus-metavariable: $SQLVERB
        - pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b
      - patterns:
        - pattern-either:
          - pattern: Kernel::sprintf("$SQLSTR", $EXPR)
          - pattern: |
              "$SQLSTR" + $EXPR
          - pattern: |
              "$SQLSTR" % $EXPR
        - pattern-not-inside: |
            $FUNC("...",  "...#{$EXPR}...",...)
        - focus-metavariable: $EXPR
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- id: php.lang.security.injection.tainted-sql-string.tainted-sql-string
  languages:
  - php
  severity: ERROR
  message: User data flows into this manually-constructed SQL string. User data can
    be safely inserted into SQL strings using prepared statements or an object-relational
    mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
    injection, which could let an attacker steal or manipulate data from the database.
    Instead, use prepared statements (`$mysqli->prepare("INSERT INTO test(id, label)
    VALUES (?, ?)");`) or a safe library.
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/www-community/attacks/SQL_Injection
    category: security
    technology:
    - php
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string
    shortlink: https://sg.run/lZYG
    semgrep.dev:
      rule:
        r_id: 14757
        rv_id: 1263290
        rule_id: qNUXdL
        version_id: gETB7vY
        url: https://semgrep.dev/playground/r/gETB7vY/php.lang.security.injection.tainted-sql-string.tainted-sql-string
        origin: community
  mode: taint
  pattern-sanitizers:
  - pattern-either:
    - pattern: mysqli_real_escape_string(...)
    - pattern: real_escape_string(...)
    - pattern: $MYSQLI->real_escape_string(...)
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: $_GET
      - pattern: $_POST
      - pattern: $_COOKIE
      - pattern: $_REQUEST
  pattern-sinks:
  - pattern-either:
    - patterns:
      - pattern: |
          sprintf($SQLSTR, ...)
      - metavariable-regex:
          metavariable: $SQLSTR
          regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.*
    - patterns:
      - pattern: |
          "...$EXPR..."
      - metavariable-regex:
          metavariable: $EXPR
          regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.*
    - patterns:
      - pattern: |
          "$SQLSTR".$EXPR
      - metavariable-regex:
          metavariable: $SQLSTR
          regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.*
- id: php.lang.security.injection.tainted-url-host.tainted-url-host
  languages:
  - php
  severity: WARNING
  message: User data flows into the host portion of this manually-constructed URL.
    This could allow an attacker to send data to their own server, potentially exposing
    sensitive data such as cookies or authorization information sent with this request.
    They could also probe internal servers or other resources that the server running
    this code can access. (This is called server-side request forgery, or SSRF.) Do
    not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or
    hardcode the correct host.
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - php
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host
    shortlink: https://sg.run/Y8no
    semgrep.dev:
      rule:
        r_id: 14758
        rv_id: 1263291
        rule_id: lBU8K1
        version_id: QkTGqRd
        url: https://semgrep.dev/playground/r/QkTGqRd/php.lang.security.injection.tainted-url-host.tainted-url-host
        origin: community
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: $_GET
      - pattern: $_POST
      - pattern: $_COOKIE
      - pattern: $_REQUEST
  pattern-sinks:
  - pattern-either:
    - patterns:
      - pattern: |
          sprintf($URLSTR, ...)
      - metavariable-pattern:
          metavariable: $URLSTR
          language: generic
          pattern: $SCHEME://%s
    - patterns:
      - pattern: |
          "...{$EXPR}..."
      - pattern-regex: |
          .*://\{.*
    - patterns:
      - pattern: |
          "...$EXPR..."
      - pattern-regex: |
          .*://\$.*
    - patterns:
      - pattern: |
          "...".$EXPR
      - pattern-regex: |
          .*://["'].*
- id: java.spring.security.injection.tainted-sql-string.tainted-sql-string
  languages:
  - java
  severity: ERROR
  message: User data flows into this manually-constructed SQL string. User data can
    be safely inserted into SQL strings using prepared statements or an object-relational
    mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
    injection, which could let an attacker steal or manipulate data from the database.
    Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html
    category: security
    technology:
    - spring
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string
    shortlink: https://sg.run/9rzz
    semgrep.dev:
      rule:
        r_id: 14767
        rv_id: 1409396
        rule_id: 10UdRR
        version_id: 44TbKvr
        url: https://semgrep.dev/playground/r/44TbKvr/java.spring.security.injection.tainted-sql-string.tainted-sql-string
        origin: community
  options:
    taint_assume_safe_numbers: true
    taint_assume_safe_booleans: true
    interfile: true
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
            ...
          }
      - pattern-inside: |
          $METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
            ...
          }
    - metavariable-regex:
        metavariable: $REQ
        regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue)
    - metavariable-regex:
        metavariable: $TYPE
        regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
    - focus-metavariable: $SOURCE
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          "$SQLSTR" + ...
      - pattern: |
          "$SQLSTR".concat(...)
      - patterns:
        - pattern-inside: |
            StringBuilder $SB = new StringBuilder("$SQLSTR");
            ...
        - pattern: $SB.append(...)
      - patterns:
        - pattern-inside: |
            $VAR = "$SQLSTR";
            ...
        - pattern: $VAR += ...
      - pattern: String.format("$SQLSTR", ...)
      - patterns:
        - pattern-inside: |
            String $VAR = "$SQLSTR";
            ...
        - pattern: String.format($VAR, ...)
    - pattern-not-inside: System.out.println(...)
    - pattern-not-inside: $LOG.info(...)
    - pattern-not-inside: $LOG.warn(...)
    - pattern-not-inside: $LOG.warning(...)
    - pattern-not-inside: $LOG.debug(...)
    - pattern-not-inside: $LOG.debugging(...)
    - pattern-not-inside: $LOG.error(...)
    - pattern-not-inside: new Exception(...)
    - pattern-not-inside: throw ...;
    - metavariable-regex:
        metavariable: $SQLSTR
        regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- id: csharp.lang.security.sqli.csharp-sqli.csharp-sqli
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: |
        (string $X)
    - pattern-not: |
        "..."
  pattern-propagators:
  - pattern: (StringBuilder $B).$ANY(...,(string $X),...)
    from: $X
    to: $B
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: |
            new $PATTERN($CMD,...)
        - focus-metavariable: $CMD
      - patterns:
        - pattern: |
            $CMD.$PATTERN = $VALUE;
        - focus-metavariable: $VALUE
    - metavariable-regex:
        metavariable: $PATTERN
        regex: ^(SqlCommand|CommandText|OleDbCommand|OdbcCommand|OracleCommand)$
  pattern-sanitizers:
  - pattern-either:
    - pattern: |
        $CMD.Parameters.Add(...)
    - pattern: |
        $CMD.Parameters.AddRange(...)
    - pattern: |
        $CMD.Parameters.AddWithValue(...)
    - pattern: |
        $CMD.Parameters[$IDX].Value = ...
    by-side-effect: true
  message: Detected a formatted string in a SQL statement. This could lead to SQL
    injection if variables in the SQL statement are not properly sanitized. Use a
    prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand'
    and 'SqlParameter'.
  metadata:
    category: security
    technology:
    - csharp
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    confidence: MEDIUM
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli
    shortlink: https://sg.run/d2Xd
    semgrep.dev:
      rule:
        r_id: 15078
        rv_id: 1262648
        rule_id: x8UxeP
        version_id: RGT0LqW
        url: https://semgrep.dev/playground/r/RGT0LqW/csharp.lang.security.sqli.csharp-sqli.csharp-sqli
        origin: community
  languages:
  - csharp
  severity: ERROR
- id: terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled
  message: Enabling authentication ensures that all communications in the application
    are authenticated. The `auth_settings` block needs to be filled out with the appropriate
    auth backend settings
  patterns:
  - pattern: resource
  - pattern-not-inside: |
      resource "azurerm_app_service" "..." {
      ...
        auth_settings {
          ...
          enabled = true
          ...
        }
      ...
      }
  - pattern-either:
    - pattern-inside: |
        resource "azurerm_app_service" "..." {
        ...
        }
    - pattern-inside: |
        resource "azurerm_app_service" "..." {
        ...
          auth_settings {
            ...
            enabled = false
            ...
          }
        ...
        }
  metadata:
    cwe:
    - 'CWE-287: Improper Authentication'
    category: security
    technology:
    - terraform
    - azure
    references:
    - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings
    owasp:
    - A02:2017 - Broken Authentication
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled
    shortlink: https://sg.run/JxYw
    semgrep.dev:
      rule:
        r_id: 15102
        rv_id: 1263755
        rule_id: 0oU23p
        version_id: PkTR3P8
        url: https://semgrep.dev/playground/r/PkTR3P8/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled
        origin: community
  languages:
  - hcl
  severity: ERROR
- id: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind
  metadata:
    cwe:
    - 'CWE-287: Improper Authentication'
    owasp:
    - A02:2017 - Broken Authentication
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS
    category: security
    technology:
    - kotlin
    references:
    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind
    shortlink: https://sg.run/rY2n
    semgrep.dev:
      rule:
        r_id: 15125
        rv_id: 1263258
        rule_id: v8U9Q7
        version_id: WrTqKgJ
        url: https://semgrep.dev/playground/r/WrTqKgJ/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind
        origin: community
  message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP
    statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html
    for more information.
  severity: WARNING
  pattern: |
    $ENV.put($CTX.SECURITY_AUTHENTICATION, "none")
    ...
    $DCTX = InitialDirContext($ENV, ...)
  languages:
  - kt
- id: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod
  message: Using the GrantPublicAccess method on bucket contruct $X will make the
    objects in the bucket world accessible. Verify if this is intentional.
  metadata:
    cwe:
    - 'CWE-306: Missing Authentication for Critical Function'
    category: security
    technology:
    - AWS-CDK
    references:
    - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod
    shortlink: https://sg.run/Z4p7
    semgrep.dev:
      rule:
        r_id: 15279
        rv_id: 1263906
        rule_id: wdUjZK
        version_id: BjTkZA7
        url: https://semgrep.dev/playground/r/BjTkZA7/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod
        origin: community
  languages:
  - ts
  severity: WARNING
  pattern-either:
  - patterns:
    - pattern-inside: |
        import {Bucket} from '@aws-cdk/aws-s3'
        ...
    - pattern: |
        const $X = new Bucket(...)
        ...
        $X.grantPublicAccess(...)
  - patterns:
    - pattern-inside: |
        import * as $Y from '@aws-cdk/aws-s3'
        ...
    - pattern: |
        const $X = new $Y.Bucket(...)
        ...
        $X.grantPublicAccess(...)
- id: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public
  message: CodeBuild Project $X is set to have a public URL. This will make the build
    results, logs, artifacts publically accessible, including builds prior to the
    project being public. Ensure this is acceptable for the project.
  metadata:
    category: security
    cwe:
    - 'CWE-306: Missing Authentication for Critical Function'
    technology:
    - AWS-CDK
    references:
    - https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public
    shortlink: https://sg.run/nK7G
    semgrep.dev:
      rule:
        r_id: 15280
        rv_id: 1263907
        rule_id: x8UxXZ
        version_id: DkTRbj1
        url: https://semgrep.dev/playground/r/DkTRbj1/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public
        origin: community
  languages:
  - ts
  severity: WARNING
  pattern-either:
  - patterns:
    - pattern-inside: |
        import {Project} from '@aws-cdk/aws-codebuild'
        ...
    - pattern: |
        const $X = new Project(..., {..., badge: true, ...})
  - patterns:
    - pattern-inside: |
        import * as $Y from '@aws-cdk/aws-codebuild'
        ...
    - pattern: |
        const $X = new $Y.Project(..., {..., badge: true, ...})
- id: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text
  mode: taint
  pattern-sinks:
  - pattern: |
      sqlalchemy.text(...)
  pattern-sources:
  - patterns:
    - pattern: |
        $X + $Y
    - metavariable-type:
        metavariable: $X
        type: string
  - patterns:
    - pattern: |
        $X + $Y
    - metavariable-type:
        metavariable: $Y
        type: string
  - patterns:
    - pattern: |
        f"..."
  - patterns:
    - pattern: |
        $X.format(...)
    - metavariable-type:
        metavariable: $X
        type: string
  - patterns:
    - pattern: |
        $X % $Y
    - metavariable-type:
        metavariable: $X
        type: string
  message: sqlalchemy.text passes the constructed SQL statement to the database mostly
    unchanged. This means that the usual SQL injection protections are not applied
    and this function is vulnerable to SQL injection if user input can reach here.
    Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct
    SQL.
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    category: security
    technology:
    - sqlalchemy
    confidence: MEDIUM
    references:
    - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text
    shortlink: https://sg.run/yP1O
    semgrep.dev:
      rule:
        r_id: 15824
        rv_id: 1263577
        rule_id: r6U2wE
        version_id: rxTAKqq
        url: https://semgrep.dev/playground/r/rxTAKqq/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text
        origin: community
  languages:
  - python
  severity: ERROR
- id: generic.ci.security.bash-reverse-shell.bash_reverse_shell
  metadata:
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    category: security
    technology:
    - ci
    confidence: HIGH
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell
    shortlink: https://sg.run/4l9l
    semgrep.dev:
      rule:
        r_id: 16200
        rv_id: 1262664
        rule_id: gxUJrJ
        version_id: jQTn5QE
        url: https://semgrep.dev/playground/r/jQTn5QE/generic.ci.security.bash-reverse-shell.bash_reverse_shell
        origin: community
  message: Semgrep found a bash reverse shell
  severity: ERROR
  languages:
  - generic
  pattern-either:
  - pattern: |
      sh -i >& /dev/udp/.../... 0>&1
  - pattern: |
      <...>/dev/tcp/.../...; sh <&... >&... 2>&
  - pattern: |
      <...>/dev/tcp/.../...; cat <&... | while read line; do $line 2>&... >&...;done
  - pattern: |
      sh -i ...<...> /dev/tcp/.../... ...<&... 1>&... 2>&
- id: php.lang.security.injection.tainted-filename.tainted-filename
  severity: WARNING
  message: File name based on user input risks server-side request forgery.
  metadata:
    technology:
    - php
    category: security
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    references:
    - https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename
    shortlink: https://sg.run/Ayqp
    semgrep.dev:
      rule:
        r_id: 16250
        rv_id: 1263287
        rule_id: 5rUpro
        version_id: 7ZTE3J1
        url: https://semgrep.dev/playground/r/7ZTE3J1/php.lang.security.injection.tainted-filename.tainted-filename
        origin: community
  languages:
  - php
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: $_GET
      - pattern: $_POST
      - pattern: $_COOKIE
      - pattern: $_REQUEST
      - pattern: $_SERVER
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern-inside: basename($PATH, ...)
      - pattern-inside: linkinfo($PATH, ...)
      - pattern-inside: readlink($PATH, ...)
      - pattern-inside: realpath($PATH, ...)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: opcache_compile_file($FILENAME, ...)
      - pattern-inside: opcache_invalidate($FILENAME, ...)
      - pattern-inside: opcache_is_script_cached($FILENAME, ...)
      - pattern-inside: runkit7_import($FILENAME, ...)
      - pattern-inside: readline_read_history($FILENAME, ...)
      - pattern-inside: readline_write_history($FILENAME, ...)
      - pattern-inside: rar_open($FILENAME, ...)
      - pattern-inside: zip_open($FILENAME, ...)
      - pattern-inside: gzfile($FILENAME, ...)
      - pattern-inside: gzopen($FILENAME, ...)
      - pattern-inside: readgzfile($FILENAME, ...)
      - pattern-inside: hash_file($ALGO, $FILENAME, ...)
      - pattern-inside: hash_update_file($CONTEXT, $FILENAME, ...)
      - pattern-inside: pg_trace($FILENAME, ...)
      - pattern-inside: dio_open($FILENAME, ...)
      - pattern-inside: finfo_file($FINFO, $FILENAME, ...)
      - pattern-inside: mime_content_type($FILENAME, ...)
      - pattern-inside: chgrp($FILENAME, ...)
      - pattern-inside: chmod($FILENAME, ...)
      - pattern-inside: chown($FILENAME, ...)
      - pattern-inside: clearstatcache($CLEAR_REALPATH_CACHE, $FILENAME, ...)
      - pattern-inside: file_exists($FILENAME, ...)
      - pattern-inside: file_get_contents($FILENAME, ...)
      - pattern-inside: file_put_contents($FILENAME, ...)
      - pattern-inside: file($FILENAME, ...)
      - pattern-inside: fileatime($FILENAME, ...)
      - pattern-inside: filectime($FILENAME, ...)
      - pattern-inside: filegroup($FILENAME, ...)
      - pattern-inside: fileinode($FILENAME, ...)
      - pattern-inside: filemtime($FILENAME, ...)
      - pattern-inside: fileowner($FILENAME, ...)
      - pattern-inside: fileperms($FILENAME, ...)
      - pattern-inside: filesize($FILENAME, ...)
      - pattern-inside: filetype($FILENAME, ...)
      - pattern-inside: fnmatch($PATTERN, $FILENAME, ...)
      - pattern-inside: fopen($FILENAME, ...)
      - pattern-inside: is_dir($FILENAME, ...)
      - pattern-inside: is_executable($FILENAME, ...)
      - pattern-inside: is_file($FILENAME, ...)
      - pattern-inside: is_link($FILENAME, ...)
      - pattern-inside: is_readable($FILENAME, ...)
      - pattern-inside: is_uploaded_file($FILENAME, ...)
      - pattern-inside: is_writable($FILENAME, ...)
      - pattern-inside: lchgrp($FILENAME, ...)
      - pattern-inside: lchown($FILENAME, ...)
      - pattern-inside: lstat($FILENAME, ...)
      - pattern-inside: parse_ini_file($FILENAME, ...)
      - pattern-inside: readfile($FILENAME, ...)
      - pattern-inside: stat($FILENAME, ...)
      - pattern-inside: touch($FILENAME, ...)
      - pattern-inside: unlink($FILENAME, ...)
      - pattern-inside: xattr_get($FILENAME, ...)
      - pattern-inside: xattr_list($FILENAME, ...)
      - pattern-inside: xattr_remove($FILENAME, ...)
      - pattern-inside: xattr_set($FILENAME, ...)
      - pattern-inside: xattr_supported($FILENAME, ...)
      - pattern-inside: enchant_broker_request_pwl_dict($BROKER, $FILENAME, ...)
      - pattern-inside: pspell_config_personal($CONFIG, $FILENAME, ...)
      - pattern-inside: pspell_config_repl($CONFIG, $FILENAME, ...)
      - pattern-inside: pspell_new_personal($FILENAME, ...)
      - pattern-inside: exif_imagetype($FILENAME, ...)
      - pattern-inside: getimagesize($FILENAME, ...)
      - pattern-inside: image2wbmp($IMAGE, $FILENAME, ...)
      - pattern-inside: imagecreatefromavif($FILENAME, ...)
      - pattern-inside: imagecreatefrombmp($FILENAME, ...)
      - pattern-inside: imagecreatefromgd2($FILENAME, ...)
      - pattern-inside: imagecreatefromgd2part($FILENAME, ...)
      - pattern-inside: imagecreatefromgd($FILENAME, ...)
      - pattern-inside: imagecreatefromgif($FILENAME, ...)
      - pattern-inside: imagecreatefromjpeg($FILENAME, ...)
      - pattern-inside: imagecreatefrompng($FILENAME, ...)
      - pattern-inside: imagecreatefromtga($FILENAME, ...)
      - pattern-inside: imagecreatefromwbmp($FILENAME, ...)
      - pattern-inside: imagecreatefromwebp($FILENAME, ...)
      - pattern-inside: imagecreatefromxbm($FILENAME, ...)
      - pattern-inside: imagecreatefromxpm($FILENAME, ...)
      - pattern-inside: imageloadfont($FILENAME, ...)
      - pattern-inside: imagexbm($IMAGE, $FILENAME, ...)
      - pattern-inside: iptcembed($IPTC_DATA, $FILENAME, ...)
      - pattern-inside: mailparse_msg_extract_part_file($MIMEMAIL, $FILENAME, ...)
      - pattern-inside: mailparse_msg_extract_whole_part_file($MIMEMAIL, $FILENAME,
          ...)
      - pattern-inside: mailparse_msg_parse_file($FILENAME, ...)
      - pattern-inside: fdf_add_template($FDF_DOCUMENT, $NEWPAGE, $FILENAME, ...)
      - pattern-inside: fdf_get_ap($FDF_DOCUMENT, $FIELD, $FACE, $FILENAME, ...)
      - pattern-inside: fdf_open($FILENAME, ...)
      - pattern-inside: fdf_save($FDF_DOCUMENT, $FILENAME, ...)
      - pattern-inside: fdf_set_ap($FDF_DOCUMENT, $FIELD_NAME, $FACE, $FILENAME, ...)
      - pattern-inside: ps_add_launchlink($PSDOC, $LLX, $LLY, $URX, $URY, $FILENAME,
          ...)
      - pattern-inside: ps_add_pdflink($PSDOC, $LLX, $LLY, $URX, $URY, $FILENAME,
          ...)
      - pattern-inside: ps_open_file($PSDOC, $FILENAME, ...)
      - pattern-inside: ps_open_image_file($PSDOC, $TYPE, $FILENAME, ...)
      - pattern-inside: posix_access($FILENAME, ...)
      - pattern-inside: posix_mkfifo($FILENAME, ...)
      - pattern-inside: posix_mknod($FILENAME, ...)
      - pattern-inside: ftok($FILENAME, ...)
      - pattern-inside: fann_cascadetrain_on_file($ANN, $FILENAME, ...)
      - pattern-inside: fann_read_train_from_file($FILENAME, ...)
      - pattern-inside: fann_train_on_file($ANN, $FILENAME, ...)
      - pattern-inside: highlight_file($FILENAME, ...)
      - pattern-inside: php_strip_whitespace($FILENAME, ...)
      - pattern-inside: stream_resolve_include_path($FILENAME, ...)
      - pattern-inside: swoole_async_read($FILENAME, ...)
      - pattern-inside: swoole_async_readfile($FILENAME, ...)
      - pattern-inside: swoole_async_write($FILENAME, ...)
      - pattern-inside: swoole_async_writefile($FILENAME, ...)
      - pattern-inside: swoole_load_module($FILENAME, ...)
      - pattern-inside: tidy_parse_file($FILENAME, ...)
      - pattern-inside: tidy_repair_file($FILENAME, ...)
      - pattern-inside: get_meta_tags($FILENAME, ...)
      - pattern-inside: yaml_emit_file($FILENAME, ...)
      - pattern-inside: yaml_parse_file($FILENAME, ...)
      - pattern-inside: curl_file_create($FILENAME, ...)
      - pattern-inside: ftp_chmod($FTP, $PERMISSIONS, $FILENAME, ...)
      - pattern-inside: ftp_delete($FTP, $FILENAME, ...)
      - pattern-inside: ftp_mdtm($FTP, $FILENAME, ...)
      - pattern-inside: ftp_size($FTP, $FILENAME, ...)
      - pattern-inside: rrd_create($FILENAME, ...)
      - pattern-inside: rrd_fetch($FILENAME, ...)
      - pattern-inside: rrd_graph($FILENAME, ...)
      - pattern-inside: rrd_info($FILENAME, ...)
      - pattern-inside: rrd_last($FILENAME, ...)
      - pattern-inside: rrd_lastupdate($FILENAME, ...)
      - pattern-inside: rrd_tune($FILENAME, ...)
      - pattern-inside: rrd_update($FILENAME, ...)
      - pattern-inside: snmp_read_mib($FILENAME, ...)
      - pattern-inside: ssh2_sftp_chmod($SFTP, $FILENAME, ...)
      - pattern-inside: ssh2_sftp_realpath($SFTP, $FILENAME, ...)
      - pattern-inside: ssh2_sftp_unlink($SFTP, $FILENAME, ...)
      - pattern-inside: apache_lookup_uri($FILENAME, ...)
      - pattern-inside: md5_file($FILENAME, ...)
      - pattern-inside: sha1_file($FILENAME, ...)
      - pattern-inside: simplexml_load_file($FILENAME, ...)
    - pattern: $FILENAME
- id: terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials
  patterns:
  - pattern-inside: |
      provider "aws" {
      ...
          secret_key = "$SECRET"
      }
  - focus-metavariable: $SECRET
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  languages:
  - hcl
  severity: WARNING
  metadata:
    technology:
    - secrets
    - aws
    - terraform
    category: security
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials
    shortlink: https://sg.run/L3kn
    semgrep.dev:
      rule:
        r_id: 16439
        rv_id: 1263735
        rule_id: d8U4n0
        version_id: rxTAK76
        url: https://semgrep.dev/playground/r/rxTAK76/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials
        origin: community
- id: php.laravel.security.laravel-sql-injection.laravel-sql-injection
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    category: security
    technology:
    - laravel
    references:
    - https://laravel.com/docs/8.x/queries
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection
    shortlink: https://sg.run/x40p
    semgrep.dev:
      rule:
        r_id: 16830
        rv_id: 1263313
        rule_id: j2UQdp
        version_id: BjTkZ45
        url: https://semgrep.dev/playground/r/BjTkZ45/php.laravel.security.laravel-sql-injection.laravel-sql-injection
        origin: community
  severity: WARNING
  message: Detected a SQL query based on user input. This could lead to SQL injection,
    which could potentially result in sensitive data being exfiltrated by attackers.
    Instead, use parameterized queries and prepared statements.
  languages:
  - php
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: $_GET
      - pattern: $_POST
      - pattern: $_COOKIE
      - pattern: $_REQUEST
      - pattern: $_SERVER
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: $SQL
        - pattern-either:
          - pattern-inside: DB::table(...)->whereRaw($SQL, ...)
          - pattern-inside: DB::table(...)->orWhereRaw($SQL, ...)
          - pattern-inside: DB::table(...)->groupByRaw($SQL, ...)
          - pattern-inside: DB::table(...)->havingRaw($SQL, ...)
          - pattern-inside: DB::table(...)->orHavingRaw($SQL, ...)
          - pattern-inside: DB::table(...)->orderByRaw($SQL, ...)
      - patterns:
        - pattern: $EXPRESSION
        - pattern-either:
          - pattern-inside: DB::table(...)->selectRaw($EXPRESSION, ...)
          - pattern-inside: DB::table(...)->fromRaw($EXPRESSION, ...)
      - patterns:
        - pattern: $COLUMNS
        - pattern-either:
          - pattern-inside: DB::table(...)->whereNull($COLUMNS, ...)
          - pattern-inside: DB::table(...)->orWhereNull($COLUMN)
          - pattern-inside: DB::table(...)->whereNotNull($COLUMNS, ...)
          - pattern-inside: DB::table(...)->whereRowValues($COLUMNS, ...)
          - pattern-inside: DB::table(...)->orWhereRowValues($COLUMNS, ...)
          - pattern-inside: DB::table(...)->find($ID, $COLUMNS)
          - pattern-inside: DB::table(...)->paginate($PERPAGE, $COLUMNS, ...)
          - pattern-inside: DB::table(...)->simplePaginate($PERPAGE, $COLUMNS, ...)
          - pattern-inside: DB::table(...)->cursorPaginate($PERPAGE, $COLUMNS, ...)
          - pattern-inside: DB::table(...)->getCountForPagination($COLUMNS)
          - pattern-inside: DB::table(...)->aggregate($FUNCTION, $COLUMNS)
          - pattern-inside: DB::table(...)->numericAggregate($FUNCTION, $COLUMNS)
          - pattern-inside: DB::table(...)->insertUsing($COLUMNS, ...)
          - pattern-inside: DB::table(...)->select($COLUMNS)
          - pattern-inside: DB::table(...)->get($COLUMNS)
          - pattern-inside: DB::table(...)->count($COLUMNS)
      - patterns:
        - pattern: $COLUMN
        - pattern-either:
          - pattern-inside: DB::table(...)->whereIn($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereIn($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereNotIn($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereNotIn($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereIntegerInRaw($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereIntegerInRaw($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereIntegerNotInRaw($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereIntegerNotInRaw($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereBetweenColumns($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereBetween($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereBetweenColumns($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereNotBetween($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereNotBetweenColumns($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereNotBetween($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereNotBetweenColumns($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereNotNull($COLUMN)
          - pattern-inside: DB::table(...)->whereDate($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereDate($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereTime($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereTime($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereDay($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereDay($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereMonth($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereMonth($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereYear($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereYear($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereJsonContains($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereJsonContains($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereJsonDoesntContain($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereJsonDoesntContain($COLUMN, ...)
          - pattern-inside: DB::table(...)->whereJsonLength($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhereJsonLength($COLUMN, ...)
          - pattern-inside: DB::table(...)->having($COLUMN, ...)
          - pattern-inside: DB::table(...)->orHaving($COLUMN, ...)
          - pattern-inside: DB::table(...)->havingBetween($COLUMN, ...)
          - pattern-inside: DB::table(...)->orderBy($COLUMN, ...)
          - pattern-inside: DB::table(...)->orderByDesc($COLUMN)
          - pattern-inside: DB::table(...)->latest($COLUMN)
          - pattern-inside: DB::table(...)->oldest($COLUMN)
          - pattern-inside: DB::table(...)->forPageBeforeId($PERPAGE, $LASTID, $COLUMN)
          - pattern-inside: DB::table(...)->forPageAfterId($PERPAGE, $LASTID, $COLUMN)
          - pattern-inside: DB::table(...)->value($COLUMN)
          - pattern-inside: DB::table(...)->pluck($COLUMN, ...)
          - pattern-inside: DB::table(...)->implode($COLUMN, ...)
          - pattern-inside: DB::table(...)->min($COLUMN)
          - pattern-inside: DB::table(...)->max($COLUMN)
          - pattern-inside: DB::table(...)->sum($COLUMN)
          - pattern-inside: DB::table(...)->avg($COLUMN)
          - pattern-inside: DB::table(...)->average($COLUMN)
          - pattern-inside: DB::table(...)->increment($COLUMN, ...)
          - pattern-inside: DB::table(...)->decrement($COLUMN, ...)
          - pattern-inside: DB::table(...)->where($COLUMN, ...)
          - pattern-inside: DB::table(...)->orWhere($COLUMN, ...)
          - pattern-inside: DB::table(...)->addSelect($COLUMN)
      - patterns:
        - pattern: $QUERY
        - pattern-inside: DB::unprepared($QUERY)
- id: csharp.dotnet.security.razor-template-injection.razor-template-injection
  message: User-controllable string passed to Razor.Parse. This leads directly to
    code execution in the context of the process.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    cwe2022-top25: true
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/
    subcategory:
    - vuln
    technology:
    - .net
    - razor
    - asp
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection
    shortlink: https://sg.run/oyj0
    semgrep.dev:
      rule:
        r_id: 18216
        rv_id: 1262621
        rule_id: EwUr68
        version_id: 1QTypdj
        url: https://semgrep.dev/playground/r/1QTypdj/csharp.dotnet.security.razor-template-injection.razor-template-injection
        origin: community
  languages:
  - csharp
  mode: taint
  pattern-sources:
  - patterns:
    - focus-metavariable: $ARG
    - pattern-inside: |
        public ActionResult $METHOD(..., string $ARG,...){...}
  pattern-sinks:
  - pattern: |
      Razor.Parse(...)
  pattern-sanitizers:
  - not_conflicting: true
    pattern: $F(...)
- id: csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: $A
    - pattern-inside: |
        Path.Combine(...,$A,...)
    - pattern-inside: |
        public $TYPE $M(...,$A,...){...}
    - pattern-not-inside: |
        <... Path.GetFileName($A) != $A ...>
  pattern-sinks:
  - patterns:
    - focus-metavariable: $X
    - pattern: |
        File.$METHOD($X,...)
    - metavariable-regex:
        metavariable: $METHOD
        regex: (?i)^(read|write)
  pattern-sanitizers:
  - pattern: |
      Path.GetFileName(...)
  - patterns:
    - pattern-inside: |
        $X = Path.GetFileName(...);
        ...
    - pattern: $X
  - patterns:
    - pattern: $X
    - pattern-inside: |
        if(<... Path.GetFileName($X) != $X ...>){
          ...
          throw new $EXCEPTION(...);
        }
        ...
  message: String argument $A is used to read or write data from a file via Path.Combine
    without direct sanitization via Path.GetFileName. If the path is user-supplied
    data this can lead to path traversal.
  languages:
  - csharp
  severity: WARNING
  metadata:
    category: security
    confidence: MEDIUM
    references:
    - https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/
    - https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks
    technology:
    - .net
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine
    shortlink: https://sg.run/1RvG
    semgrep.dev:
      rule:
        r_id: 18222
        rv_id: 1262632
        rule_id: 3qU3bE
        version_id: vdT0644
        url: https://semgrep.dev/playground/r/vdT0644/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine
        origin: community
- id: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override
  mode: taint
  pattern-sources:
  - patterns:
    - focus-metavariable: $ARG
    - pattern-inside: |
        public $T $M(...,string $ARG,...){...}
  pattern-sinks:
  - patterns:
    - pattern: |
        $XMLDOCUMENT.$METHOD(...)
    - pattern-inside: "XmlDocument $XMLDOCUMENT = new XmlDocument(...);\n...\n$XMLDOCUMENT.XmlResolver
        = new XmlUrlResolver(...);\n...  \n"
  message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling
    a string argument from a public method. Enabling Document Type Definition (DTD)
    parsing may cause XML External Entity (XXE) injection if supplied with user-controllable
    data.
  languages:
  - csharp
  severity: WARNING
  metadata:
    category: security
    references:
    - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/
    - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks
    technology:
    - .net
    - xml
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: LOW
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override
    shortlink: https://sg.run/k98P
    semgrep.dev:
      rule:
        r_id: 18228
        rv_id: 1262654
        rule_id: ReUK9k
        version_id: K3TKk5E
        url: https://semgrep.dev/playground/r/K3TKk5E/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override
        origin: community
- id: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override
  mode: taint
  pattern-sources:
  - patterns:
    - focus-metavariable: $ARG
    - pattern-inside: |
        public $T $M(...,string $ARG,...){...}
  pattern-sinks:
  - patterns:
    - pattern: |
        XmlReader $READER = XmlReader.Create(...,$RS,...);
    - pattern-inside: "XmlReaderSettings $RS = new XmlReaderSettings();\n...\n$RS.DtdProcessing
        = DtdProcessing.Parse;\n...        \n"
  message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling
    a string argument from a public method. Enabling Document Type Definition (DTD)
    parsing may cause XML External Entity (XXE) injection if supplied with user-controllable
    data.
  languages:
  - csharp
  severity: WARNING
  metadata:
    category: security
    references:
    - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/
    - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks
    technology:
    - .net
    - xml
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: LOW
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override
    shortlink: https://sg.run/wXjA
    semgrep.dev:
      rule:
        r_id: 18229
        rv_id: 1262655
        rule_id: AbU3pX
        version_id: qkTR7WD
        url: https://semgrep.dev/playground/r/qkTR7WD/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override
        origin: community
- id: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults
  mode: taint
  pattern-sources:
  - patterns:
    - focus-metavariable: $ARG
    - pattern-inside: |
        public $T $M(...,string $ARG,...){...}
  pattern-sinks:
  - patterns:
    - pattern: |
        $READER.$METHOD(...)
    - pattern-not-inside: |
        $READER.DtdProcessing = DtdProcessing.Prohibit;
        ...
    - pattern-inside: |
        XmlTextReader $READER = new XmlTextReader(...);
        ...
  message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling
    a string argument from a public method. Enabling Document Type Definition (DTD)
    parsing may cause XML External Entity (XXE) injection if supplied with user-controllable
    data.
  languages:
  - csharp
  severity: WARNING
  metadata:
    category: security
    references:
    - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/
    - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks
    technology:
    - .net
    - xml
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: LOW
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults
    shortlink: https://sg.run/xXjL
    semgrep.dev:
      rule:
        r_id: 18230
        rv_id: 1262656
        rule_id: BYUevk
        version_id: l4TJRWG
        url: https://semgrep.dev/playground/r/l4TJRWG/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults
        origin: community
- id: go.aws-lambda.security.database-sqli.database-sqli
  languages:
  - go
  message: Detected SQL statement that is tainted by `$EVENT` object. This could lead
    to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use prepared statements with the 'Prepare' and 'PrepareContext'
    calls.
  mode: taint
  metadata:
    references:
    - https://pkg.go.dev/database/sql#DB.Query
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - database
    - sql
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli
    shortlink: https://sg.run/e5e8
    semgrep.dev:
      rule:
        r_id: 18232
        rv_id: 1262909
        rule_id: WAUdJ7
        version_id: BjTkZkQ
        url: https://semgrep.dev/playground/r/BjTkZkQ/go.aws-lambda.security.database-sqli.database-sqli
        origin: community
  pattern-sinks:
  - patterns:
    - focus-metavariable: $QUERY
    - pattern-either:
      - pattern: $DB.Exec($QUERY,...)
      - pattern: $DB.ExecContent($QUERY,...)
      - pattern: $DB.Query($QUERY,...)
      - pattern: $DB.QueryContext($QUERY,...)
      - pattern: $DB.QueryRow($QUERY,...)
      - pattern: $DB.QueryRowContext($QUERY,...)
    - pattern-inside: |
        import "database/sql"
        ...
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...}
          ...
          lambda.Start($HANDLER, ...)
      - patterns:
        - pattern-inside: |
            func $HANDLER($EVENT $TYPE) {...}
            ...
            lambda.Start($HANDLER, ...)
        - pattern-not-inside: |
            func $HANDLER($EVENT context.Context) {...}
            ...
            lambda.Start($HANDLER, ...)
    - focus-metavariable: $EVENT
  severity: WARNING
- id: go.aws-lambda.security.tainted-sql-string.tainted-sql-string
  languages:
  - go
  severity: ERROR
  message: Detected user input used to manually construct a SQL string. This is usually
    bad practice because manual construction could accidentally result in a SQL injection.
    An attacker could use a SQL injection to steal or modify contents of the database.
    Instead, use a parameterized query which is available by default in most database
    engines. Alternatively, consider using an object-relational mapper (ORM) such
    as Sequelize which will protect your queries.
  metadata:
    references:
    - https://owasp.org/www-community/attacks/SQL_Injection
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string
    shortlink: https://sg.run/vX3Y
    semgrep.dev:
      rule:
        r_id: 18233
        rv_id: 1262910
        rule_id: 0oUwqg
        version_id: DkTRbRL
        url: https://semgrep.dev/playground/r/DkTRbRL/go.aws-lambda.security.tainted-sql-string.tainted-sql-string
        origin: community
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...}
          ...
          lambda.Start($HANDLER, ...)
      - patterns:
        - pattern-inside: |
            func $HANDLER($EVENT $TYPE) {...}
            ...
            lambda.Start($HANDLER, ...)
        - pattern-not-inside: |
            func $HANDLER($EVENT context.Context) {...}
            ...
            lambda.Start($HANDLER, ...)
    - focus-metavariable: $EVENT
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: |
            "$SQLSTR" + ...
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: (?i)(\s*select|\s*delete|\s*insert|\s*create|\s*update|\s*alter|\s*drop).*
      - patterns:
        - pattern-either:
          - pattern: fmt.Fprintf($F, "$SQLSTR", ...)
          - pattern: fmt.Sprintf("$SQLSTR", ...)
          - pattern: fmt.Printf("$SQLSTR", ...)
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).*
    - pattern-not-inside: |
        log.$PRINT(...)
  pattern-sanitizers:
  - pattern: strconv.Atoi(...)
- id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse
  message: '`Clean` is not intended to sanitize against path traversal attacks. This
    function is for finding the shortest path name equivalent to the given input.
    Using `Clean` to sanitize file reads may expose this application to path traversal
    attacks, where an attacker could access arbitrary files on the server. To fix
    this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path,
    "/")))` However, a better solution is using the `SecureJoin` function in the package
    `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.'
  severity: ERROR
  languages:
  - go
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          ($REQUEST : *http.Request).$ANYTHING
      - pattern: |
          ($REQUEST : http.Request).$ANYTHING
    - metavariable-regex:
        metavariable: $ANYTHING
        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: filepath.Clean($...INNER)
      - pattern: path.Clean($...INNER)
  pattern-sanitizers:
  - pattern-either:
    - pattern: |
        "/" + ...
  fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/")))
  options:
    interfile: true
  metadata:
    references:
    - https://pkg.go.dev/path#Clean
    - http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html
    - https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/
    - https://dzx.cz/2021/04/02/go_path_traversal/
    - https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    category: security
    technology:
    - go
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse
    shortlink: https://sg.run/ZKzw
    semgrep.dev:
      rule:
        r_id: 18235
        rv_id: 1262967
        rule_id: qNUQJe
        version_id: jQTn5Bj
        url: https://semgrep.dev/playground/r/jQTn5Bj/go.lang.security.filepath-clean-misuse.filepath-clean-misuse
        origin: community
- id: java.aws-lambda.security.tainted-sql-string.tainted-sql-string
  languages:
  - java
  severity: ERROR
  message: Detected user input used to manually construct a SQL string. This is usually
    bad practice because manual construction could accidentally result in a SQL injection.
    An attacker could use a SQL injection to steal or modify contents of the database.
    Instead, use a parameterized query which is available by default in most database
    engines. Alternatively, consider using an object-relational mapper (ORM) such
    as Sequelize which will protect your queries.
  options:
    interfile: true
  metadata:
    references:
    - https://owasp.org/www-community/attacks/SQL_Injection
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string
    shortlink: https://sg.run/EBYN
    semgrep.dev:
      rule:
        r_id: 18237
        rv_id: 1262977
        rule_id: YGUl4z
        version_id: O9TpxQN
        url: https://semgrep.dev/playground/r/O9TpxQN/java.aws-lambda.security.tainted-sql-string.tainted-sql-string
        origin: community
  mode: taint
  pattern-sources:
  - patterns:
    - focus-metavariable: $EVENT
    - pattern-either:
      - pattern: |
          $HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {
            ...
          }
      - pattern: |
          $HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {
            ...
          }
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          "$SQLSTR" + ...
      - pattern: |
          "$SQLSTR".concat(...)
      - patterns:
        - pattern-inside: |
            StringBuilder $SB = new StringBuilder("$SQLSTR");
            ...
        - pattern: $SB.append(...)
      - patterns:
        - pattern-inside: |
            $VAR = "$SQLSTR";
            ...
        - pattern: $VAR += ...
      - pattern: String.format("$SQLSTR", ...)
    - metavariable-regex:
        metavariable: $SQLSTR
        regex: (?i)(select|delete|insert|create|update|alter|drop)\b
    - pattern-not-inside: |
        System.out.$PRINTLN(...)
- id: java.aws-lambda.security.tainted-sqli.tainted-sqli
  message: Detected SQL statement that is tainted by `$EVENT` object. This could lead
    to SQL injection if variables in the SQL statement are not properly sanitized.
    Use parameterized SQL queries or properly sanitize user input instead.
  languages:
  - java
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - focus-metavariable: $EVENT
    - pattern-either:
      - pattern: |
          $HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {
            ...
          }
      - pattern: |
          $HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {
            ...
          }
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: "(java.sql.CallableStatement $STMT) = ...; \n"
      - pattern: |
          (java.sql.Statement $STMT) = ...;
      - pattern: |
          (java.sql.PreparedStatement $STMT) = ...;
      - pattern: |
          $VAR = $CONN.prepareStatement(...)
      - pattern: |
          $PATH.queryForObject(...);
      - pattern: |
          (java.util.Map<String, Object> $STMT) = $PATH.queryForMap(...);
      - pattern: |
          (org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...;
      - patterns:
        - pattern-inside: |
            (String $SQL) = "$SQLSTR" + ...;
            ...
        - pattern: $PATH.$SQLCMD(..., $SQL, ...);
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*)
        - metavariable-regex:
            metavariable: $SQLCMD
            regex: (execute|query|executeUpdate|batchUpdate)
  options:
    interfile: true
  metadata:
    category: security
    technology:
    - sql
    - java
    - aws-lambda
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli
    shortlink: https://sg.run/7942
    semgrep.dev:
      rule:
        r_id: 18238
        rv_id: 1262978
        rule_id: 6JUDWk
        version_id: e1Tyj4g
        url: https://semgrep.dev/playground/r/e1Tyj4g/java.aws-lambda.security.tainted-sqli.tainted-sqli
        origin: community
- id: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
  message: Detected input from a HTTPServletRequest going into a SQL sink or statement.
    This could lead to SQL injection if variables in the SQL statement are not properly
    sanitized. Use parameterized SQL queries or properly sanitize user input instead.
  severity: WARNING
  metadata:
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    category: security
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    cwe2021-top25: true
    cwe2022-top25: true
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
    - https://owasp.org/www-community/attacks/SQL_Injection
    subcategory:
    - vuln
    technology:
    - sql
    - java
    - servlets
    - spring
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
    shortlink: https://sg.run/Lg56
    semgrep.dev:
      rule:
        r_id: 18239
        rv_id: 1409390
        rule_id: oqUBJG
        version_id: 7ZTKJNj
        url: https://semgrep.dev/playground/r/7ZTKJNj/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
        origin: community
  languages:
  - java
  mode: taint
  options:
    taint_assume_safe_numbers: true
    taint_assume_safe_booleans: true
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletRequest $REQ).$REQFUNC(...)
      - pattern: "(ServletRequest $REQ).$REQFUNC(...) \n"
    - metavariable-regex:
        metavariable: $REQFUNC
        regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: "(java.sql.CallableStatement $STMT) = ...; \n"
      - pattern: |
          (java.sql.Statement $STMT) = ...;
          ...
          $OUTPUT = $STMT.$FUNC(...);
      - pattern: |
          (java.sql.PreparedStatement $STMT) = ...;
      - pattern: |
          $VAR = $CONN.prepareStatement(...)
      - pattern: |
          $PATH.queryForObject(...);
      - pattern: |
          (java.util.Map<String, Object> $STMT) = $PATH.queryForMap(...);
      - pattern: |
          (org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...;
      - pattern: |
          (org.springframework.jdbc.core.JdbcTemplate $TEMPL).batchUpdate(...)
      - patterns:
        - pattern-inside: |
            (String $SQL) = "$SQLSTR" + ...;
            ...
        - pattern: $PATH.$SQLCMD(..., $SQL, ...);
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*)
        - metavariable-regex:
            metavariable: $SQLCMD
            regex: (execute|query|executeUpdate|batchUpdate)
- id: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request
  message: Detected input from a HTTPServletRequest going into a 'ProcessBuilder'
    or 'exec' command. This could lead to command injection if variables passed into
    the exec commands are not properly sanitized. Instead, avoid using these OS commands
    with user-supplied input, or, if you must use these commands, use a whitelist
    of specific values.
  languages:
  - java
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletRequest $REQ)
      - patterns:
        - pattern-inside: |
            (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
            ...
            for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
              ...
            }
        - pattern: |
            $COOKIE.getValue(...)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          (ProcessBuilder $PB) = ...;
      - patterns:
        - pattern: |
            (Process $P) = ...;
        - pattern-not: |
            (Process $P) = (java.lang.Runtime $R).exec(...);
      - patterns:
        - pattern: (java.lang.Runtime $R).exec($CMD, ...);
        - focus-metavariable: $CMD
      - patterns:
        - pattern-either:
          - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...;  \n...\n(ProcessBuilder
              $PB) = ...;\n...\n$PB.command($ARGLIST);\n"
          - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...;  \n...\n(ProcessBuilder
              $PB) = ...;\n"
          - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...;  \n...\n(Process
              $P) = ...;\n"
        - pattern: |
            $ARGLIST.add(...);
  metadata:
    category: security
    technology:
    - java
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request
    shortlink: https://sg.run/8zPN
    semgrep.dev:
      rule:
        r_id: 18240
        rv_id: 1263042
        rule_id: zdUWrg
        version_id: LjTkg9J
        url: https://semgrep.dev/playground/r/LjTkg9J/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request
        origin: community
- id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://semgrep.dev/blog/2022/xml-security-in-java
    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
    - https://blog.sonarsource.com/secure-xml-processor
    - https://xerces.apache.org/xerces2-j/features.html
    category: security
    technology:
    - java
    - xml
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false
    shortlink: https://sg.run/4Dv5
    semgrep.dev:
      rule:
        r_id: 18244
        rv_id: 1263057
        rule_id: j2UrJ8
        version_id: 0bTKzgX
        url: https://semgrep.dev/playground/r/0bTKzgX/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false
        origin: community
  message: DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external
    entity declarations, this is vulnerable to XML external entity attacks. Disable
    this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl"
    to true. Alternatively, allow DOCTYPE declarations and only prohibit external
    entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities"
    and "http://xml.org/sax/features/external-parameter-entities" to false.
  patterns:
  - pattern: $DBFACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
      false);
  - pattern-not-inside: |
      $RETURNTYPE $METHOD(...){
        ...
        $DBF.setFeature("http://xml.org/sax/features/external-general-entities", false);
        ...
        $DBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        ...
      }
  - pattern-not-inside: |
      $RETURNTYPE $METHOD(...){
        ...
        $DBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        ...
        $DBF.setFeature("http://xml.org/sax/features/external-general-entities", false);
        ...
      }
  - pattern-not-inside: |
      $RETURNTYPE $METHOD(...){
        ...
        $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
        ...
        $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
        ...
      }
  - pattern-not-inside: |
      $RETURNTYPE $METHOD(...){
        ...
        $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
        ...
        $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
        ...
      }
  languages:
  - java
- id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://semgrep.dev/blog/2022/xml-security-in-java
    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
    - https://blog.sonarsource.com/secure-xml-processor
    - https://xerces.apache.org/xerces2-j/features.html
    category: security
    technology:
    - java
    - xml
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing
    shortlink: https://sg.run/PYBz
    semgrep.dev:
      rule:
        r_id: 18245
        rv_id: 1263058
        rule_id: 10UPQB
        version_id: K3TKk80
        url: https://semgrep.dev/playground/r/K3TKk80/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing
        origin: community
  message: DOCTYPE declarations are enabled for this DocumentBuilderFactory. This
    is vulnerable to XML external entity attacks. Disable this by setting the feature
    "http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively,
    allow DOCTYPE declarations and only prohibit external entities declarations. This
    can be done by setting the features "http://xml.org/sax/features/external-general-entities"
    and "http://xml.org/sax/features/external-parameter-entities" to false.
  mode: taint
  pattern-sources:
  - by-side-effect: true
    patterns:
    - pattern-either:
      - pattern: |
          $FACTORY = DocumentBuilderFactory.newInstance();
      - patterns:
        - pattern: $FACTORY
        - pattern-inside: |
            class $C {
              ...
              $V $FACTORY = DocumentBuilderFactory.newInstance();
              ...
            }
        - pattern-not-inside: |
            class $C {
              ...
              $V $FACTORY = DocumentBuilderFactory.newInstance();
              static {
                ...
                $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
                ...
              }
              ...
            }
        - pattern-not-inside: |
            class $C {
              ...
              $V $FACTORY = DocumentBuilderFactory.newInstance();
              static {
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
                ...
              }
              ...
            }
        - pattern-not-inside: |
            class $C {
              ...
              $V $FACTORY = DocumentBuilderFactory.newInstance();
              static {
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
                ...
              }
              ...
            }
  pattern-sinks:
  - patterns:
    - pattern: $FACTORY.newDocumentBuilder();
  pattern-sanitizers:
  - by-side-effect: true
    pattern-either:
    - patterns:
      - pattern-either:
        - pattern: |
            $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        - pattern: |
            $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
            ...
            $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        - pattern: |
            $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
            ...
            $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
      - focus-metavariable: $FACTORY
    - patterns:
      - pattern-either:
        - pattern-inside: |
            class $C {
              ...
              $T $M(...) {
                ...
                $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
                true);
                ...
              }
              ...
            }
        - pattern-inside: |
            class $C {
              ...
              $T $M(...) {
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
                ...
              }
              ...
            }
        - pattern-inside: |
            class $C {
              ...
              $T $M(...) {
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities",false);
                ...
              }
              ...
            }
      - pattern: $M($X)
      - focus-metavariable: $X
  fix: |
    $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
    $FACTORY.newDocumentBuilder();
  languages:
  - java
- id: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://semgrep.dev/blog/2022/xml-security-in-java
    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
    - https://blog.sonarsource.com/secure-xml-processor
    category: security
    technology:
    - java
    - xml
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true
    shortlink: https://sg.run/JgPy
    semgrep.dev:
      rule:
        r_id: 18246
        rv_id: 1263059
        rule_id: 9AUJ6r
        version_id: qkTR7Lk
        url: https://semgrep.dev/playground/r/qkTR7Lk/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true
        origin: community
  message: External entities are allowed for $DBFACTORY. This is vulnerable to XML
    external entity attacks. Disable this by setting the feature "http://xml.org/sax/features/external-general-entities"
    to false.
  pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities",
    true);
  fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities",
    false);
  languages:
  - java
- id: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://semgrep.dev/blog/2022/xml-security-in-java
    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
    - https://blog.sonarsource.com/secure-xml-processor
    category: security
    technology:
    - java
    - xml
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true
    shortlink: https://sg.run/5Lv0
    semgrep.dev:
      rule:
        r_id: 18247
        rv_id: 1263060
        rule_id: yyUNeo
        version_id: l4TJRoL
        url: https://semgrep.dev/playground/r/l4TJRoL/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true
        origin: community
  message: External entities are allowed for $DBFACTORY. This is vulnerable to XML
    external entity attacks. Disable this by setting the feature "http://xml.org/sax/features/external-parameter-entities"
    to false.
  pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities",
    true);
  fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities",
    false);
  languages:
  - java
- id: javascript.aws-lambda.security.detect-child-process.detect-child-process
  message: Allowing spawning arbitrary programs or running shell processes with arbitrary
    arguments may end up in a command injection vulnerability. Try to avoid non-literal
    values for the command string. If it is not possible, then do not let running
    arbitrary commands, use a white list for inputs.
  metadata:
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - javascript
    - aws-lambda
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process
    shortlink: https://sg.run/Ggoq
    semgrep.dev:
      rule:
        r_id: 18248
        rv_id: 1263105
        rule_id: r6UDNQ
        version_id: YDTZe4o
        url: https://semgrep.dev/playground/r/YDTZe4o/javascript.aws-lambda.security.detect-child-process.detect-child-process
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: $EVENT
    - pattern-either:
      - pattern-inside: |
          exports.handler = function ($EVENT, ...) {
            ...
          }
      - pattern-inside: |
          function $FUNC ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
      - pattern-inside: |
          $FUNC = function ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
  pattern-sinks:
  - patterns:
    - focus-metavariable: $CMD
    - pattern-either:
      - pattern: exec($CMD,...)
      - pattern: execSync($CMD,...)
      - pattern: spawn($CMD,...)
      - pattern: spawnSync($CMD,...)
      - pattern: $CP.exec($CMD,...)
      - pattern: $CP.execSync($CMD,...)
      - pattern: $CP.spawn($CMD,...)
      - pattern: $CP.spawnSync($CMD,...)
    - pattern-either:
      - pattern-inside: |
          require('child_process')
          ...
      - pattern-inside: |
          import 'child_process'
          ...
- id: javascript.aws-lambda.security.knex-sqli.knex-sqli
  message: 'Detected SQL statement that is tainted by `$EVENT` object. This could
    lead to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use parameterized statements like so: `knex.raw(''SELECT $1 from
    table'', [userinput])`'
  metadata:
    references:
    - https://knexjs.org/#Builder-fromRaw
    - https://knexjs.org/#Builder-whereRaw
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - knex
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli
    shortlink: https://sg.run/RgWq
    semgrep.dev:
      rule:
        r_id: 18249
        rv_id: 1263106
        rule_id: bwUBlj
        version_id: JdTzxKg
        url: https://semgrep.dev/playground/r/JdTzxKg/javascript.aws-lambda.security.knex-sqli.knex-sqli
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          exports.handler = function ($EVENT, ...) {
            ...
          }
      - pattern-inside: |
          function $FUNC ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
      - pattern-inside: |
          $FUNC = function ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
    - pattern: $EVENT
  pattern-sinks:
  - patterns:
    - focus-metavariable: $QUERY
    - pattern-either:
      - pattern: $KNEX.fromRaw($QUERY, ...)
      - pattern: $KNEX.whereRaw($QUERY, ...)
      - pattern: $KNEX.raw($QUERY, ...)
    - pattern-either:
      - pattern-inside: |
          require('knex')
          ...
      - pattern-inside: |
          import 'knex'
          ...
- id: javascript.aws-lambda.security.mysql-sqli.mysql-sqli
  message: 'Detected SQL statement that is tainted by `$EVENT` object. This could
    lead to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use parameterized statements like so: `connection.query(''SELECT
    $1 from table'', [userinput])`'
  metadata:
    references:
    - https://www.npmjs.com/package/mysql2
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - mysql
    - mysql2
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli
    shortlink: https://sg.run/A502
    semgrep.dev:
      rule:
        r_id: 18250
        rv_id: 1263107
        rule_id: NbUBJ2
        version_id: 5PTo1En
        url: https://semgrep.dev/playground/r/5PTo1En/javascript.aws-lambda.security.mysql-sqli.mysql-sqli
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          exports.handler = function ($EVENT, ...) {
            ...
          }
      - pattern-inside: |
          function $FUNC ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
      - pattern-inside: |
          $FUNC = function ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
    - pattern: $EVENT
  pattern-sinks:
  - patterns:
    - focus-metavariable: $QUERY
    - pattern-either:
      - pattern: $POOL.query($QUERY, ...)
      - pattern: $POOL.execute($QUERY, ...)
    - pattern-either:
      - pattern-inside: |
          require('mysql')
          ...
      - pattern-inside: |
          require('mysql2')
          ...
      - pattern-inside: |
          require('mysql2/promise')
          ...
      - pattern-inside: |
          import 'mysql'
          ...
      - pattern-inside: |
          import 'mysql2'
          ...
      - pattern-inside: |
          import 'mysql2/promise'
          ...
- id: javascript.aws-lambda.security.pg-sqli.pg-sqli
  message: 'Detected SQL statement that is tainted by `$EVENT` object. This could
    lead to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use parameterized statements like so: `connection.query(''SELECT
    $1 from table'', [userinput])`'
  metadata:
    references:
    - https://node-postgres.com/features/queries
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - postgres
    - pg
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli
    shortlink: https://sg.run/BGKA
    semgrep.dev:
      rule:
        r_id: 18251
        rv_id: 1263108
        rule_id: kxU25P
        version_id: GxTkeJL
        url: https://semgrep.dev/playground/r/GxTkeJL/javascript.aws-lambda.security.pg-sqli.pg-sqli
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          exports.handler = function ($EVENT, ...) {
            ...
          }
      - pattern-inside: |
          function $FUNC ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
      - pattern-inside: |
          $FUNC = function ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
    - pattern: $EVENT
  pattern-sinks:
  - patterns:
    - focus-metavariable: $QUERY
    - pattern-either:
      - pattern: $DB.query($QUERY, ...)
    - pattern-either:
      - pattern-inside: |
          require('pg')
          ...
      - pattern-inside: |
          import 'pg'
          ...
- id: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli
  message: 'Detected SQL statement that is tainted by `$EVENT` object. This could
    lead to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use parameterized statements like so: `sequelize.query(''SELECT
    * FROM projects WHERE status = ?'', { replacements: [''active''], type: QueryTypes.SELECT
    });`'
  metadata:
    references:
    - https://sequelize.org/master/manual/raw-queries.html
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - sequelize
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli
    shortlink: https://sg.run/DAlP
    semgrep.dev:
      rule:
        r_id: 18252
        rv_id: 1263109
        rule_id: wdUA5o
        version_id: RGT0LrD
        url: https://semgrep.dev/playground/r/RGT0LrD/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          exports.handler = function ($EVENT, ...) {
            ...
          }
      - pattern-inside: |
          function $FUNC ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
      - pattern-inside: |
          $FUNC = function ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
    - pattern: $EVENT
  pattern-sinks:
  - patterns:
    - focus-metavariable: $QUERY
    - pattern-either:
      - pattern: $DB.query($QUERY, ...)
    - pattern-either:
      - pattern-inside: |
          require('sequelize')
          ...
      - pattern-inside: |
          import 'sequelize'
          ...
- id: javascript.aws-lambda.security.tainted-html-response.tainted-html-response
  message: Detected user input flowing into an HTML response. You may be accidentally
    bypassing secure methods of rendering HTML by manually constructing HTML and this
    could create a cross-site scripting vulnerability, which could let attackers steal
    sensitive user data.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - aws-lambda
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response
    shortlink: https://sg.run/0Gvj
    semgrep.dev:
      rule:
        r_id: 18254
        rv_id: 1263111
        rule_id: OrUJBY
        version_id: BjTkZ8D
        url: https://semgrep.dev/playground/r/BjTkZ8D/javascript.aws-lambda.security.tainted-html-response.tainted-html-response
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          exports.handler = function ($EVENT, ...) {
            ...
          }
      - pattern-inside: |
          function $FUNC ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
      - pattern-inside: |
          $FUNC = function ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
    - pattern: $EVENT
  pattern-sinks:
  - patterns:
    - focus-metavariable: $BODY
    - pattern-inside: |
        {..., headers: {..., 'Content-Type': 'text/html', ...}, body: $BODY, ... }
- id: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection
  message: The `vm` module enables compiling and running code within V8 Virtual Machine
    contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted
    code. If code passed to `vm` functions is controlled by user input it could result
    in command injection. Do not let user input in `vm` functions.
  metadata:
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    category: security
    technology:
    - javascript
    - aws-lambda
    cwe2022-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection
    shortlink: https://sg.run/q9w7
    semgrep.dev:
      rule:
        r_id: 18256
        rv_id: 1263114
        rule_id: v8UOdZ
        version_id: 0bTKz9J
        url: https://semgrep.dev/playground/r/0bTKz9J/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: $EVENT
    - pattern-either:
      - pattern-inside: |
          exports.handler = function ($EVENT, ...) {
            ...
          }
      - pattern-inside: |
          function $FUNC ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
      - pattern-inside: |
          $FUNC = function ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          require('vm');
          ...
      - pattern-inside: |
          import 'vm'
          ...
    - pattern-either:
      - pattern: $VM.runInContext($X,...)
      - pattern: $VM.runInNewContext($X,...)
      - pattern: $VM.runInThisContext($X,...)
      - pattern: $VM.compileFunction($X,...)
      - pattern: new $VM.Script($X,...)
      - pattern: new $VM.SourceTextModule($X,...)
      - pattern: runInContext($X,...)
      - pattern: runInNewContext($X,...)
      - pattern: runInThisContext($X,...)
      - pattern: compileFunction($X,...)
      - pattern: new Script($X,...)
      - pattern: new SourceTextModule($X,...)
- id: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli
  message: 'Detected SQL statement that is tainted by `$REQ` object. This could lead
    to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, it is recommended to use parameterized queries
    or prepared statements. An example of parameterized queries like so: `knex.raw(''SELECT
    $1 from table'', [userinput])` can help prevent SQLi.'
  metadata:
    confidence: MEDIUM
    references:
    - https://knexjs.org/#Builder-fromRaw
    - https://knexjs.org/#Builder-whereRaw
    - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - express
    - nodejs
    - knex
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli
    shortlink: https://sg.run/l9eE
    semgrep.dev:
      rule:
        r_id: 18257
        rv_id: 1263205
        rule_id: d8UKLD
        version_id: l4TJRey
        url: https://semgrep.dev/playground/r/l4TJRey/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
      - pattern: $REQ.files.$ANYTHING.data.toString('utf8')
      - pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
      - pattern: files.$ANYTHING.data.toString('utf8')
      - pattern: files.$ANYTHING['data'].toString('utf8')
  pattern-sinks:
  - patterns:
    - focus-metavariable: $QUERY
    - pattern-either:
      - pattern-inside: $KNEX.fromRaw($QUERY, ...)
      - pattern-inside: $KNEX.whereRaw($QUERY, ...)
      - pattern-inside: $KNEX.raw($QUERY, ...)
    - pattern-either:
      - pattern-inside: |
          require('knex')
          ...
      - pattern-inside: |
          import 'knex'
          ...
  pattern-sanitizers:
  - patterns:
    - pattern: parseInt(...)
- id: php.lang.security.deserialization.extract-user-data
  mode: taint
  pattern-sources:
  - pattern-either:
    - pattern: $_GET[...]
    - pattern: $_FILES[...]
    - pattern: $_POST[...]
  pattern-sinks:
  - pattern: extract(...)
  pattern-sanitizers:
  - pattern: extract($VAR, EXTR_SKIP,...)
  message: Do not call 'extract()' on user-controllable data. If you must, then you
    must also provide the EXTR_SKIP flag to prevent overwriting existing variables.
  languages:
  - php
  metadata:
    category: security
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    technology:
    - php
    references:
    - https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data
    shortlink: https://sg.run/6bv1
    semgrep.dev:
      rule:
        r_id: 18259
        rv_id: 1263278
        rule_id: nJUykq
        version_id: w8TRovw
        url: https://semgrep.dev/playground/r/w8TRovw/php.lang.security.deserialization.extract-user-data
        origin: community
  severity: ERROR
- id: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  pattern-sinks:
  - patterns:
    - focus-metavariable: $CMD
    - pattern-either:
      - pattern: asyncio.create_subprocess_exec($PROG, $CMD, ...)
      - pattern: asyncio.create_subprocess_exec($PROG, [$CMD, ...], ...)
      - pattern: asyncio.subprocess.create_subprocess_exec($PROG, $CMD, ...)
      - pattern: asyncio.subprocess.create_subprocess_exec($PROG, [$CMD, ...], ...)
      - pattern: asyncio.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
          "-c", $CMD, ...)
      - pattern: asyncio.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
          "-c", $CMD, ...], ...)
      - pattern: asyncio.subprocess.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
          "-c", $CMD, ...)
      - pattern: asyncio.subprocess.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
          "-c", $CMD, ...], ...)
  message: Detected 'create_subprocess_exec' function with argument tainted by `event`
    object. If this data can be controlled by a malicious actor, it may be an instance
    of command injection. Audit the use of this call to ensure it is not controllable
    by an external resource. You may consider using 'shlex.escape()'.
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    references:
    - https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec
    - https://docs.python.org/3/library/shlex.html
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec
    shortlink: https://sg.run/oyv0
    semgrep.dev:
      rule:
        r_id: 18260
        rv_id: 1263331
        rule_id: EwUrX8
        version_id: rxTAKgo
        url: https://semgrep.dev/playground/r/rxTAKgo/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  pattern-sinks:
  - patterns:
    - focus-metavariable: $CMD
    - pattern-either:
      - pattern: $LOOP.subprocess_exec($PROTOCOL, $CMD, ...)
      - pattern: $LOOP.subprocess_exec($PROTOCOL, [$CMD, ...], ...)
      - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
          "-c", $CMD, ...)
      - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
          "-c", $CMD, ...], ...)
  message: Detected subprocess function '$LOOP.subprocess_exec' with argument tainted
    by `event` object. If this data can be controlled by a malicious actor, it may
    be an instance of command injection. Audit the use of this call to ensure it is
    not controllable by an external resource. You may consider using 'shlex.escape()'.
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    references:
    - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec
    - https://docs.python.org/3/library/shlex.html
    category: security
    technology:
    - python
    - aws-lambda
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec
    shortlink: https://sg.run/z14d
    semgrep.dev:
      rule:
        r_id: 18261
        rv_id: 1263332
        rule_id: 7KUxXg
        version_id: bZT53Ww
        url: https://semgrep.dev/playground/r/bZT53Ww/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  pattern-sinks:
  - patterns:
    - focus-metavariable: $CMD
    - pattern-either:
      - pattern: $LOOP.subprocess_shell($PROTOCOL, $CMD)
      - pattern: asyncio.subprocess.create_subprocess_shell($CMD, ...)
      - pattern: asyncio.create_subprocess_shell($CMD, ...)
  message: Detected asyncio subprocess function with argument tainted by `event` object.
    If this data can be controlled by a malicious actor, it may be an instance of
    command injection. Audit the use of this call to ensure it is not controllable
    by an external resource. You may consider using 'shlex.escape()'.
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    references:
    - https://docs.python.org/3/library/asyncio-subprocess.html
    - https://docs.python.org/3/library/shlex.html
    category: security
    technology:
    - python
    - aws-lambda
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell
    shortlink: https://sg.run/p9vZ
    semgrep.dev:
      rule:
        r_id: 18262
        rv_id: 1263333
        rule_id: L1UEl7
        version_id: NdTzyWA
        url: https://semgrep.dev/playground/r/NdTzyWA/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process
  mode: taint
  message: Detected `os` function with argument tainted by `event` object. This is
    dangerous if external data can reach this function call because it allows a malicious
    actor to execute commands. Ensure no external data reaches here.
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    category: security
    technology:
    - python
    - aws-lambda
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process
    shortlink: https://sg.run/2AjL
    semgrep.dev:
      rule:
        r_id: 18263
        rv_id: 1263334
        rule_id: 8GUGBq
        version_id: kbTzGv8
        url: https://semgrep.dev/playground/r/kbTzGv8/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process
        origin: community
  languages:
  - python
  severity: ERROR
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  pattern-sinks:
  - patterns:
    - focus-metavariable: $CMD
    - pattern-either:
      - patterns:
        - pattern: os.$METHOD($MODE, $CMD, ...)
        - metavariable-regex:
            metavariable: $METHOD
            regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile)
      - patterns:
        - pattern-inside: os.$METHOD($MODE, $BASH, ["-c", $CMD,...],...)
        - metavariable-regex:
            metavariable: $METHOD
            regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp)
        - metavariable-regex:
            metavariable: $BASH
            regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
      - patterns:
        - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...)
        - metavariable-regex:
            metavariable: $METHOD
            regex: (spawnl|spawnle|spawnlp|spawnlpe)
        - metavariable-regex:
            metavariable: $BASH
            regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
- id: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use
  mode: taint
  message: Detected subprocess function with argument tainted by an `event` object.  If
    this data can be controlled by a malicious actor, it may be an instance of command
    injection. The default option for `shell` is False, and this is secure by default.
    Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False`
    means you have to split the command string into an array of strings for the command
    and its arguments. You may consider using 'shlex.split()' for this purpose.
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    references:
    - https://docs.python.org/3/library/subprocess.html
    - https://docs.python.org/3/library/shlex.html
    category: security
    technology:
    - python
    - aws-lambda
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use
    shortlink: https://sg.run/XZ7B
    semgrep.dev:
      rule:
        r_id: 18264
        rv_id: 1263335
        rule_id: gxUyn1
        version_id: w8TRogj
        url: https://semgrep.dev/playground/r/w8TRogj/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use
        origin: community
  languages:
  - python
  severity: ERROR
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  pattern-sinks:
  - patterns:
    - pattern: subprocess.$FUNC(..., shell=True, ...)
  pattern-sanitizers:
  - pattern: shlex.split(...)
  - pattern: pipes.quote(...)
  - pattern: shlex.quote(...)
- id: python.aws-lambda.security.dangerous-system-call.dangerous-system-call
  mode: taint
  message: Detected `os` function with argument tainted by `event` object. This is
    dangerous if external data can reach this function call because it allows a malicious
    actor to execute commands. Use the 'subprocess' module instead, which is easier
    to use without accidentally exposing a command injection vulnerability.
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.2.4 Dyanmic Code Execution Features
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
      version: '4'
    category: security
    technology:
    - python
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call
    shortlink: https://sg.run/jDvN
    semgrep.dev:
      rule:
        r_id: 18265
        rv_id: 1263336
        rule_id: QrUkg6
        version_id: xyTjzbG
        url: https://semgrep.dev/playground/r/xyTjzbG/python.aws-lambda.security.dangerous-system-call.dangerous-system-call
        origin: community
  languages:
  - python
  severity: ERROR
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  pattern-sinks:
  - patterns:
    - focus-metavariable: $CMD
    - pattern-either:
      - pattern: os.system($CMD,...)
      - pattern: os.popen($CMD,...)
      - pattern: os.popen2($CMD,...)
      - pattern: os.popen3($CMD,...)
      - pattern: os.popen4($CMD,...)
- id: python.aws-lambda.security.mysql-sqli.mysql-sqli
  languages:
  - python
  message: 'Detected SQL statement that is tainted by `event` object. This could lead
    to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use parameterized statements like so: `cursor.execute(''SELECT
    * FROM projects WHERE status = %s'', (''active''))`'
  mode: taint
  metadata:
    references:
    - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html
    - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - mysql
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli
    shortlink: https://sg.run/1RjG
    semgrep.dev:
      rule:
        r_id: 18266
        rv_id: 1263337
        rule_id: 3qU3eE
        version_id: O9TpxLJ
        url: https://semgrep.dev/playground/r/O9TpxLJ/python.aws-lambda.security.mysql-sqli.mysql-sqli
        origin: community
  pattern-sinks:
  - patterns:
    - focus-metavariable: $QUERY
    - pattern-either:
      - pattern: $CURSOR.execute($QUERY,...)
      - pattern: $CURSOR.executemany($QUERY,...)
    - pattern-either:
      - pattern-inside: |
          import mysql
          ...
      - pattern-inside: |
          import mysql.cursors
          ...
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  severity: WARNING
- id: python.aws-lambda.security.psycopg-sqli.psycopg-sqli
  languages:
  - python
  message: 'Detected SQL statement that is tainted by `event` object. This could lead
    to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use parameterized statements like so: `cursor.execute(''SELECT
    * FROM projects WHERE status = %s'', ''active'')`'
  mode: taint
  metadata:
    references:
    - https://www.psycopg.org/docs/cursor.html#cursor.execute
    - https://www.psycopg.org/docs/cursor.html#cursor.executemany
    - https://www.psycopg.org/docs/cursor.html#cursor.mogrify
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - psycopg
    - psycopg2
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli
    shortlink: https://sg.run/9L8r
    semgrep.dev:
      rule:
        r_id: 18267
        rv_id: 1263338
        rule_id: 4bUQG1
        version_id: e1TyjPZ
        url: https://semgrep.dev/playground/r/e1TyjPZ/python.aws-lambda.security.psycopg-sqli.psycopg-sqli
        origin: community
  pattern-sinks:
  - patterns:
    - focus-metavariable: $QUERY
    - pattern-either:
      - pattern: $CURSOR.execute($QUERY,...)
      - pattern: $CURSOR.executemany($QUERY,...)
      - pattern: $CURSOR.mogrify($QUERY,...)
    - pattern-inside: |
        import psycopg2
        ...
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  severity: WARNING
- id: python.aws-lambda.security.pymssql-sqli.pymssql-sqli
  languages:
  - python
  message: 'Detected SQL statement that is tainted by `event` object. This could lead
    to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use parameterized statements like so: `cursor.execute(''SELECT
    * FROM projects WHERE status = %s'', ''active'')`'
  mode: taint
  metadata:
    references:
    - https://pypi.org/project/pymssql/
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - pymssql
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli
    shortlink: https://sg.run/yXvP
    semgrep.dev:
      rule:
        r_id: 18268
        rv_id: 1263339
        rule_id: PeUxO0
        version_id: vdT06bG
        url: https://semgrep.dev/playground/r/vdT06bG/python.aws-lambda.security.pymssql-sqli.pymssql-sqli
        origin: community
  pattern-sinks:
  - patterns:
    - focus-metavariable: $QUERY
    - pattern: $CURSOR.execute($QUERY,...)
    - pattern-inside: |
        import pymssql
        ...
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  severity: WARNING
- id: python.aws-lambda.security.pymysql-sqli.pymysql-sqli
  languages:
  - python
  message: 'Detected SQL statement that is tainted by `event` object. This could lead
    to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use parameterized statements like so: `cursor.execute(''SELECT
    * FROM projects WHERE status = %s'', (''active''))`'
  mode: taint
  metadata:
    references:
    - https://pypi.org/project/PyMySQL/#id4
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - pymysql
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli
    shortlink: https://sg.run/reve
    semgrep.dev:
      rule:
        r_id: 18269
        rv_id: 1263340
        rule_id: JDUlel
        version_id: d6TyxNA
        url: https://semgrep.dev/playground/r/d6TyxNA/python.aws-lambda.security.pymysql-sqli.pymysql-sqli
        origin: community
  pattern-sinks:
  - patterns:
    - focus-metavariable: $QUERY
    - pattern: $CURSOR.execute($QUERY,...)
    - pattern-either:
      - pattern-inside: |
          import pymysql
          ...
      - pattern-inside: |
          import pymysql.cursors
          ...
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  severity: WARNING
- id: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli
  languages:
  - python
  message: 'Detected SQL statement that is tainted by `event` object. This could lead
    to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use parameterized statements like so: `cursor.execute(''SELECT
    * FROM projects WHERE status = ?'', ''active'')`'
  mode: taint
  metadata:
    references:
    - https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - sqlalchemy
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli
    shortlink: https://sg.run/b48W
    semgrep.dev:
      rule:
        r_id: 18270
        rv_id: 1263341
        rule_id: 5rUy3N
        version_id: ZRTKARp
        url: https://semgrep.dev/playground/r/ZRTKARp/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli
        origin: community
  pattern-sinks:
  - patterns:
    - focus-metavariable: $QUERY
    - pattern: $CURSOR.execute($QUERY,...)
    - pattern-inside: |
        import sqlalchemy
        ...
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  severity: WARNING
- id: python.aws-lambda.security.tainted-html-response.tainted-html-response
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  pattern-sinks:
  - patterns:
    - pattern: $BODY
    - pattern-inside: |
        {..., "headers": {..., "Content-Type": "text/html", ...}, "body": $BODY, ... }
  message: Detected user input flowing into an HTML response. You may be accidentally
    bypassing secure methods of rendering HTML by manually constructing HTML and this
    could create a cross-site scripting vulnerability, which could let attackers steal
    sensitive user data.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - aws-lambda
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response
    shortlink: https://sg.run/k9vP
    semgrep.dev:
      rule:
        r_id: 18272
        rv_id: 1263343
        rule_id: ReUKrk
        version_id: ExTEx5o
        url: https://semgrep.dev/playground/r/ExTEx5o/python.aws-lambda.security.tainted-html-response.tainted-html-response
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.aws-lambda.security.tainted-sql-string.tainted-sql-string
  languages:
  - python
  message: Detected user input used to manually construct a SQL string. This is usually
    bad practice because manual construction could accidentally result in a SQL injection.
    An attacker could use a SQL injection to steal or modify contents of the database.
    Instead, use a parameterized query which is available by default in most database
    engines. Alternatively, consider using an object-relational mapper (ORM) such
    as Sequelize which will protect your queries.
  metadata:
    references:
    - https://owasp.org/www-community/attacks/SQL_Injection
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string
    shortlink: https://sg.run/wXvA
    semgrep.dev:
      rule:
        r_id: 18273
        rv_id: 1263346
        rule_id: AbU3LX
        version_id: 8KT5ron
        url: https://semgrep.dev/playground/r/8KT5ron/python.aws-lambda.security.tainted-sql-string.tainted-sql-string
        origin: community
  mode: taint
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          "$SQLSTR" + ...
      - pattern: |
          "$SQLSTR" % ...
      - pattern: |
          "$SQLSTR".format(...)
      - pattern: |
          f"$SQLSTR{...}..."
    - metavariable-regex:
        metavariable: $SQLSTR
        regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*=
    - pattern-not-inside: |
        print(...)
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  severity: ERROR
- id: ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli
  languages:
  - ruby
  message: 'Detected SQL statement that is tainted by `event` object. This could lead
    to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use parameterized statements like so: `Example.find_by_sql ["SELECT
    title FROM posts WHERE author = ? AND created > ?", author_id, start_date]`'
  mode: taint
  metadata:
    references:
    - https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - active-record
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli
    shortlink: https://sg.run/vXvY
    semgrep.dev:
      rule:
        r_id: 18277
        rv_id: 1263581
        rule_id: 0oUw9g
        version_id: w8TRor7
        url: https://semgrep.dev/playground/r/w8TRor7/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli
        origin: community
  pattern-sinks:
  - patterns:
    - pattern: $QUERY
    - pattern-either:
      - pattern: ActiveRecord::Base.connection.execute($QUERY,...)
      - pattern: $MODEL.find_by_sql($QUERY,...)
      - pattern: $MODEL.select_all($QUERY,...)
    - pattern-inside: |
        require 'active_record'
        ...
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context)
          ...
        end
  severity: WARNING
- id: ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli
  languages:
  - ruby
  message: 'Detected SQL statement that is tainted by `event` object. This could lead
    to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`'
  mode: taint
  metadata:
    references:
    - https://github.com/brianmario/mysql2
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - mysql2
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli
    shortlink: https://sg.run/dJLE
    semgrep.dev:
      rule:
        r_id: 18278
        rv_id: 1263582
        rule_id: KxUrQ3
        version_id: xyTjzOe
        url: https://semgrep.dev/playground/r/xyTjzOe/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli
        origin: community
  pattern-sinks:
  - patterns:
    - pattern: $QUERY
    - pattern-either:
      - pattern: $CLIENT.query($QUERY,...)
      - pattern: $CLIENT.prepare($QUERY,...)
    - pattern-inside: |
        require 'mysql2'
        ...
  pattern-sanitizers:
  - pattern: $CLIENT.escape(...)
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context)
          ...
        end
  severity: WARNING
- id: ruby.aws-lambda.security.pg-sqli.pg-sqli
  languages:
  - ruby
  message: 'Detected SQL statement that is tainted by `event` object. This could lead
    to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use parameterized statements like so: `conn.exec_params(''SELECT
    $1 AS a, $2 AS b, $3 AS c'', [1, 2, nil])`'
  mode: taint
  metadata:
    references:
    - https://www.rubydoc.info/gems/pg/PG/Connection
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - postgres
    - pg
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli
    shortlink: https://sg.run/ZKww
    semgrep.dev:
      rule:
        r_id: 18279
        rv_id: 1263583
        rule_id: qNUQee
        version_id: O9Tpxz7
        url: https://semgrep.dev/playground/r/O9Tpxz7/ruby.aws-lambda.security.pg-sqli.pg-sqli
        origin: community
  pattern-sinks:
  - patterns:
    - pattern: $QUERY
    - pattern-either:
      - pattern: $CONN.exec($QUERY,...)
      - pattern: $CONN.exec_params($QUERY,...)
      - pattern: $CONN.exec_prepared($QUERY,...)
      - pattern: $CONN.async_exec($QUERY,...)
      - pattern: $CONN.async_exec_params($QUERY,...)
      - pattern: $CONN.async_exec_prepared($QUERY,...)
    - pattern-inside: |
        require 'pg'
        ...
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context)
          ...
        end
  severity: WARNING
- id: ruby.aws-lambda.security.sequel-sqli.sequel-sqli
  languages:
  - ruby
  message: 'Detected SQL statement that is tainted by `event` object. This could lead
    to SQL injection if the variable is user-controlled and not properly sanitized.
    In order to prevent SQL injection, use parameterized queries or prepared statements
    instead. You can use parameterized statements like so: `DB[''select * from items
    where name = ?'', name]`'
  mode: taint
  metadata:
    references:
    - https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    - sequel
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli
    shortlink: https://sg.run/n9vY
    semgrep.dev:
      rule:
        r_id: 18280
        rv_id: 1263584
        rule_id: lBUy2N
        version_id: e1Tyj5j
        url: https://semgrep.dev/playground/r/e1Tyj5j/ruby.aws-lambda.security.sequel-sqli.sequel-sqli
        origin: community
  pattern-sinks:
  - patterns:
    - pattern: $QUERY
    - pattern-either:
      - pattern: DB[$QUERY,...]
      - pattern: DB.run($QUERY,...)
    - pattern-inside: |
        require 'sequel'
        ...
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context)
          ...
        end
  severity: WARNING
- id: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string
  languages:
  - ruby
  severity: ERROR
  message: Detected user input used to manually construct a SQL string. This is usually
    bad practice because manual construction could accidentally result in a SQL injection.
    An attacker could use a SQL injection to steal or modify contents of the database.
    Instead, use a parameterized query which is available by default in most database
    engines. Alternatively, consider using an object-relational mapper (ORM) such
    as Sequelize which will protect your queries.
  metadata:
    references:
    - https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet
    category: security
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    technology:
    - aws-lambda
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string
    shortlink: https://sg.run/EB7N
    semgrep.dev:
      rule:
        r_id: 18281
        rv_id: 1263586
        rule_id: PeUxOE
        version_id: d6Tyx1Z
        url: https://semgrep.dev/playground/r/d6Tyx1Z/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string
        origin: community
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context)
          ...
        end
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: |
            "...#{...}..."
        - pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].*
      - patterns:
        - pattern-either:
          - pattern: Kernel::sprintf("$SQLSTR", ...)
          - pattern: |
              "$SQLSTR" + $EXPR
          - pattern: |
              "$SQLSTR" % $EXPR
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].*
    - pattern-not-inside: |
        puts(...)
- id: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check
  patterns:
  - pattern-inside: |
      import ("github.com/gorilla/websocket")
      ...
  - patterns:
    - pattern-not-inside: |
        $UPGRADER = websocket.Upgrader{..., CheckOrigin: $FN ,...}
        ...
    - pattern-not-inside: |
        $UPGRADER.CheckOrigin = $FN2
        ...
    - pattern: |
        $UPGRADER.Upgrade(...)
  message: 'The Origin header in the HTTP WebSocket handshake is used to guarantee
    that the connection accepted by the WebSocket is from a trusted origin domain.
    Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per "gorilla/websocket"
    documentation: "A CheckOrigin function should carefully validate the request origin
    to prevent cross-site request forgery."'
  languages:
  - go
  severity: WARNING
  metadata:
    category: security
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://pkg.go.dev/github.com/gorilla/websocket#Upgrader
    technology:
    - gorilla
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site Request Forgery (CSRF)
    source: https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check
    shortlink: https://sg.run/xXpz
    semgrep.dev:
      rule:
        r_id: 18430
        rv_id: 1262914
        rule_id: ReUKdz
        version_id: qkTR7RP
        url: https://semgrep.dev/playground/r/qkTR7RP/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check
        origin: community
- id: javascript.aws-lambda.security.tainted-html-string.tainted-html-string
  message: Detected user input flowing into a manually constructed HTML string. You
    may be accidentally bypassing secure methods of rendering HTML by manually constructing
    HTML and this could create a cross-site scripting vulnerability, which could let
    attackers steal sensitive user data. To be sure this is safe, check that the HTML
    is rendered safely. Otherwise, use templates which will safely render HTML instead.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - aws-lambda
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string
    shortlink: https://sg.run/Lgqr
    semgrep.dev:
      rule:
        r_id: 18483
        rv_id: 1263112
        rule_id: PeUxwW
        version_id: DkTRbvp
        url: https://semgrep.dev/playground/r/DkTRbvp/javascript.aws-lambda.security.tainted-html-string.tainted-html-string
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          exports.handler = function ($EVENT, ...) {
            ...
          }
      - pattern-inside: |
          function $FUNC ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
      - pattern-inside: |
          $FUNC = function ($EVENT, ...) {...}
          ...
          exports.handler = $FUNC
    - pattern: $EVENT
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: |
              "$HTMLSTR" + $EXPR
          - pattern: |
              "$HTMLSTR".concat(...)
          - pattern: $UTIL.format($HTMLSTR, ...)
          - pattern: format($HTMLSTR, ...)
        - metavariable-pattern:
            metavariable: $HTMLSTR
            language: generic
            pattern: <$TAG ...
      - patterns:
        - pattern: |
            `...${...}...`
        - pattern-regex: |
            .*<\w+.*
    - pattern-not-inside: |
        console.$LOG(...)
- id: python.aws-lambda.security.tainted-html-string.tainted-html-string
  languages:
  - python
  severity: WARNING
  message: Detected user input flowing into a manually constructed HTML string. You
    may be accidentally bypassing secure methods of rendering HTML by manually constructing
    HTML and this could create a cross-site scripting vulnerability, which could let
    attackers steal sensitive user data. To be sure this is safe, check that the HTML
    is rendered safely. Otherwise, use templates which will safely render HTML instead.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - aws-lambda
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string
    shortlink: https://sg.run/8zNy
    semgrep.dev:
      rule:
        r_id: 18484
        rv_id: 1263344
        rule_id: JDUlwy
        version_id: 7ZTE36K
        url: https://semgrep.dev/playground/r/7ZTE36K/python.aws-lambda.security.tainted-html-string.tainted-html-string
        origin: community
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: '"$HTMLSTR" % ...'
          - pattern: '"$HTMLSTR".format(...)'
          - pattern: '"$HTMLSTR" + ...'
          - pattern: f"$HTMLSTR{...}..."
      - patterns:
        - pattern-inside: |
            $HTML = "$HTMLSTR"
            ...
        - pattern-either:
          - pattern: $HTML % ...
          - pattern: $HTML.format(...)
          - pattern: $HTML + ...
    - metavariable-pattern:
        metavariable: $HTMLSTR
        language: generic
        pattern: <$TAG ...
    - pattern-not-inside: |
        print(...)
- id: scala.lang.security.audit.io-source-ssrf.io-source-ssrf
  patterns:
  - pattern-either:
    - pattern: Source.fromURL($URL,...)
    - pattern: Source.fromURI($URL,...)
  - pattern-inside: |
      import scala.io.$SOURCE
      ...
  - pattern-either:
    - pattern-inside: |
        def $FUNC(..., $URL: $T, ...) = $A {
          ...
        }
    - pattern-inside: |
        def $FUNC(..., $URL: $T, ...) = {
          ...
        }
  message: A parameter being passed directly into `fromURL` most likely lead to SSRF.
    This could allow an attacker to send data to their own server, potentially exposing
    sensitive data sent with this request. They could also probe internal servers
    or other resources that the server running this code can access. Do not allow
    arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode
    the correct host.
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
    - https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource
    category: security
    technology:
    - scala
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf
    shortlink: https://sg.run/Qbz4
    semgrep.dev:
      rule:
        r_id: 18486
        rv_id: 1263675
        rule_id: GdUDOZ
        version_id: 1QTypG9
        url: https://semgrep.dev/playground/r/1QTypG9/scala.lang.security.audit.io-source-ssrf.io-source-ssrf
        origin: community
  languages:
  - scala
  severity: WARNING
- id: scala.play.security.tainted-html-response.tainted-html-response
  mode: taint
  metadata:
    category: security
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    technology:
    - scala
    - play
    confidence: MEDIUM
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response
    shortlink: https://sg.run/BG96
    semgrep.dev:
      rule:
        r_id: 18795
        rv_id: 1263686
        rule_id: 0oUwn2
        version_id: vdT06yj
        url: https://semgrep.dev/playground/r/vdT06yj/scala.play.security.tainted-html-response.tainted-html-response
        origin: community
  message: Detected a request with potential user-input going into an `Ok()` response.
    This bypasses any view or template environments, including HTML escaping, which
    may expose this application to cross-site scripting (XSS) vulnerabilities. Consider
    using a view technology such as Twirl which automatically escapes HTML views.
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: $REQ
        - pattern-either:
          - pattern-inside: "Action {\n  $REQ: Request[$T] => \n    ...\n}\n"
          - pattern-inside: "Action(...) {\n  $REQ: Request[$T] => \n    ...\n}\n"
          - pattern-inside: "Action.async {\n  $REQ: Request[$T] => \n    ...\n}\n"
          - pattern-inside: "Action.async(...) {\n  $REQ: Request[$T] => \n    ...\n}\n"
      - patterns:
        - pattern: $PARAM
        - pattern-either:
          - pattern-inside: |
              def $CTRL(..., $PARAM: $TYPE, ...) = Action {
                ...
              }
          - pattern-inside: |
              def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {
                ...
              }
          - pattern-inside: |
              def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {
                ...
              }
          - pattern-inside: |
              def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {
                ...
              }
  pattern-sanitizers:
  - pattern-either:
    - pattern: org.apache.commons.lang3.StringEscapeUtils.escapeHtml4(...)
    - pattern: org.owasp.encoder.Encode.forHtml(...)
  pattern-sinks:
  - pattern-either:
    - pattern: Html.apply(...)
    - pattern: Ok(...).as(HTML)
    - pattern: Ok(...).as(ContentTypes.HTML)
    - patterns:
      - pattern: Ok(...).as($CTYPE)
      - metavariable-regex:
          metavariable: $CTYPE
          regex: '"[tT][eE][xX][tT]/[hH][tT][mM][lL]"'
    - patterns:
      - pattern: Ok(...).as($CTYPE)
      - pattern-not: Ok(...).as("...")
      - pattern-either:
        - pattern-inside: |
            def $FUNC(..., $URL: $T, ...) = $A {
              ...
            }
        - pattern-inside: |
            def $FUNC(..., $URL: $T, ...) = {
              ...
            }
  severity: WARNING
  languages:
  - scala
- id: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled
  patterns:
  - pattern-either:
    - pattern: |
        $DF = DocumentBuilderFactory.newInstance(...)
        ...
        $DB = $DF.newDocumentBuilder(...)
    - patterns:
      - pattern: $DB = DocumentBuilderFactory.newInstance(...)
      - pattern-not-inside: |
          ...
          $X = $DB.newDocumentBuilder(...)
    - pattern: $DB = DocumentBuilderFactory.newInstance(...).newDocumentBuilder(...)
  - pattern-not-inside: |
      ...
      $DB.setXIncludeAware(true)
      ...
      $DB.setNamespaceAware(true)
      ...
      $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
      ...
      $DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
      ...
      $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
  - pattern-not-inside: |
      ...
      $DB.setXIncludeAware(true)
      ...
      $DB.setNamespaceAware(true)
      ...
      $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
      ...
      $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
      ...
      $DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
  - pattern-not-inside: |
      ...
      $DB.setXIncludeAware(true)
      ...
      $DB.setNamespaceAware(true)
      ...
      $DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
      ...
      $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
      ...
      $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
  - pattern-not-inside: |
      ...
      $DB.setXIncludeAware(true)
      ...
      $DB.setNamespaceAware(true)
      ...
      $DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
      ...
      $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
      ...
      $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
  message: Document Builder being instantiated without calling the `setFeature` functions
    that are generally used for disabling entity processing. User controlled data
    in XML Document builder can result in XML Internal Entity Processing vulnerabilities
    like the disclosure of confidential data, denial of service, Server Side Request
    Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.
  languages:
  - scala
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - scala
    confidence: HIGH
    references:
    - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled
    shortlink: https://sg.run/gRQn
    semgrep.dev:
      rule:
        r_id: 19041
        rv_id: 1263673
        rule_id: 0oUwzP
        version_id: X0TzyRq
        url: https://semgrep.dev/playground/r/X0TzyRq/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled
        origin: community
- id: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled
  patterns:
  - pattern-either:
    - pattern: $SR = new SAXReader(...)
    - pattern: |
        $SF = SAXParserFactory.newInstance(...)
        ...
        $SR = $SF.newSAXParser(...)
    - patterns:
      - pattern: $SR = SAXParserFactory.newInstance(...)
      - pattern-not-inside: |
          ...
          $X = $SR.newSAXParser(...)
    - pattern: $SR = SAXParserFactory.newInstance(...).newSAXParser(...)
    - pattern: $SR = new SAXBuilder(...)
  - pattern-not-inside: |
      ...
      $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
      ...
      $SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
      ...
      $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
  - pattern-not-inside: |
      ...
      $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
      ...
      $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
      ...
      $SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
  - pattern-not-inside: |
      ...
      $SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
      ...
      $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
      ...
      $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
  - pattern-not-inside: |
      ...
      $SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
      ...
      $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
      ...
      $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
  message: XML processor being instantiated without calling the `setFeature` functions
    that are generally used for disabling entity processing. User controlled data
    in XML Parsers can result in XML Internal Entity Processing vulnerabilities like
    the disclosure of confidential data, denial of service, Server Side Request Forgery
    (SSRF), port scanning. Make sure to disable entity processing functionality.
  languages:
  - scala
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - scala
    confidence: HIGH
    references:
    - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled
    shortlink: https://sg.run/QbYP
    semgrep.dev:
      rule:
        r_id: 19042
        rv_id: 1263678
        rule_id: KxUrkq
        version_id: rxTAKWY
        url: https://semgrep.dev/playground/r/rxTAKWY/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled
        origin: community
- id: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled
  patterns:
  - pattern-not-inside: |
      ...
      $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false)
  - pattern-either:
    - pattern: $XMLFACTORY = XMLInputFactory.newFactory(...)
    - pattern: $XMLFACTORY = XMLInputFactory.newInstance(...)
    - pattern: $XMLFACTORY = new XMLInputFactory(...)
  message: XMLInputFactory being instantiated without calling the setProperty functions
    that are generally used for disabling entity processing. User controlled data
    in XML Document builder can result in XML Internal Entity Processing vulnerabilities
    like the disclosure of confidential data, denial of service, Server Side Request
    Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.
  languages:
  - scala
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - scala
    confidence: HIGH
    references:
    - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled
    shortlink: https://sg.run/3BEb
    semgrep.dev:
      rule:
        r_id: 19043
        rv_id: 1263683
        rule_id: qNUQ7w
        version_id: xyTjzkA
        url: https://semgrep.dev/playground/r/xyTjzkA/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled
        origin: community
- id: scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass
  patterns:
  - pattern-either:
    - pattern: X-Requested-With = "*"
    - pattern: Csrf-Token = "..."
  - pattern-inside: |
      bypassHeaders {...
      ...
      ...}
  - pattern-not-inside: |
      {...
        ...
        ...blackList = [..."application/x-www-form-urlencoded"..."multipart/form-data"..."text/plain"...]
        ...
      ...}
  - pattern-not-inside: |
      {...
        ...
        ...blackList = [..."application/x-www-form-urlencoded"..."text/plain"..."multipart/form-data"...]
        ...
      ...}
  - pattern-not-inside: |
      {...
        ...
        ...blackList = [..."multipart/form-data"..."application/x-www-form-urlencoded"..."text/plain"...]
        ...
      ...}
  - pattern-not-inside: |
      {...
        ...
        ...blackList = [..."multipart/form-data"..."text/plain"..."application/x-www-form-urlencoded"...]
        ...
      ...}
  - pattern-not-inside: |
      {...
        ...
        ...blackList = [..."text/plain"..."application/x-www-form-urlencoded"..."multipart/form-data"...]
        ...
      ...}
  - pattern-not-inside: |
      {...
        ...
        ...blackList = [..."text/plain"..."multipart/form-data"..."application/x-www-form-urlencoded"...]
        ...
      ...}
  message: "Possibly bypassable CSRF configuration found. CSRF is an attack that forces
    an end user to execute unwanted actions on a web application in which they\u2019re
    currently authenticated. Make sure that Content-Type black list is configured
    and CORS filter is turned on."
  languages:
  - generic
  severity: ERROR
  paths:
    include:
    - '*.conf'
  metadata:
    references:
    - https://www.playframework.com/documentation/2.8.x/Migration25#CSRF-changes
    - https://owasp.org/www-community/attacks/csrf
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    category: security
    technology:
    - scala
    - play
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site Request Forgery (CSRF)
    source: https://semgrep.dev/r/scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass
    shortlink: https://sg.run/4DEE
    semgrep.dev:
      rule:
        r_id: 19044
        rv_id: 1263684
        rule_id: lBUyRR
        version_id: O9Tpx53
        url: https://semgrep.dev/playground/r/O9Tpx53/scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass
        origin: community
- id: ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include
  mode: search
  paths:
    include:
    - '*.erb'
  patterns:
  - pattern: |
      params[...]
  - pattern-inside: |
      render :file => ...
  message: Found request parameters in a call to `render` in a dynamic context. This
    can allow end users to request arbitrary local files which may result in leaking
    sensitive information persisted on disk.
  languages:
  - generic
  severity: WARNING
  metadata:
    technology:
    - ruby
    - rails
    category: security
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb
    references:
    - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
    - https://github.com/presidentbeef/brakeman/blob/f74cb53ead47f0af821d98b5b41e16d63100c240/test/apps/rails2/app/views/home/test_render.html.erb
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include
    shortlink: https://sg.run/3QWl
    semgrep.dev:
      rule:
        r_id: 20043
        rv_id: 1263651
        rule_id: JDUokO
        version_id: QkTGq9X
        url: https://semgrep.dev/playground/r/QkTGq9X/ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include
        origin: community
- id: ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: params[...]
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          render ..., file: $X
      - pattern: |
          render ..., inline: $X
      - pattern: |
          render ..., template: $X
      - pattern: |
          render ..., action: $X
      - pattern: |
          render $X, ...
    - focus-metavariable: $X
  pattern-sanitizers:
  - patterns:
    - pattern: $MAP[...]
    - metavariable-pattern:
        metavariable: $MAP
        patterns:
        - pattern-not-regex: params
  - pattern: File.basename(...)
  message: Found request parameters in a call to `render`. This can allow end users
    to request arbitrary local files which may result in leaking sensitive information
    persisted on disk. Where possible, avoid letting users specify template paths
    for `render`. If you must allow user input, use an allow-list of known templates
    or normalize the user-supplied value with `File.basename(...)`.
  languages:
  - ruby
  severity: WARNING
  metadata:
    technology:
    - ruby
    - rails
    category: security
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb
    references:
    - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
    - https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    vulnerability_class:
    - Path Traversal
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include
    shortlink: https://sg.run/Jw8Z
    semgrep.dev:
      rule:
        r_id: 20046
        rv_id: 1409407
        rule_id: ReU2pZ
        version_id: K3TgANN
        url: https://semgrep.dev/playground/r/K3TgANN/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include
        origin: community
- id: scala.lang.security.audit.tainted-sql-string.tainted-sql-string
  languages:
  - scala
  severity: ERROR
  mode: taint
  message: User data flows into this manually-constructed SQL string. User data can
    be safely inserted into SQL strings using prepared statements or an object-relational
    mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
    injection, which could let an attacker steal or manipulate data from the database.
    Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html
    category: security
    technology:
    - scala
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/scala.lang.security.audit.tainted-sql-string.tainted-sql-string
    shortlink: https://sg.run/ALD6
    semgrep.dev:
      rule:
        r_id: 20050
        rv_id: 1263682
        rule_id: WAUY8B
        version_id: w8TRoO6
        url: https://semgrep.dev/playground/r/w8TRoO6/scala.lang.security.audit.tainted-sql-string.tainted-sql-string
        origin: community
  pattern-sources:
  - patterns:
    - pattern: $PARAM
    - pattern-either:
      - pattern-inside: |
          def $CTRL(..., $PARAM: $TYPE, ...) = {
            ...
          }
      - pattern-inside: |
          def $CTRL(..., $PARAM: $TYPE, ...) = $A {
            ...
          }
      - pattern-inside: |
          def $CTRL(..., $PARAM: $TYPE, ...) = $A(...) {
            ...
          }
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: |
              "$SQLSTR" + ...
          - pattern: |
              "$SQLSTR".format(...)
          - patterns:
            - pattern-inside: |
                $SB = new StringBuilder("$SQLSTR");
                ...
            - pattern: $SB.append(...)
          - patterns:
            - pattern-inside: |
                $VAR = "$SQLSTR"
                ...
            - pattern: $VAR += ...
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: (?i)(select|delete|insert|create|update|alter|drop)\b
      - patterns:
        - pattern-either:
          - pattern: s"..."
          - pattern: f"..."
        - pattern-regex: |
            .*\b(?i)(select|delete|insert|create|update|alter|drop)\b.*
    - pattern-not-inside: println(...)
    - pattern-not-inside: throw new $EXCEPTION(...)
  pattern-sanitizers:
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern: $LOGGER.$METHOD(...)
        - pattern: $LOGGER(...)
      - metavariable-regex:
          metavariable: $LOGGER
          regex: (i?)log.*
    - patterns:
      - pattern: $LOGGER.$METHOD(...)
      - metavariable-regex:
          metavariable: $METHOD
          regex: (i?)(trace|info|warn|warning|warnToError|error|debug)
- id: scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request
  languages:
  - scala
  severity: ERROR
  mode: taint
  message: User data flows into this manually-constructed SQL string. User data can
    be safely inserted into SQL strings using prepared statements or an object-relational
    mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
    injection, which could let an attacker steal or manipulate data from the database.
    Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html
    category: security
    technology:
    - scala
    - play
    confidence: HIGH
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request
    shortlink: https://sg.run/BeW9
    semgrep.dev:
      rule:
        r_id: 20051
        rv_id: 1263688
        rule_id: 0oUpon
        version_id: ZRTKAoG
        url: https://semgrep.dev/playground/r/ZRTKAoG/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request
        origin: community
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: $REQ
        - pattern-either:
          - pattern-inside: "Action {\n  $REQ: Request[$T] => \n    ...\n}\n"
          - pattern-inside: "Action(...) {\n  $REQ: Request[$T] => \n    ...\n}\n"
          - pattern-inside: "Action.async {\n  $REQ: Request[$T] => \n    ...\n}\n"
          - pattern-inside: "Action.async(...) {\n  $REQ: Request[$T] => \n    ...\n}\n"
      - patterns:
        - pattern: $PARAM
        - pattern-either:
          - pattern-inside: |
              def $CTRL(..., $PARAM: $TYPE, ...) = Action {
                ...
              }
          - pattern-inside: |
              def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {
                ...
              }
          - pattern-inside: |
              def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {
                ...
              }
          - pattern-inside: |
              def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {
                ...
              }
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: |
              "$SQLSTR" + ...
          - pattern: |
              "$SQLSTR".format(...)
          - patterns:
            - pattern-inside: |
                $SB = new StringBuilder("$SQLSTR");
                ...
            - pattern: $SB.append(...)
          - patterns:
            - pattern-inside: |
                $VAR = "$SQLSTR"
                ...
            - pattern: $VAR += ...
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: (?i)(select|delete|insert|create|update|alter|drop)\b
      - patterns:
        - pattern: s"..."
        - pattern-regex: |
            .*\b(?i)(select|delete|insert|create|update|alter|drop)\b.*
    - pattern-not-inside: println(...)
- id: yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file
  patterns:
  - pattern: |
      $KEY: $VALUE
  - pattern-inside: |
      data: ...
  - pattern-inside: |
      kind: Secret
      ...
  - metavariable-regex:
      metavariable: $VALUE
      regex: (?i)^[aA-zZ0-9+/]+={0,2}$
  - metavariable-analysis:
      analyzer: entropy
      metavariable: $VALUE
  message: 'Secrets ($VALUE) should not be stored in infrastructure as code files.
    Use an alternative such as Bitnami Sealed Secrets or KSOPS to encrypt Kubernetes
    Secrets. '
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    category: security
    technology:
    - kubernetes
    references:
    - https://kubernetes.io/docs/concepts/configuration/secret/
    - https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR_Kubernetes_Hardening_Guidance_1.1_20220315.PDF
    - https://docs.gitlab.com/ee/user/clusters/agent/gitops/secrets_management.html
    - https://www.cncf.io/blog/2021/04/22/revealing-the-secrets-of-kubernetes-secrets/
    - https://github.com/bitnami-labs/sealed-secrets
    - https://www.cncf.io/blog/2022/01/25/secrets-management-essential-when-using-kubernetes/
    - https://blog.oddbit.com/post/2021-03-09-getting-started-with-ksops/
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file
    shortlink: https://sg.run/KyL6
    semgrep.dev:
      rule:
        r_id: 20055
        rv_id: 1263942
        rule_id: YGUYEb
        version_id: xyTjz5B
        url: https://semgrep.dev/playground/r/xyTjz5B/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file
        origin: community
  languages:
  - yaml
  severity: WARNING
- id: ruby.rails.security.brakeman.check-sql.check-sql
  mode: taint
  pattern-sources:
  - pattern-either:
    - pattern: |
        cookies[...]
    - patterns:
      - pattern: |
          cookies. ... .$PROPERTY[...]
      - metavariable-regex:
          metavariable: $PROPERTY
          regex: (?!signed|encrypted)
    - pattern: |
        params[...]
    - pattern: |
        request.env[...]
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: $X
        - pattern-either:
          - pattern-inside: |
              :$KEY => $X
          - pattern-inside: |
              ["...",$X,...]
      - pattern: |
          params[...].to_i
      - pattern: |
          params[...].to_f
      - patterns:
        - pattern: |
            params[...] ? $A : $B
        - metavariable-pattern:
            metavariable: $A
            patterns:
            - pattern-not: |
                params[...]
        - metavariable-pattern:
            metavariable: $B
            patterns:
            - pattern-not: |
                params[...]
  pattern-sinks:
  - patterns:
    - pattern: $X
    - pattern-not-inside: |
        $P.where("...",...)
    - pattern-not-inside: |
        $P.where(:$KEY => $VAL,...)
    - pattern-either:
      - pattern-inside: |
          $P.$M(...)
      - pattern-inside: |
          $P.$M("...",...)
    - pattern-inside: |
        class $P < ActiveRecord::Base
          ...
        end
    - metavariable-regex:
        metavariable: $M
        regex: (where|find|first|last|select|minimum|maximum|calculate|sum|average)
  message: Found potential SQL injection due to unsafe SQL query construction via
    $X. Where possible, prefer parameterized queries.
  languages:
  - ruby
  severity: ERROR
  metadata:
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_sql.rb
    category: security
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    technology:
    - ruby
    - rails
    references:
    - https://owasp.org/www-community/attacks/SQL_Injection
    - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql
    shortlink: https://sg.run/vpgb
    semgrep.dev:
      rule:
        r_id: 20533
        rv_id: 1263661
        rule_id: OrUv2z
        version_id: DkTRbE4
        url: https://semgrep.dev/playground/r/DkTRbE4/ruby.rails.security.brakeman.check-sql.check-sql
        origin: community
- id: ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods
  mode: taint
  pattern-sources:
  - pattern-either:
    - pattern: |
        cookies[...]
    - patterns:
      - pattern: |
          cookies. ... .$PROPERTY[...]
      - metavariable-regex:
          metavariable: $PROPERTY
          regex: (?!signed|encrypted)
    - pattern: |
        params[...]
    - pattern: |
        request.env[...]
  pattern-sinks:
  - patterns:
    - pattern: $X
    - pattern-either:
      - pattern-inside: |
          $X. ... .to_proc
      - patterns:
        - pattern-inside: |
            $Y.method($Z)
        - focus-metavariable: $Z
      - patterns:
        - pattern-inside: |
            $Y.tap($Z)
        - focus-metavariable: $Z
      - patterns:
        - pattern-inside: |
            $Y.tap{ |$ANY| $Z }
        - focus-metavariable: $Z
  message: Found user-controllable input to a reflection method. This may allow a
    user to alter program behavior and potentially execute arbitrary instructions
    in the context of the process. Do not provide arbitrary user input to `tap`, `method`,
    or `to_proc`
  languages:
  - ruby
  severity: ERROR
  metadata:
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection_methods.rb
    category: security
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    technology:
    - ruby
    - rails
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb
    cwe2022-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods
    shortlink: https://sg.run/dPYd
    semgrep.dev:
      rule:
        r_id: 20534
        rv_id: 1263662
        rule_id: eqUZ2Q
        version_id: WrTqKLA
        url: https://semgrep.dev/playground/r/WrTqKLA/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods
        origin: community
- id: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase
  message: Found the use of an hardcoded passphrase for RSA. The passphrase can be
    easily discovered, and therefore should not be stored in source-code. It is recommended
    to remove the passphrase from source-code, and use system environment variables
    or a restricted configuration file.
  languages:
  - ruby
  severity: WARNING
  metadata:
    technology:
    - ruby
    - secrets
    category: security
    references:
    - https://cwe.mitre.org/data/definitions/522.html
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase
    shortlink: https://sg.run/xPEe
    semgrep.dev:
      rule:
        r_id: 20730
        rv_id: 1263607
        rule_id: bwULyN
        version_id: K3TKkEo
        url: https://semgrep.dev/playground/r/K3TKkEo/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase
        origin: community
  patterns:
  - pattern-either:
    - pattern: OpenSSL::PKey::RSA.new(..., '...')
    - pattern: OpenSSL::PKey::RSA.new(...).to_pem(..., '...')
    - pattern: OpenSSL::PKey::RSA.new(...).export(..., '...')
    - patterns:
      - pattern-inside: |
          $OPENSSL = OpenSSL::PKey::RSA.new(...)
          ...
      - pattern-either:
        - pattern: |
            $OPENSSL.export(...,'...')
        - pattern: |
            $OPENSSL.to_pem(...,'...')
    - patterns:
      - pattern-either:
        - patterns:
          - pattern-inside: |
              $ASSIGN = '...'
              ...
          - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN)
        - patterns:
          - pattern-inside: |
              def $METHOD1(...)
              ...
              $ASSIGN = '...'
              ...
              end
              ...
              def $METHOD2(...)
              ...
              end
          - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN)
        - patterns:
          - pattern-inside: |
              $ASSIGN = '...'
              ...
              def $METHOD(...)
                $OPENSSL = OpenSSL::PKey::RSA.new(...)
              ...
              end
              ...
          - pattern-either:
            - pattern: $OPENSSL.export(...,$ASSIGN)
            - pattern: $OPENSSL.to_pem(...,$ASSIGN)
        - patterns:
          - pattern-inside: |
              def $METHOD1(...)
              ...
              $OPENSSL = OpenSSL::PKey::RSA.new(...)
              ...
              $ASSIGN = '...'
              ...
              end
              ...
          - pattern-either:
            - pattern: $OPENSSL.export(...,$ASSIGN)
            - pattern: $OPENSSL.to_pem(...,$ASSIGN)
        - patterns:
          - pattern-inside: |
              def $METHOD1(...)
              ...
              $ASSIGN = '...'
              ...
              end
              ...
              def $METHOD2(...)
              ...
              $OPENSSL = OpenSSL::PKey::RSA.new(...)
              ...
              end
              ...
          - pattern-either:
            - pattern: $OPENSSL.export(...,$ASSIGN)
            - pattern: $OPENSSL.to_pem(...,$ASSIGN)
- id: ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection
  mode: taint
  pattern-sources:
  - pattern-either:
    - pattern: |
        cookies[...]
    - patterns:
      - pattern: |
          cookies. ... .$PROPERTY[...]
      - metavariable-regex:
          metavariable: $PROPERTY
          regex: (?!signed|encrypted)
    - pattern: |
        params[...]
    - pattern: |
        request.env[...]
  pattern-sinks:
  - patterns:
    - pattern: $X
    - pattern-either:
      - pattern-inside: |
          $X.constantize
      - pattern-inside: |
          $X. ... .safe_constantize
      - pattern-inside: |
          const_get(...)
      - pattern-inside: |
          qualified_const_get(...)
  message: Found user-controllable input to Ruby reflection functionality. This allows
    a remote user to influence runtime behavior, up to and including arbitrary remote
    code execution. Do not provide user-controllable input to reflection functionality.
    Do not call symbol conversion on user-controllable input.
  languages:
  - ruby
  severity: ERROR
  metadata:
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection.rb
    category: security
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    technology:
    - ruby
    - rails
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb
    cwe2022-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection
    shortlink: https://sg.run/vpEX
    semgrep.dev:
      rule:
        r_id: 20733
        rv_id: 1263663
        rule_id: wdUkYA
        version_id: 0bTKzn8
        url: https://semgrep.dev/playground/r/0bTKzn8/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection
        origin: community
- id: python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally
  patterns:
  - pattern-inside: |
      $CONFIG.set_default_csrf_options(..., check_origin=$CHECK_ORIGIN, ...)
  - pattern: $CHECK_ORIGIN
  - metavariable-comparison:
      metavariable: $CHECK_ORIGIN
      comparison: $CHECK_ORIGIN == False
  message: Automatic check of the referrer for cross-site request forgery tokens has
    been explicitly disabled globally, which might leave views unprotected when an
    unsafe CSRF storage policy is used. Use 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)'
    to turn the automatic check for all unsafe methods (per RFC2616).
  languages:
  - python
  severity: ERROR
  fix: |
    True
  metadata:
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    category: security
    technology:
    - pyramid
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site Request Forgery (CSRF)
    source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally
    shortlink: https://sg.run/3GeW
    semgrep.dev:
      rule:
        r_id: 21443
        rv_id: 1263563
        rule_id: eqU9Le
        version_id: K3TKkeo
        url: https://semgrep.dev/playground/r/K3TKkeo/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally
        origin: community
- id: python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled
  message: Origin check for the CSRF token is disabled for this view. This might represent
    a security risk if the CSRF storage policy is not known to be secure.
  metadata:
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    asvs:
      section: V4 Access Control
      control_id: 4.2.2 CSRF
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control
      version: '4'
    category: security
    technology:
    - pyramid
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site Request Forgery (CSRF)
    source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled
    shortlink: https://sg.run/4RB9
    semgrep.dev:
      rule:
        r_id: 21444
        rv_id: 1263564
        rule_id: v8UGpL
        version_id: qkTR7Gv
        url: https://semgrep.dev/playground/r/qkTR7Gv/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled
        origin: community
  severity: WARNING
  languages:
  - python
  patterns:
  - pattern-inside: |
      from pyramid.view import view_config
      ...
      @view_config(..., check_origin=$CHECK_ORIGIN, ...)
      def $VIEW(...):
        ...
  - pattern: $CHECK_ORIGIN
  - metavariable-comparison:
      metavariable: $CHECK_ORIGIN
      comparison: $CHECK_ORIGIN == False
  fix: |
    True
- id: python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally
  patterns:
  - pattern-inside: |
      $CONFIG.set_default_csrf_options(..., require_csrf=$REQUIRE_CSRF, ...)
  - pattern: $REQUIRE_CSRF
  - metavariable-comparison:
      metavariable: $REQUIRE_CSRF
      comparison: $REQUIRE_CSRF == False
  message: Automatic check of cross-site request forgery tokens has been explicitly
    disabled globally, which might leave views unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)'
    to turn the automatic check for all unsafe methods (per RFC2616).
  languages:
  - python
  severity: ERROR
  fix: |
    True
  metadata:
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    category: security
    technology:
    - pyramid
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site Request Forgery (CSRF)
    source: https://semgrep.dev/r/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally
    shortlink: https://sg.run/Bx2R
    semgrep.dev:
      rule:
        r_id: 21451
        rv_id: 1263571
        rule_id: 8GUKqP
        version_id: 2KTv2en
        url: https://semgrep.dev/playground/r/2KTv2en/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally
        origin: community
- id: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response
  message: Detected data rendered directly to the end user via 'Response'. This bypasses
    Pyramid's built-in cross-site scripting (XSS) defenses and could result in an
    XSS vulnerability. Use Pyramid's template engines to safely render HTML.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - pyramid
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response
    shortlink: https://sg.run/DX8G
    semgrep.dev:
      rule:
        r_id: 21452
        rv_id: 1263572
        rule_id: gxUeA8
        version_id: X0TzyEe
        url: https://semgrep.dev/playground/r/X0TzyEe/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response
        origin: community
  languages:
  - python
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-inside: |
        @pyramid.view.view_config( ... )
        def $VIEW($REQ):
          ...
    - pattern: $REQ.$ANYTHING
    - pattern-not: $REQ.dbsession
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          pyramid.request.Response.text($SINK)
      - pattern: |
          pyramid.request.Response($SINK)
      - pattern: |
          $REQ.response.body = $SINK
      - pattern: |
          $REQ.response.text = $SINK
      - pattern: |
          $REQ.response.ubody = $SINK
      - pattern: |
          $REQ.response.unicode_body = $SINK
    - pattern: $SINK
- id: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection
  message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause
    sql injections if the developer inputs raw SQL into the before-mentioned clauses.
    This pattern captures relevant cases in which the developer inputs raw SQL into
    the distinct, having, group_by, order_by or filter clauses and injects user-input
    into the raw SQL with any function besides "bindparams". Use bindParams to securely
    bind user-input to SQL statements.
  languages:
  - python
  severity: ERROR
  metadata:
    category: security
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data
    technology:
    - pyramid
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection
    shortlink: https://sg.run/W7eE
    semgrep.dev:
      rule:
        r_id: 21453
        rv_id: 1263573
        rule_id: QrUZ7l
        version_id: jQTn5WA
        url: https://semgrep.dev/playground/r/jQTn5WA/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection
        origin: community
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-inside: |
        from pyramid.view import view_config
        ...
        @view_config( ... )
        def $VIEW($REQ):
          ...
    - pattern: $REQ.$ANYTHING
    - pattern-not: $REQ.dbsession
  pattern-sinks:
  - patterns:
    - pattern-inside: |
        $QUERY = $REQ.dbsession.query(...)
        ...
    - pattern-either:
      - pattern: |
          $QUERY.$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...))
      - pattern: |
          $QUERY.join(...).$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...))
    - pattern: $SINK
    - metavariable-regex:
        metavariable: $SQLFUNC
        regex: (group_by|order_by|distinct|having|filter)
    - metavariable-regex:
        metavariable: $FORMATFUNC
        regex: (?!bindparams)
  fix-regex:
    regex: format
    replacement: bindparams
- id: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint
  message: Use of angular.element can lead to XSS if user-input is treated as part
    of the HTML element within `$SINK`. It is recommended to contextually output encode
    user-input, before inserting into `$SINK`. If the HTML needs to be preserved it
    is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.
  metadata:
    confidence: MEDIUM
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    references:
    - https://docs.angularjs.org/api/ng/function/angular.element
    - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
    category: security
    technology:
    - angularjs
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint
    shortlink: https://sg.run/5AQ0
    semgrep.dev:
      rule:
        r_id: 21503
        rv_id: 1263091
        rule_id: GdUP71
        version_id: 44TEj8L
        url: https://semgrep.dev/playground/r/44TEj8L/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: window.location.search
      - pattern: window.document.location.search
      - pattern: document.location.search
      - pattern: location.search
      - pattern: $location.search(...)
  - patterns:
    - pattern-either:
      - pattern: $DECODE(<... location.hash ...>)
      - pattern: $DECODE(<... window.location.hash ...>)
      - pattern: $DECODE(<... document.location.hash ...>)
      - pattern: $DECODE(<... location.href ...>)
      - pattern: $DECODE(<... window.location.href ...>)
      - pattern: $DECODE(<... document.location.href ...>)
      - pattern: $DECODE(<... document.URL ...>)
      - pattern: $DECODE(<... window.document.URL ...>)
      - pattern: $DECODE(<... document.location.href ...>)
      - pattern: $DECODE(<... document.location.href ...>)
      - pattern: $DECODE(<... $location.absUrl() ...>)
      - pattern: $DECODE(<... $location.url() ...>)
      - pattern: $DECODE(<... $location.hash() ...>)
    - metavariable-regex:
        metavariable: $DECODE
        regex: ^(unescape|decodeURI|decodeURIComponent)$
  - patterns:
    - pattern-inside: $http.$METHOD(...).$CONTINUE(function $FUNC($RES) {...})
    - metavariable-regex:
        metavariable: $METHOD
        regex: ^(get|delete|head|jsonp|post|put|patch)
    - pattern: $RES.data
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          angular.element(...). ... .$SINK($QUERY)
      - pattern-inside: |
          $ANGULAR = angular.element(...)
          ...
          $ANGULAR. ... .$SINK($QUERY)
    - metavariable-regex:
        metavariable: $SINK
        regex: ^(after|append|html|prepend|replaceWith|wrap)$
    - focus-metavariable: $QUERY
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern: $sce.getTrustedHtml(...)
      - pattern: $sanitize(...)
      - pattern: DOMPurify.sanitize(...)
- id: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context):
          ...
  pattern-sinks:
  - patterns:
    - focus-metavariable: $SINK
    - pattern-either:
      - pattern: pickle.load($SINK,...)
      - pattern: pickle.loads($SINK,...)
      - pattern: _pickle.load($SINK,...)
      - pattern: _pickle.loads($SINK,...)
      - pattern: cPickle.load($SINK,...)
      - pattern: cPickle.loads($SINK,...)
      - pattern: dill.load($SINK,...)
      - pattern: dill.loads($SINK,...)
      - pattern: shelve.open($SINK,...)
  message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities.
    When unpickling, the serialized data could be manipulated to run arbitrary code.
    Instead, consider serializing the relevant data as JSON or a similar text-based
    serialization format.
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    - https://davidhamann.de/2020/04/05/exploiting-python-pickle/
    category: security
    technology:
    - python
    - aws-lambda
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization
    shortlink: https://sg.run/JbjW
    semgrep.dev:
      rule:
        r_id: 21602
        rv_id: 1263345
        rule_id: JDUDQg
        version_id: LjTkgd9
        url: https://semgrep.dev/playground/r/LjTkgd9/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization
        origin: community
  languages:
  - python
  severity: WARNING
- id: php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection
  mode: taint
  pattern-sources:
  - patterns:
    - focus-metavariable: $ARG
    - pattern-inside: |
        Route::$METHOD($ROUTE_NAME, function(...,$ARG,...){...})
  pattern-sanitizers:
  - patterns:
    - pattern: |
        DB::raw("...",[...])
  pattern-sinks:
  - patterns:
    - pattern: |
        DB::raw(...)
  message: HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL
    injection via string concatenation or unsafe interpolation.
  languages:
  - php
  severity: WARNING
  metadata:
    category: security
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md
    technology:
    - php
    - laravel
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection
    shortlink: https://sg.run/x94g
    semgrep.dev:
      rule:
        r_id: 21674
        rv_id: 1263305
        rule_id: zdUln0
        version_id: qkTR7A9
        url: https://semgrep.dev/playground/r/qkTR7A9/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection
        origin: community
- id: php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: |
        public function $F(...,Request $R,...){...}
    - focus-metavariable: $R
  - patterns:
    - pattern-either:
      - pattern: |
          $this->$PROPERTY
      - pattern: |
          $this->$PROPERTY->$GET
    - metavariable-pattern:
        metavariable: $PROPERTY
        patterns:
        - pattern-either:
          - pattern: query
          - pattern: request
          - pattern: headers
          - pattern: cookies
          - pattern: cookie
          - pattern: files
          - pattern: file
          - pattern: allFiles
          - pattern: input
          - pattern: all
          - pattern: post
          - pattern: json
    - pattern-either:
      - pattern-inside: |
          class $CL extends Illuminate\Http\Request {...}
      - pattern-inside: |
          class $CL extends Illuminate\Foundation\Http\FormRequest {...}
  pattern-sinks:
  - patterns:
    - pattern: |
        Illuminate\Validation\Rule::unique(...)->ignore(...,$IGNORE,...)
    - focus-metavariable: $IGNORE
  message: Found a request argument passed to an `ignore()` definition in a Rule constraint.
    This can lead to SQL injection.
  languages:
  - php
  severity: ERROR
  metadata:
    category: security
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    technology:
    - php
    - laravel
    references:
    - https://laravel.com/docs/9.x/validation#rule-unique
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator
    shortlink: https://sg.run/vkeb
    semgrep.dev:
      rule:
        r_id: 21677
        rv_id: 1263314
        rule_id: X5ULgE
        version_id: DkTRbBl
        url: https://semgrep.dev/playground/r/DkTRbBl/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator
        origin: community
- id: java.spring.security.injection.tainted-html-string.tainted-html-string
  languages:
  - java
  severity: ERROR
  message: Detected user input flowing into a manually constructed HTML string. You
    may be accidentally bypassing secure methods of rendering HTML by manually constructing
    HTML and this could create a cross-site scripting vulnerability, which could let
    attackers steal sensitive user data. To be sure this is safe, check that the HTML
    is rendered safely. You can use the OWASP ESAPI encoder if you must render user
    data.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - java
    - spring
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string
    shortlink: https://sg.run/ObdR
    semgrep.dev:
      rule:
        r_id: 22075
        rv_id: 1409395
        rule_id: YGUvkL
        version_id: 3ZT2598
        url: https://semgrep.dev/playground/r/3ZT2598/java.spring.security.injection.tainted-html-string.tainted-html-string
        origin: community
  mode: taint
  pattern-sources:
  - label: INPUT
    patterns:
    - pattern-either:
      - pattern-inside: |
          $METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
            ...
          }
      - pattern-inside: |
          $METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
            ...
          }
    - metavariable-regex:
        metavariable: $TYPE
        regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
    - metavariable-regex:
        metavariable: $REQ
        regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
    - focus-metavariable: $SOURCE
  - label: CONCAT
    by-side-effect: true
    requires: INPUT
    patterns:
    - pattern-either:
      - pattern: |
          "$HTMLSTR" + ...
      - pattern: |
          "$HTMLSTR".concat(...)
      - patterns:
        - pattern-inside: |
            StringBuilder $SB = new StringBuilder("$HTMLSTR");
            ...
        - pattern: $SB.append(...)
      - patterns:
        - pattern-inside: |
            $VAR = "$HTMLSTR";
            ...
        - pattern: $VAR += ...
      - pattern: String.format("$HTMLSTR", ...)
      - patterns:
        - pattern-inside: |
            String $VAR = "$HTMLSTR";
            ...
        - pattern: String.format($VAR, ...)
    - metavariable-regex:
        metavariable: $HTMLSTR
        regex: ^<\w+
  pattern-propagators:
  - pattern: (StringBuilder $SB).append($...TAINTED)
    from: $...TAINTED
    to: $SB
  - pattern: $VAR += $...TAINTED
    from: $...TAINTED
    to: $VAR
  pattern-sinks:
  - requires: CONCAT
    patterns:
    - pattern-either:
      - pattern: new ResponseEntity<>($PAYLOAD, ...)
      - pattern: new ResponseEntity<$ERROR>($PAYLOAD, ...)
      - pattern: ResponseEntity. ... .body($PAYLOAD)
      - patterns:
        - pattern: |
            ResponseEntity.$RESPFUNC($PAYLOAD). ...
        - metavariable-regex:
            metavariable: $RESPFUNC
            regex: ^(ok|of)$
    - focus-metavariable: $PAYLOAD
  pattern-sanitizers:
  - pattern-either:
    - pattern: Encode.forHtml(...)
    - pattern: (PolicyFactory $POLICY).sanitize(...)
    - pattern: (AntiSamy $AS).scan(...)
    - pattern: JSoup.clean(...)
- id: java.spring.security.injection.tainted-system-command.tainted-system-command
  languages:
  - java
  severity: ERROR
  mode: taint
  pattern-propagators:
  - pattern: (StringBuilder $STRB).append($INPUT)
    from: $INPUT
    to: $STRB
    label: CONCAT
    requires: INPUT
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
            ...
          }
      - pattern-inside: |
          $METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
            ...
          }
    - metavariable-regex:
        metavariable: $TYPE
        regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
    - metavariable-regex:
        metavariable: $REQ
        regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
    - focus-metavariable: $SOURCE
    label: INPUT
  - patterns:
    - pattern-either:
      - pattern: $X + $SOURCE
      - pattern: $SOURCE + $Y
      - pattern: String.format("...", ..., $SOURCE, ...)
      - pattern: String.join("...", ..., $SOURCE, ...)
      - pattern: (String $STR).concat($SOURCE)
      - pattern: $SOURCE.concat(...)
      - pattern: $X += $SOURCE
      - pattern: $SOURCE += $X
    label: CONCAT
    requires: INPUT
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          (Process $P) = new Process(...);
      - pattern: |
          (ProcessBuilder $PB).command(...);
      - patterns:
        - pattern-either:
          - pattern: |
              (Runtime $R).$EXEC(...);
          - pattern: |
              Runtime.getRuntime(...).$EXEC(...);
        - metavariable-regex:
            metavariable: $EXEC
            regex: (exec|loadLibrary|load)
      - patterns:
        - pattern: |
            (ProcessBuilder $PB).command(...).$ADD(...);
        - metavariable-regex:
            metavariable: $ADD
            regex: (add|addAll)
      - patterns:
        - pattern-either:
          - patterns:
            - pattern-inside: |
                $BUILDER = new ProcessBuilder(...);
                ...
            - pattern: $BUILDER.start(...)
          - pattern: |
              new ProcessBuilder(...). ... .start(...);
    requires: CONCAT
  message: 'Detected user input entering a method which executes a system command.
    This could result in a command injection vulnerability, which allows an attacker
    to inject an arbitrary system command onto the server. The attacker could download
    malware onto or steal data from the server. Instead, use ProcessBuilder, separating
    the command into individual arguments, like this: `new ProcessBuilder("ls", "-al",
    targetDirectory)`. Further, make sure you hardcode or allowlist the actual command
    so that attackers can''t run arbitrary commands.'
  metadata:
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - java
    - spring
    confidence: HIGH
    references:
    - https://www.stackhawk.com/blog/command-injection-java/
    - https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html
    - https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command
    shortlink: https://sg.run/epY0
    semgrep.dev:
      rule:
        r_id: 22076
        rv_id: 1263087
        rule_id: 6JUxGN
        version_id: 8KT5rnP
        url: https://semgrep.dev/playground/r/8KT5rnP/java.spring.security.injection.tainted-system-command.tainted-system-command
        origin: community
- id: java.spring.security.injection.tainted-url-host.tainted-url-host
  languages:
  - java
  severity: ERROR
  message: User data flows into the host portion of this manually-constructed URL.
    This could allow an attacker to send data to their own server, potentially exposing
    sensitive data such as cookies or authorization information sent with this request.
    They could also probe internal servers or other resources that the server running
    this code can access. (This is called server-side request forgery, or SSRF.) Do
    not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode
    the correct host, or ensure that the user data can only affect the path or parameters.
  options:
    interfile: true
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - java
    - spring
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
    confidence: MEDIUM
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host
    shortlink: https://sg.run/vkYn
    semgrep.dev:
      rule:
        r_id: 22077
        rv_id: 1263088
        rule_id: oqUZo8
        version_id: gETB708
        url: https://semgrep.dev/playground/r/gETB708/java.spring.security.injection.tainted-url-host.tainted-url-host
        origin: community
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
            ...
          }
      - pattern-inside: |
          $METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
            ...
          }
    - metavariable-regex:
        metavariable: $TYPE
        regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
    - metavariable-regex:
        metavariable: $REQ
        regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
    - focus-metavariable: $SOURCE
  pattern-sinks:
  - pattern-either:
    - pattern: new URL($ONEARG)
    - patterns:
      - pattern-either:
        - pattern: |
            "$URLSTR" + ...
        - pattern: |
            "$URLSTR".concat(...)
        - patterns:
          - pattern-inside: |
              StringBuilder $SB = new StringBuilder("$URLSTR");
              ...
          - pattern: $SB.append(...)
        - patterns:
          - pattern-inside: |
              $VAR = "$URLSTR";
              ...
          - pattern: $VAR += ...
        - patterns:
          - pattern: String.format("$URLSTR", ...)
          - pattern-not: String.format("$URLSTR", "...", ...)
        - patterns:
          - pattern-inside: |
              String $VAR = "$URLSTR";
              ...
          - pattern: String.format($VAR, ...)
      - metavariable-regex:
          metavariable: $URLSTR
          regex: http(s?)://%(v|s|q).*
- id: ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization
  mode: taint
  languages:
  - ruby
  message: Deserialization of a string tainted by `event` object found. Objects in
    Ruby can be serialized into strings, then later loaded from strings. However,
    uses of `load` can cause remote code execution. Loading user input with MARSHAL,
    YAML or CSV can potentially be dangerous. If you need to deserialize untrusted
    data, you should use JSON as it is only capable of returning 'primitive' types
    such as strings, arrays, hashes, numbers and nil.
  metadata:
    references:
    - https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html
    - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb
    category: security
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    technology:
    - ruby
    - aws-lambda
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization
    shortlink: https://sg.run/dplX
    semgrep.dev:
      rule:
        r_id: 22078
        rv_id: 1263585
        rule_id: zdUlNJ
        version_id: vdT06gR
        url: https://semgrep.dev/playground/r/vdT06gR/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization
        origin: community
  pattern-sinks:
  - patterns:
    - pattern: $SINK
    - pattern-either:
      - pattern-inside: |
          YAML.load($SINK,...)
      - pattern-inside: |
          CSV.load($SINK,...)
      - pattern-inside: |
          Marshal.load($SINK,...)
      - pattern-inside: |
          Marshal.restore($SINK,...)
  pattern-sources:
  - patterns:
    - pattern: event
    - pattern-inside: |
        def $HANDLER(event, context)
          ...
        end
  severity: WARNING
- id: javascript.express.security.audit.express-libxml-noent.express-libxml-noent
  message: The libxml library processes user-input with the `noent` attribute is set
    to `true` which can lead to being vulnerable to XML External Entities (XXE) type
    attacks. It is recommended to set `noent` to `false` when using this feature to
    ensure you are protected.
  options:
    interfile: true
  metadata:
    interfile: true
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
    technology:
    - express
    category: security
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent
    shortlink: https://sg.run/Z75x
    semgrep.dev:
      rule:
        r_id: 22079
        rv_id: 1263138
        rule_id: pKUNeD
        version_id: d6TyxpX
        url: https://semgrep.dev/playground/r/d6TyxpX/javascript.express.security.audit.express-libxml-noent.express-libxml-noent
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
      - pattern: $REQ.files.$ANYTHING.data.toString('utf8')
      - pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
      - pattern: files.$ANYTHING.data.toString('utf8')
      - pattern: files.$ANYTHING['data'].toString('utf8')
  pattern-sinks:
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern-inside: |
            $XML = require('$IMPORT')
            ...
        - pattern-inside: |
            import $XML from '$IMPORT'
              ...
        - pattern-inside: |
            import * as $XML from '$IMPORT'
            ...
      - metavariable-regex:
          metavariable: $IMPORT
          regex: ^(libxmljs|libxmljs2)$
      - pattern-inside: $XML.$FUNC($QUERY, {...,noent:true,...})
      - metavariable-regex:
          metavariable: $FUNC
          regex: ^(parseXmlString|parseXml)$
      - focus-metavariable: $QUERY
- id: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  options:
    interfile: true
  metadata:
    interfile: true
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    category: security
    technology:
    - express
    - secrets
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret
    shortlink: https://sg.run/LYvG
    semgrep.dev:
      rule:
        r_id: 22083
        rv_id: 1263143
        rule_id: 10Uo39
        version_id: LjTkgle
        url: https://semgrep.dev/playground/r/LjTkgle/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern-inside: |
        $SESSION = require('express-session');
        ...
    - pattern-inside: |
        import $SESSION from 'express-session'
        ...
    - pattern-inside: |
        import {..., $SESSION, ...} from 'express-session'
        ...
    - pattern-inside: |
        import * as $SESSION from 'express-session'
        ...
  - patterns:
    - pattern-either:
      - pattern-inside: $APP.use($SESSION({...}))
      - pattern: |
          $SECRET = $VALUE
          ...
          $APP.use($SESSION($SECRET))
    - pattern: |
        secret: '$Y'
- id: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization
  message: The following function call $SER.$FUNC accepts user controlled data which
    can result in Remote Code Execution (RCE) through Object Deserialization. It is
    recommended to use secure data processing alternatives such as JSON.parse() and
    Buffer.from().
  options:
    interfile: true
  metadata:
    interfile: true
    technology:
    - express
    category: security
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html
    source_rule_url:
    - https://github.com/ajinabraham/njsscan/blob/75bfbeb9c8d72999e4d527dfa2548f7f0f3cc48a/njsscan/rules/semantic_grep/eval/eval_deserialize.yaml
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization
    shortlink: https://sg.run/8W5j
    semgrep.dev:
      rule:
        r_id: 22084
        rv_id: 1263145
        rule_id: 9AUyqj
        version_id: gETB7nD
        url: https://semgrep.dev/playground/r/gETB7nD/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
      - pattern: $REQ.files.$ANYTHING.data.toString('utf8')
      - pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
      - pattern: files.$ANYTHING.data.toString('utf8')
      - pattern: files.$ANYTHING['data'].toString('utf8')
  pattern-sinks:
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern-inside: |
            $SER = require('$IMPORT')
            ...
        - pattern-inside: |
            import $SER from '$IMPORT'
             ...
        - pattern-inside: |
            import * as $SER from '$IMPORT'
            ...
      - metavariable-regex:
          metavariable: $IMPORT
          regex: ^(node-serialize|serialize-to-js)$
      - pattern: $SER.$FUNC(...)
      - metavariable-regex:
          metavariable: $FUNC
          regex: ^(unserialize|deserialize)$
- id: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection
  message: Detected a sequelize statement that is tainted by user-input. This could
    lead to SQL injection if the variable is user-controlled and is not properly sanitized.
    In order to prevent SQL injection, it is recommended to use parameterized queries
    or prepared statements.
  options:
    interfile: true
  metadata:
    interfile: true
    references:
    - https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements
    category: security
    technology:
    - express
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection
    shortlink: https://sg.run/gjoe
    semgrep.dev:
      rule:
        r_id: 22085
        rv_id: 1263241
        rule_id: yyU0GX
        version_id: nWT2Llx
        url: https://semgrep.dev/playground/r/nWT2Llx/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
      - pattern: $REQ.files.$ANYTHING.data.toString('utf8')
      - pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
      - pattern: files.$ANYTHING.data.toString('utf8')
      - pattern: files.$ANYTHING['data'].toString('utf8')
  pattern-sinks:
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern: sequelize.query($QUERY,...)
        - pattern: $DB.sequelize.query($QUERY,...)
      - focus-metavariable: $QUERY
  pattern-sanitizers:
  - pattern-either:
    - pattern: parseInt(...)
    - pattern: $FUNC. ... .hash(...)
- id: javascript.express.security.audit.express-ssrf.express-ssrf
  message: 'The following request $REQUEST.$METHOD() was found to be crafted from
    user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities.
    It is recommended where possible to not allow user-input to craft the base request,
    but to be treated as part of the path or query parameter. When user-input is necessary
    to craft the request, it is recommeneded to follow OWASP best practices to prevent
    abuse. '
  metadata:
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    technology:
    - express
    category: security
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    - A01:2025 - Broken Access Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf
    shortlink: https://sg.run/0PNw
    semgrep.dev:
      rule:
        r_id: 22554
        rv_id: 1263144
        rule_id: eqU9l2
        version_id: 8KT5rBr
        url: https://semgrep.dev/playground/r/8KT5rBr/javascript.express.security.audit.express-ssrf.express-ssrf
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  options:
    taint_unify_mvars: true
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, ...) {...}
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,...) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: $EXPRESS.Request,...) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $REQUEST = require('request')
          ...
      - pattern-inside: |
          import * as $REQUEST from 'request'
          ...
      - pattern-inside: |
          import $REQUEST from 'request'
          ...
    - pattern-either:
      - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE)
      - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE + $...A)
      - pattern: $REQUEST.$METHOD(`$HTTP${$REQ. ... .$VALUE}...`)
      - pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...])
      - pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...] + $...A)
      - pattern: $REQUEST.$METHOD(`$HTTP${$REQ.$VALUE[...]}...`)
    - metavariable-regex:
        metavariable: $METHOD
        regex: ^(get|post|put|patch|del|head|delete)$
    - metavariable-regex:
        metavariable: $HTTP
        regex: ^(https?:\/\/|//)$
    - pattern-either:
      - pattern: $REQ. ... .$VALUE
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $REQUEST = require('request')
          ...
      - pattern-inside: |
          import * as $REQUEST from 'request'
          ...
      - pattern-inside: |
          import $REQUEST from 'request'
          ...
    - pattern-either:
      - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE,...)
      - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE + $...A,...)
      - pattern: $REQUEST.$METHOD(`${$REQ. ... .$VALUE}...`,...)
    - pattern: $REQ. ... .$VALUE
    - metavariable-regex:
        metavariable: $METHOD
        regex: ^(get|post|put|patch|del|head|delete)$
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $REQUEST = require('request')
          ...
      - pattern-inside: |
          import * as $REQUEST from 'request'
          ...
      - pattern-inside: |
          import $REQUEST from 'request'
          ...
    - pattern-either:
      - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'],...)
      - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'] + $...A,...)
      - pattern: $REQUEST.$METHOD(`${$REQ.$VALUE['...']}...`,...)
    - pattern: $REQ.$VALUE
    - metavariable-regex:
        metavariable: $METHOD
        regex: ^(get|post|put|patch|del|head|delete)$
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $REQUEST = require('request')
          ...
      - pattern-inside: |
          import * as $REQUEST from 'request'
          ...
      - pattern-inside: |
          import $REQUEST from 'request'
          ...
    - pattern-either:
      - pattern-inside: |
          $ASSIGN = $REQ. ... .$VALUE
          ...
      - pattern-inside: |
          $ASSIGN = $REQ. ... .$VALUE['...']
          ...
      - pattern-inside: |
          $ASSIGN = $REQ. ... .$VALUE + $...A
          ...
      - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE['...'] + $...A\n...     \n"
      - pattern-inside: |
          $ASSIGN = `${$REQ. ... .$VALUE}...`
          ...
      - pattern-inside: "$ASSIGN = `${$REQ. ... .$VALUE['...']}...`\n... \n"
      - patterns:
        - pattern-either:
          - pattern-inside: |
              $ASSIGN = "$HTTP"+ $REQ. ... .$VALUE
              ...
          - pattern-inside: |
              $ASSIGN = "$HTTP"+$REQ. ... .$VALUE + $...A
              ...
          - pattern-inside: |
              $ASSIGN = "$HTTP"+$REQ.$VALUE[...]
              ...
          - pattern-inside: |
              $ASSIGN = "$HTTP"+$REQ.$VALUE[...] + $...A
              ...
          - pattern-inside: |
              $ASSIGN = `$HTTP${$REQ.$VALUE[...]}...`
              ...
        - metavariable-regex:
            metavariable: $HTTP
            regex: ^(https?:\/\/|//)$
    - pattern-either:
      - pattern: $REQUEST.$METHOD($ASSIGN,...)
      - pattern: $REQUEST.$METHOD($ASSIGN + $...FOO,...)
      - pattern: $REQUEST.$METHOD(`${$ASSIGN}...`,...)
      - patterns:
        - pattern-either:
          - pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN,...)
          - pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN + $...A,...)
          - pattern: $REQUEST.$METHOD(`$HTTP${$ASSIGN}...`,...)
        - metavariable-regex:
            metavariable: $HTTP
            regex: ^(https?:\/\/|//)$
    - pattern: $ASSIGN
    - metavariable-regex:
        metavariable: $METHOD
        regex: ^(get|post|put|patch|del|head|delete)$
- id: go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage
  message: Detected usage of dangerous method $METHOD which does not escape inputs
    (see link in references). If the argument is user-controlled, this can lead to
    SQL injection. When using $METHOD function, do not trust user-submitted data and
    only allow approved list of input (possibly, use an allowlist approach).
  severity: WARNING
  languages:
  - go
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          ($REQUEST : http.Request).$ANYTHING
      - pattern: |
          ($REQUEST : *http.Request).$ANYTHING
    - metavariable-regex:
        metavariable: $ANYTHING
        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
  pattern-sinks:
  - patterns:
    - pattern-inside: |
        import ("gorm.io/gorm")
        ...
    - patterns:
      - pattern-inside: |
          func $VAL(..., $GORM *gorm.DB,... ) {
            ...
          }
      - pattern-either:
        - pattern: |
            $GORM. ... .$METHOD($VALUE)
        - pattern: |
            $DB := $GORM. ... .$ANYTHING(...)
            ...
            $DB. ... .$METHOD($VALUE)
    - focus-metavariable: $VALUE
    - metavariable-regex:
        metavariable: $METHOD
        regex: ^(Order|Exec|Raw|Group|Having|Distinct|Select|Pluck)$
  pattern-sanitizers:
  - pattern-either:
    - pattern: strconv.Atoi(...)
    - pattern: |
        ($X: bool)
  options:
    interfile: true
  metadata:
    category: security
    technology:
    - gorm
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://gorm.io/docs/security.html#SQL-injection-Methods
    - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
    confidence: HIGH
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage
    shortlink: https://sg.run/R4qg
    semgrep.dev:
      rule:
        r_id: 24693
        rv_id: 1262915
        rule_id: AbU5o3
        version_id: l4TJRJK
        url: https://semgrep.dev/playground/r/l4TJRJK/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage
        origin: community
- id: csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization
  message: Anonymous access shouldn't be allowed unless explicit by design. Access
    control checks are missing and potentially can be bypassed. This finding violates
    the principle of least privilege or deny by default, where access should only
    be permitted for a specific set of roles or conforms to a custom policy or users.
  severity: INFO
  metadata:
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe:
    - 'CWE-862: Missing Authorization'
    cwe2021-top25: true
    cwe2022-top25: true
    cwe2023-top25: true
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    - https://cwe.mitre.org/data/definitions/862.html
    - https://docs.microsoft.com/en-us/aspnet/core/security/authorization/simple?view=aspnetcore-7.0
    subcategory:
    - vuln
    technology:
    - .net
    - mvc
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authorization
    source: https://semgrep.dev/r/csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization
    shortlink: https://sg.run/Z8GA
    semgrep.dev:
      rule:
        r_id: 26335
        rv_id: 1262615
        rule_id: eqU32Y
        version_id: o5TbD41
        url: https://semgrep.dev/playground/r/o5TbD41/csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization
        origin: community
  languages:
  - csharp
  patterns:
  - pattern: |
      public class $CLASS : Controller {
        ...
      }
  - pattern-inside: |
      using Microsoft.AspNetCore.Mvc;
      ...
  - pattern-not: |
      [AllowAnonymous]
      public class $CLASS : Controller {
        ...
      }
  - pattern-not: |
      [Authorize]
      public class $CLASS : Controller {
        ...
      }
  - pattern-not: |
      [Authorize(Roles = ...)]
      public class $CLASS : Controller {
        ...
      }
  - pattern-not: |
      [Authorize(Policy = ...)]
      public class $CLASS : Controller {
        ...
      }
- id: python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: os.environ
          - pattern: os.environ.get('$FOO', ...)
          - pattern: os.environb
          - pattern: os.environb.get('$FOO', ...)
          - pattern: os.getenv('$ANYTHING', ...)
          - pattern: os.getenvb('$ANYTHING', ...)
      - patterns:
        - pattern-either:
          - patterns:
            - pattern-either:
              - pattern: sys.argv
              - pattern: sys.orig_argv
          - patterns:
            - pattern-inside: |
                $PARSER = argparse.ArgumentParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-inside: |
                $PARSER = optparse.OptionParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-either:
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.getopt(...)
                  ...
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.gnu_getopt(...)
                  ...
            - pattern-either:
              - patterns:
                - pattern-inside: |
                    for $O, $A in $OPTS:
                      ...
                - pattern: $A
              - pattern: $ARGS
  pattern-sinks:
  - pattern-either:
    - patterns:
      - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "...", ...)
      - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["...",...], ...)
      - pattern: $LOOP.subprocess_exec(...)
    - patterns:
      - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
          "-c", "...", ...)
      - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
          "-c",...)
    - patterns:
      - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
          "-c", "...", ...], ...)
      - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
          "-c", ...], ...)
  message: Detected subprocess function '$LOOP.subprocess_exec' with user controlled
    data. You may consider using 'shlex.escape()'.
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    references:
    - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec
    - https://docs.python.org/3/library/shlex.html
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    category: security
    technology:
    - python
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args
    shortlink: https://sg.run/Apjp
    semgrep.dev:
      rule:
        r_id: 27250
        rv_id: 1263460
        rule_id: 7KUE1E
        version_id: WrTqKXz
        url: https://semgrep.dev/playground/r/WrTqKXz/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: os.environ
          - pattern: os.environ.get('$FOO', ...)
          - pattern: os.environb
          - pattern: os.environb.get('$FOO', ...)
          - pattern: os.getenv('$ANYTHING', ...)
          - pattern: os.getenvb('$ANYTHING', ...)
      - patterns:
        - pattern-either:
          - patterns:
            - pattern-either:
              - pattern: sys.argv
              - pattern: sys.orig_argv
          - patterns:
            - pattern-inside: |
                $PARSER = argparse.ArgumentParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-inside: |
                $PARSER = optparse.OptionParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-either:
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.getopt(...)
                  ...
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.gnu_getopt(...)
                  ...
            - pattern-either:
              - patterns:
                - pattern-inside: |
                    for $O, $A in $OPTS:
                      ...
                - pattern: $A
              - pattern: $ARGS
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: $LOOP.subprocess_shell($PROTOCOL, $CMD)
      - pattern-inside: asyncio.subprocess.create_subprocess_shell($CMD, ...)
      - pattern-inside: asyncio.create_subprocess_shell($CMD, ...)
    - focus-metavariable: $CMD
    - pattern-not-inside: |
        $CMD = "..."
        ...
    - pattern-not: $LOOP.subprocess_shell($PROTOCOL, "...")
    - pattern-not: asyncio.subprocess.create_subprocess_shell("...", ...)
    - pattern-not: asyncio.create_subprocess_shell("...", ...)
  message: Detected asyncio subprocess function with user controlled data. You may
    consider using 'shlex.escape()'.
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    references:
    - https://docs.python.org/3/library/asyncio-subprocess.html
    - https://docs.python.org/3/library/shlex.html
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    category: security
    technology:
    - python
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args
    shortlink: https://sg.run/Dx8Y
    semgrep.dev:
      rule:
        r_id: 27252
        rv_id: 1263462
        rule_id: 8GU5q3
        version_id: K3TKkDn
        url: https://semgrep.dev/playground/r/K3TKkDn/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: os.environ
          - pattern: os.environ.get('$FOO', ...)
          - pattern: os.environb
          - pattern: os.environb.get('$FOO', ...)
          - pattern: os.getenv('$ANYTHING', ...)
          - pattern: os.getenvb('$ANYTHING', ...)
      - patterns:
        - pattern-either:
          - patterns:
            - pattern-either:
              - pattern: sys.argv
              - pattern: sys.orig_argv
          - patterns:
            - pattern-inside: |
                $PARSER = argparse.ArgumentParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-inside: |
                $PARSER = optparse.OptionParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-either:
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.getopt(...)
                  ...
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.gnu_getopt(...)
                  ...
            - pattern-either:
              - patterns:
                - pattern-inside: |
                    for $O, $A in $OPTS:
                      ...
                - pattern: $A
              - pattern: $ARGS
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-not: os.$METHOD("...", ...)
        - pattern: os.$METHOD(...)
        - metavariable-regex:
            metavariable: $METHOD
            regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe)
      - patterns:
        - pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...)
        - pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...)
        - pattern: $CMD
        - metavariable-regex:
            metavariable: $METHOD
            regex: (execv|execve|execvp|execvpe)
        - metavariable-regex:
            metavariable: $BASH
            regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
      - patterns:
        - pattern-not: os.$METHOD("...", $PATH, "...", "...",...)
        - pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...)
        - pattern: $CMD
        - metavariable-regex:
            metavariable: $METHOD
            regex: (execl|execle|execlp|execlpe)
        - metavariable-regex:
            metavariable: $BASH
            regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
  message: Found user controlled content when spawning a process. This is dangerous
    because it allows a malicious actor to execute commands.
  metadata:
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    confidence: MEDIUM
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args
    shortlink: https://sg.run/qL6z
    semgrep.dev:
      rule:
        r_id: 27256
        rv_id: 1263466
        rule_id: 4bUEAY
        version_id: 6xT29l6
        url: https://semgrep.dev/playground/r/6xT29l6/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: os.environ
          - pattern: os.environ.get('$FOO', ...)
          - pattern: os.environb
          - pattern: os.environb.get('$FOO', ...)
          - pattern: os.getenv('$ANYTHING', ...)
          - pattern: os.getenvb('$ANYTHING', ...)
      - patterns:
        - pattern-either:
          - patterns:
            - pattern-either:
              - pattern: sys.argv
              - pattern: sys.orig_argv
          - patterns:
            - pattern-inside: |
                $PARSER = argparse.ArgumentParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-inside: |
                $PARSER = optparse.OptionParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-either:
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.getopt(...)
                  ...
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.gnu_getopt(...)
                  ...
            - pattern-either:
              - patterns:
                - pattern-inside: |
                    for $O, $A in $OPTS:
                      ...
                - pattern: $A
              - pattern: $ARGS
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-not: os.$METHOD($MODE, "...", ...)
        - pattern-inside: os.$METHOD($MODE, $CMD, ...)
        - pattern: $CMD
        - metavariable-regex:
            metavariable: $METHOD
            regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile)
      - patterns:
        - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...)
        - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...)
        - pattern: $CMD
        - metavariable-regex:
            metavariable: $METHOD
            regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp)
        - metavariable-regex:
            metavariable: $BASH
            regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
      - patterns:
        - pattern-not: os.$METHOD($MODE, "...", "...", "...", ...)
        - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...)
        - pattern: $CMD
        - metavariable-regex:
            metavariable: $METHOD
            regex: (spawnl|spawnle|spawnlp|spawnlpe)
        - metavariable-regex:
            metavariable: $BASH
            regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
  message: Found user controlled content when spawning a process. This is dangerous
    because it allows a malicious actor to execute commands.
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    category: security
    technology:
    - python
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args
    shortlink: https://sg.run/Y3Ke
    semgrep.dev:
      rule:
        r_id: 27258
        rv_id: 1263468
        rule_id: JDUz34
        version_id: zyTb2wn
        url: https://semgrep.dev/playground/r/zyTb2wn/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sanitizers:
  - pattern: shlex.quote(...)
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: os.environ
          - pattern: os.environ.get('$FOO', ...)
          - pattern: os.environb
          - pattern: os.environb.get('$FOO', ...)
          - pattern: os.getenv('$ANYTHING', ...)
          - pattern: os.getenvb('$ANYTHING', ...)
      - patterns:
        - pattern-either:
          - patterns:
            - pattern-either:
              - pattern: sys.argv
              - pattern: sys.orig_argv
          - patterns:
            - pattern-inside: |
                $PARSER = argparse.ArgumentParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-inside: |
                $PARSER = optparse.OptionParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-either:
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.getopt(...)
                  ...
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.gnu_getopt(...)
                  ...
            - pattern-either:
              - patterns:
                - pattern-inside: |
                    for $O, $A in $OPTS:
                      ...
                - pattern: $A
              - pattern: $ARGS
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-not: subprocess.$FUNC("...", ...)
        - pattern-not: subprocess.$FUNC(["...",...], ...)
        - pattern-not: subprocess.$FUNC(("...",...), ...)
        - pattern-not: subprocess.CalledProcessError(...)
        - pattern-not: subprocess.SubprocessError(...)
        - pattern: subprocess.$FUNC($CMD, ...)
      - patterns:
        - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...)
        - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD)
      - patterns:
        - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...)
        - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...)
        - pattern-either:
          - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD],
              ...)
          - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD),
              ...)
      - patterns:
        - pattern-not: subprocess.$FUNC("=~/(python)/","...",...)
        - pattern: subprocess.$FUNC("=~/(python)/", $CMD)
      - patterns:
        - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...)
        - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...)
        - pattern-either:
          - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...)
          - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...)
    - focus-metavariable: $CMD
  message: Detected subprocess function '$FUNC' with user controlled data. A malicious
    actor could leverage this to perform command injection. You may consider using
    'shlex.quote()'.
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    references:
    - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess
    - https://docs.python.org/3/library/subprocess.html
    - https://docs.python.org/3/library/shlex.html
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    category: security
    technology:
    - python
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args
    shortlink: https://sg.run/pLGg
    semgrep.dev:
      rule:
        r_id: 27262
        rv_id: 1263472
        rule_id: AbUgrZ
        version_id: jQTn54Y
        url: https://semgrep.dev/playground/r/jQTn54Y/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: os.environ
          - pattern: os.environ.get('$FOO', ...)
          - pattern: os.environb
          - pattern: os.environb.get('$FOO', ...)
          - pattern: os.getenv('$ANYTHING', ...)
          - pattern: os.getenvb('$ANYTHING', ...)
      - patterns:
        - pattern-either:
          - patterns:
            - pattern-either:
              - pattern: sys.argv
              - pattern: sys.orig_argv
          - patterns:
            - pattern-inside: |
                $PARSER = argparse.ArgumentParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-inside: |
                $PARSER = optparse.OptionParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-either:
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.getopt(...)
                  ...
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.gnu_getopt(...)
                  ...
            - pattern-either:
              - patterns:
                - pattern-inside: |
                    for $O, $A in $OPTS:
                      ...
                - pattern: $A
              - pattern: $ARGS
  pattern-sinks:
  - patterns:
    - pattern-not: os.$W("...", ...)
    - pattern-either:
      - pattern: os.system(...)
      - pattern: |
          $X = __import__("os")
          ...
          $X.system(...)
      - pattern: |
          $X = __import__("os")
          ...
          getattr($X, "system")(...)
      - pattern: |
          $X = getattr(os, "system")
          ...
          $X(...)
      - pattern: |
          $X = __import__("os")
          ...
          $Y = getattr($X, "system")
          ...
          $Y(...)
      - pattern: os.popen(...)
      - pattern: os.popen2(...)
      - pattern: os.popen3(...)
      - pattern: os.popen4(...)
  message: Found user-controlled data used in a system call. This could allow a malicious
    actor to execute commands. Use the 'subprocess' module instead, which is easier
    to use without accidentally exposing a command injection vulnerability.
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.2.4 Dyanmic Code Execution Features
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
      version: '4'
    category: security
    technology:
    - python
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args
    shortlink: https://sg.run/XR2K
    semgrep.dev:
      rule:
        r_id: 27264
        rv_id: 1263474
        rule_id: DbUR9g
        version_id: 9lT4bG4
        url: https://semgrep.dev/playground/r/9lT4bG4/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.lang.security.dangerous-os-exec.dangerous-os-exec
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: flask.request.form.get(...)
          - pattern: flask.request.form[...]
          - pattern: flask.request.args.get(...)
          - pattern: flask.request.args[...]
          - pattern: flask.request.values.get(...)
          - pattern: flask.request.values[...]
          - pattern: flask.request.cookies.get(...)
          - pattern: flask.request.cookies[...]
          - pattern: flask.request.stream
          - pattern: flask.request.headers.get(...)
          - pattern: flask.request.headers[...]
          - pattern: flask.request.data
          - pattern: flask.request.full_path
          - pattern: flask.request.url
          - pattern: flask.request.json
          - pattern: flask.request.get_json()
          - pattern: flask.request.view_args.get(...)
          - pattern: flask.request.view_args[...]
          - patterns:
            - pattern-inside: |
                @$APP.route(...)
                def $FUNC(..., $ROUTEVAR, ...):
                  ...
            - focus-metavariable: $ROUTEVAR
      - patterns:
        - pattern-inside: |
            def $FUNC(request, ...):
              ...
        - pattern-either:
          - pattern: request.$PROPERTY.get(...)
          - pattern: request.$PROPERTY[...]
      - patterns:
        - pattern-either:
          - pattern-inside: |
              @rest_framework.decorators.api_view(...)
              def $FUNC($REQ, ...):
                ...
          - patterns:
            - pattern-either:
              - pattern-inside: |
                  class $VIEW(..., rest_framework.views.APIView, ...):
                    ...
              - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
                  ...):\n  ...                              \n"
            - pattern-inside: |
                def $METHOD(self, $REQ, ...):
                  ...
            - metavariable-regex:
                metavariable: $METHOD
                regex: (get|post|put|patch|delete|head)
        - pattern-either:
          - pattern: $REQ.POST.get(...)
          - pattern: $REQ.POST[...]
          - pattern: $REQ.FILES.get(...)
          - pattern: $REQ.FILES[...]
          - pattern: $REQ.DATA.get(...)
          - pattern: $REQ.DATA[...]
          - pattern: $REQ.QUERY_PARAMS.get(...)
          - pattern: $REQ.QUERY_PARAMS[...]
          - pattern: $REQ.data.get(...)
          - pattern: $REQ.data[...]
          - pattern: $REQ.query_params.get(...)
          - pattern: $REQ.query_params[...]
          - pattern: $REQ.content_type
          - pattern: $REQ.content_type
          - pattern: $REQ.stream
          - pattern: $REQ.stream
      - patterns:
        - pattern-either:
          - pattern-inside: |
              class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
                ...
          - pattern-inside: |
              class $SERVER(..., http.server.StreamRequestHandler, ...):
                ...
          - pattern-inside: |
              class $SERVER(..., http.server.DatagramRequestHandler, ...):
                ...
        - pattern-either:
          - pattern: self.requestline
          - pattern: self.path
          - pattern: self.headers[...]
          - pattern: self.headers.get(...)
          - pattern: self.rfile
      - patterns:
        - pattern-inside: |
            @pyramid.view.view_config( ... )
            def $VIEW($REQ):
              ...
        - pattern: $REQ.$ANYTHING
        - pattern-not: $REQ.dbsession
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-not: os.$METHOD("...", ...)
        - pattern: os.$METHOD(...)
        - metavariable-regex:
            metavariable: $METHOD
            regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe)
      - patterns:
        - pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...)
        - pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...)
        - pattern: $CMD
        - metavariable-regex:
            metavariable: $METHOD
            regex: (execv|execve|execvp|execvpe)
        - metavariable-regex:
            metavariable: $BASH
            regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
      - patterns:
        - pattern-not: os.$METHOD("...", $PATH, "...", "...",...)
        - pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...)
        - pattern: $CMD
        - metavariable-regex:
            metavariable: $METHOD
            regex: (execl|execle|execlp|execlpe)
        - metavariable-regex:
            metavariable: $BASH
            regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
  message: Found user controlled content when spawning a process. This is dangerous
    because it allows a malicious actor to execute commands.
  metadata:
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    confidence: MEDIUM
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec
    shortlink: https://sg.run/yL9x
    semgrep.dev:
      rule:
        r_id: 27268
        rv_id: 1263523
        rule_id: qNUR13
        version_id: 6xT29rz
        url: https://semgrep.dev/playground/r/6xT29rz/python.lang.security.dangerous-os-exec.dangerous-os-exec
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.lang.security.dangerous-spawn-process.dangerous-spawn-process
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: flask.request.form.get(...)
          - pattern: flask.request.form[...]
          - pattern: flask.request.args.get(...)
          - pattern: flask.request.args[...]
          - pattern: flask.request.values.get(...)
          - pattern: flask.request.values[...]
          - pattern: flask.request.cookies.get(...)
          - pattern: flask.request.cookies[...]
          - pattern: flask.request.stream
          - pattern: flask.request.headers.get(...)
          - pattern: flask.request.headers[...]
          - pattern: flask.request.data
          - pattern: flask.request.full_path
          - pattern: flask.request.url
          - pattern: flask.request.json
          - pattern: flask.request.get_json()
          - pattern: flask.request.view_args.get(...)
          - pattern: flask.request.view_args[...]
          - patterns:
            - pattern-inside: |
                @$APP.route(...)
                def $FUNC(..., $ROUTEVAR, ...):
                  ...
            - pattern: $ROUTEVAR
      - patterns:
        - pattern-inside: |
            def $FUNC(request, ...):
              ...
        - pattern-either:
          - pattern: request.$PROPERTY.get(...)
          - pattern: request.$PROPERTY[...]
      - patterns:
        - pattern-either:
          - pattern-inside: |
              @rest_framework.decorators.api_view(...)
              def $FUNC($REQ, ...):
                ...
          - patterns:
            - pattern-either:
              - pattern-inside: |
                  class $VIEW(..., rest_framework.views.APIView, ...):
                    ...
              - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
                  ...):\n  ...                              \n"
            - pattern-inside: |
                def $METHOD(self, $REQ, ...):
                  ...
            - metavariable-regex:
                metavariable: $METHOD
                regex: (get|post|put|patch|delete|head)
        - pattern-either:
          - pattern: $REQ.POST.get(...)
          - pattern: $REQ.POST[...]
          - pattern: $REQ.FILES.get(...)
          - pattern: $REQ.FILES[...]
          - pattern: $REQ.DATA.get(...)
          - pattern: $REQ.DATA[...]
          - pattern: $REQ.QUERY_PARAMS.get(...)
          - pattern: $REQ.QUERY_PARAMS[...]
          - pattern: $REQ.data.get(...)
          - pattern: $REQ.data[...]
          - pattern: $REQ.query_params.get(...)
          - pattern: $REQ.query_params[...]
          - pattern: $REQ.content_type
          - pattern: $REQ.content_type
          - pattern: $REQ.stream
          - pattern: $REQ.stream
      - patterns:
        - pattern-either:
          - pattern-inside: |
              class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
                ...
          - pattern-inside: |
              class $SERVER(..., http.server.StreamRequestHandler, ...):
                ...
          - pattern-inside: |
              class $SERVER(..., http.server.DatagramRequestHandler, ...):
                ...
        - pattern-either:
          - pattern: self.requestline
          - pattern: self.path
          - pattern: self.headers[...]
          - pattern: self.headers.get(...)
          - pattern: self.rfile
      - patterns:
        - pattern-inside: |
            @pyramid.view.view_config( ... )
            def $VIEW($REQ):
              ...
        - pattern: $REQ.$ANYTHING
        - pattern-not: $REQ.dbsession
      - patterns:
        - pattern-either:
          - pattern: os.environ['$ANYTHING']
          - pattern: os.environ.get('$FOO', ...)
          - pattern: os.environb['$ANYTHING']
          - pattern: os.environb.get('$FOO', ...)
          - pattern: os.getenv('$ANYTHING', ...)
          - pattern: os.getenvb('$ANYTHING', ...)
      - patterns:
        - pattern-either:
          - patterns:
            - pattern-either:
              - pattern: sys.argv[...]
              - pattern: sys.orig_argv[...]
          - patterns:
            - pattern-inside: |
                $PARSER = argparse.ArgumentParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-inside: |
                $PARSER = optparse.OptionParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-either:
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.getopt(...)
                  ...
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.gnu_getopt(...)
                  ...
            - pattern-either:
              - patterns:
                - pattern-inside: |
                    for $O, $A in $OPTS:
                      ...
                - pattern: $A
              - pattern: $ARGS
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-not: os.$METHOD($MODE, "...", ...)
        - pattern-inside: os.$METHOD($MODE, $CMD, ...)
        - pattern: $CMD
        - metavariable-regex:
            metavariable: $METHOD
            regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile)
      - patterns:
        - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...)
        - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...)
        - pattern: $CMD
        - metavariable-regex:
            metavariable: $METHOD
            regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp)
        - metavariable-regex:
            metavariable: $BASH
            regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
      - patterns:
        - pattern-not: os.$METHOD($MODE, "...", "...", "...", ...)
        - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...)
        - pattern: $CMD
        - metavariable-regex:
            metavariable: $METHOD
            regex: (spawnl|spawnle|spawnlp|spawnlpe)
        - metavariable-regex:
            metavariable: $BASH
            regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
  message: Found user controlled content when spawning a process. This is dangerous
    because it allows a malicious actor to execute commands.
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    category: security
    technology:
    - python
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process
    shortlink: https://sg.run/r8Zn
    semgrep.dev:
      rule:
        r_id: 27269
        rv_id: 1263524
        rule_id: lBUJrn
        version_id: o5TbDO5
        url: https://semgrep.dev/playground/r/o5TbDO5/python.lang.security.dangerous-spawn-process.dangerous-spawn-process
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: flask.request.form.get(...)
          - pattern: flask.request.form[...]
          - pattern: flask.request.args.get(...)
          - pattern: flask.request.args[...]
          - pattern: flask.request.values.get(...)
          - pattern: flask.request.values[...]
          - pattern: flask.request.cookies.get(...)
          - pattern: flask.request.cookies[...]
          - pattern: flask.request.stream
          - pattern: flask.request.headers.get(...)
          - pattern: flask.request.headers[...]
          - pattern: flask.request.data
          - pattern: flask.request.full_path
          - pattern: flask.request.url
          - pattern: flask.request.json
          - pattern: flask.request.get_json()
          - pattern: flask.request.view_args.get(...)
          - pattern: flask.request.view_args[...]
          - patterns:
            - pattern-inside: |
                @$APP.route(...)
                def $FUNC(..., $ROUTEVAR, ...):
                  ...
            - focus-metavariable: $ROUTEVAR
      - patterns:
        - pattern-inside: |
            def $FUNC(request, ...):
              ...
        - pattern-either:
          - pattern: request.$PROPERTY.get(...)
          - pattern: request.$PROPERTY[...]
      - patterns:
        - pattern-either:
          - pattern-inside: |
              @rest_framework.decorators.api_view(...)
              def $FUNC($REQ, ...):
                ...
          - patterns:
            - pattern-either:
              - pattern-inside: |
                  class $VIEW(..., rest_framework.views.APIView, ...):
                    ...
              - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
                  ...):\n  ...                              \n"
            - pattern-inside: |
                def $METHOD(self, $REQ, ...):
                  ...
            - metavariable-regex:
                metavariable: $METHOD
                regex: (get|post|put|patch|delete|head)
        - pattern-either:
          - pattern: $REQ.POST.get(...)
          - pattern: $REQ.POST[...]
          - pattern: $REQ.FILES.get(...)
          - pattern: $REQ.FILES[...]
          - pattern: $REQ.DATA.get(...)
          - pattern: $REQ.DATA[...]
          - pattern: $REQ.QUERY_PARAMS.get(...)
          - pattern: $REQ.QUERY_PARAMS[...]
          - pattern: $REQ.data.get(...)
          - pattern: $REQ.data[...]
          - pattern: $REQ.query_params.get(...)
          - pattern: $REQ.query_params[...]
          - pattern: $REQ.content_type
          - pattern: $REQ.content_type
          - pattern: $REQ.stream
          - pattern: $REQ.stream
      - patterns:
        - pattern-either:
          - pattern-inside: |
              class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
                ...
          - pattern-inside: |
              class $SERVER(..., http.server.StreamRequestHandler, ...):
                ...
          - pattern-inside: |
              class $SERVER(..., http.server.DatagramRequestHandler, ...):
                ...
        - pattern-either:
          - pattern: self.requestline
          - pattern: self.path
          - pattern: self.headers[...]
          - pattern: self.headers.get(...)
          - pattern: self.rfile
      - patterns:
        - pattern-inside: |
            @pyramid.view.view_config( ... )
            def $VIEW($REQ):
              ...
        - pattern: $REQ.$ANYTHING
        - pattern-not: $REQ.dbsession
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-not: subprocess.$FUNC("...", ...)
        - pattern-not: subprocess.$FUNC(["...",...], ...)
        - pattern-not: subprocess.$FUNC(("...",...), ...)
        - pattern-not: subprocess.CalledProcessError(...)
        - pattern-not: subprocess.SubprocessError(...)
        - pattern: subprocess.$FUNC($CMD, ...)
      - patterns:
        - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...)
        - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD)
      - patterns:
        - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...)
        - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...)
        - pattern-either:
          - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD],
              ...)
          - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD),
              ...)
      - patterns:
        - pattern-not: subprocess.$FUNC("=~/(python)/","...",...)
        - pattern: subprocess.$FUNC("=~/(python)/", $CMD)
      - patterns:
        - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...)
        - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...)
        - pattern-either:
          - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...)
          - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...)
    - focus-metavariable: $CMD
  message: Detected subprocess function '$FUNC' with user controlled data. A malicious
    actor could leverage this to perform command injection. You may consider using
    'shlex.escape()'.
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    references:
    - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess
    - https://docs.python.org/3/library/subprocess.html
    - https://docs.python.org/3/library/shlex.html
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    category: security
    technology:
    - python
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use
    shortlink: https://sg.run/NWxp
    semgrep.dev:
      rule:
        r_id: 27271
        rv_id: 1263526
        rule_id: JDUz3R
        version_id: pZT038J
        url: https://semgrep.dev/playground/r/pZT038J/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.lang.security.dangerous-system-call.dangerous-system-call
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: flask.request.form.get(...)
          - pattern: flask.request.form[...]
          - pattern: flask.request.args.get(...)
          - pattern: flask.request.args[...]
          - pattern: flask.request.values.get(...)
          - pattern: flask.request.values[...]
          - pattern: flask.request.cookies.get(...)
          - pattern: flask.request.cookies[...]
          - pattern: flask.request.stream
          - pattern: flask.request.headers.get(...)
          - pattern: flask.request.headers[...]
          - pattern: flask.request.data
          - pattern: flask.request.full_path
          - pattern: flask.request.url
          - pattern: flask.request.json
          - pattern: flask.request.get_json()
          - pattern: flask.request.view_args.get(...)
          - pattern: flask.request.view_args[...]
          - patterns:
            - pattern-inside: |
                @$APP.route(...)
                def $FUNC(..., $ROUTEVAR, ...):
                  ...
            - focus-metavariable: $ROUTEVAR
      - patterns:
        - pattern-inside: |
            def $FUNC(request, ...):
              ...
        - pattern-either:
          - pattern: request.$PROPERTY.get(...)
          - pattern: request.$PROPERTY[...]
      - patterns:
        - pattern-either:
          - pattern-inside: |
              @rest_framework.decorators.api_view(...)
              def $FUNC($REQ, ...):
                ...
          - patterns:
            - pattern-either:
              - pattern-inside: |
                  class $VIEW(..., rest_framework.views.APIView, ...):
                    ...
              - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
                  ...):\n  ...                              \n"
            - pattern-inside: |
                def $METHOD(self, $REQ, ...):
                  ...
            - metavariable-regex:
                metavariable: $METHOD
                regex: (get|post|put|patch|delete|head)
        - pattern-either:
          - pattern: $REQ.POST.get(...)
          - pattern: $REQ.POST[...]
          - pattern: $REQ.FILES.get(...)
          - pattern: $REQ.FILES[...]
          - pattern: $REQ.DATA.get(...)
          - pattern: $REQ.DATA[...]
          - pattern: $REQ.QUERY_PARAMS.get(...)
          - pattern: $REQ.QUERY_PARAMS[...]
          - pattern: $REQ.data.get(...)
          - pattern: $REQ.data[...]
          - pattern: $REQ.query_params.get(...)
          - pattern: $REQ.query_params[...]
          - pattern: $REQ.content_type
          - pattern: $REQ.content_type
          - pattern: $REQ.stream
          - pattern: $REQ.stream
      - patterns:
        - pattern-either:
          - pattern-inside: |
              class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
                ...
          - pattern-inside: |
              class $SERVER(..., http.server.StreamRequestHandler, ...):
                ...
          - pattern-inside: |
              class $SERVER(..., http.server.DatagramRequestHandler, ...):
                ...
        - pattern-either:
          - pattern: self.requestline
          - pattern: self.path
          - pattern: self.headers[...]
          - pattern: self.headers.get(...)
          - pattern: self.rfile
      - patterns:
        - pattern-inside: |
            @pyramid.view.view_config( ... )
            def $VIEW($REQ):
              ...
        - pattern: $REQ.$ANYTHING
        - pattern-not: $REQ.dbsession
  pattern-sinks:
  - patterns:
    - pattern-not: os.$W("...", ...)
    - pattern-either:
      - pattern: os.system(...)
      - pattern: getattr(os, "system")(...)
      - pattern: __import__("os").system(...)
      - pattern: getattr(__import__("os"), "system")(...)
      - pattern: |
          $X = __import__("os")
          ...
          $X.system(...)
      - pattern: |
          $X = __import__("os")
          ...
          getattr($X, "system")(...)
      - pattern: |
          $X = getattr(os, "system")
          ...
          $X(...)
      - pattern: |
          $X = __import__("os")
          ...
          $Y = getattr($X, "system")
          ...
          $Y(...)
      - pattern: os.popen(...)
      - pattern: os.popen2(...)
      - pattern: os.popen3(...)
      - pattern: os.popen4(...)
  message: Found user-controlled data used in a system call. This could allow a malicious
    actor to execute commands. Use the 'subprocess' module instead, which is easier
    to use without accidentally exposing a command injection vulnerability.
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.2.4 Dyanmic Code Execution Features
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
      version: '4'
    category: security
    technology:
    - python
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call
    shortlink: https://sg.run/k0W7
    semgrep.dev:
      rule:
        r_id: 27272
        rv_id: 1263527
        rule_id: 5rUoP1
        version_id: 2KTv2Zn
        url: https://semgrep.dev/playground/r/2KTv2Zn/python.lang.security.dangerous-system-call.dangerous-system-call
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.django.security.injection.command.subprocess-injection.subprocess-injection
  languages:
  - python
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sources:
  - patterns:
    - pattern-inside: |
        def $FUNC(..., $REQUEST, ...):
          ...
    - focus-metavariable: $REQUEST
    - metavariable-pattern:
        metavariable: $REQUEST
        patterns:
        - pattern: request
        - pattern-not-inside: request.build_absolute_uri
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: subprocess.$FUNC(...)
        - pattern-not: subprocess.$FUNC("...", ...)
        - pattern-not: subprocess.$FUNC(["...", ...], ...)
        - pattern-not-inside: |
            $CMD = ["...", ...]
            ...
            subprocess.$FUNC($CMD, ...)
      - patterns:
        - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...)
        - metavariable-regex:
            metavariable: $SHELL
            regex: ^(sh|bash|ksh|csh|tcsh|zsh)$
      - patterns:
        - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...)
        - metavariable-regex:
            metavariable: $INTERPRETER
            regex: ^(python|python\d)$
  pattern-sanitizers:
  - patterns:
    - pattern: $DICT[$KEY]
    - focus-metavariable: $KEY
  severity: ERROR
  message: Detected user input entering a `subprocess` call unsafely. This could result
    in a command injection vulnerability. An attacker could use this vulnerability
    to execute arbitrary commands on the host, which allows them to download malware,
    scan sensitive data, or run any command they wish on the server. Do not let users
    choose the command to run. In general, prefer to use Python API versions of system
    commands. If you must use subprocess, use a dictionary to allowlist a set of commands.
  metadata:
    category: security
    technology:
    - flask
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    references:
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    confidence: HIGH
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection
    shortlink: https://sg.run/49BE
    semgrep.dev:
      rule:
        r_id: 31144
        rv_id: 1263388
        rule_id: EwUepx
        version_id: 7ZTE3qK
        url: https://semgrep.dev/playground/r/7ZTE3qK/python.django.security.injection.command.subprocess-injection.subprocess-injection
        origin: community
- id: python.flask.security.injection.subprocess-injection.subprocess-injection
  languages:
  - python
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sources:
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern: flask.request.form.get(...)
        - pattern: flask.request.form[...]
        - pattern: flask.request.args.get(...)
        - pattern: flask.request.args[...]
        - pattern: flask.request.values.get(...)
        - pattern: flask.request.values[...]
        - pattern: flask.request.cookies.get(...)
        - pattern: flask.request.cookies[...]
        - pattern: flask.request.stream
        - pattern: flask.request.headers.get(...)
        - pattern: flask.request.headers[...]
        - pattern: flask.request.data
        - pattern: flask.request.full_path
        - pattern: flask.request.url
        - pattern: flask.request.json
        - pattern: flask.request.get_json()
        - pattern: flask.request.view_args.get(...)
        - pattern: flask.request.view_args[...]
    - patterns:
      - pattern-inside: |
          @$APP.route($ROUTE, ...)
          def $FUNC(..., $ROUTEVAR, ...):
            ...
      - focus-metavariable: $ROUTEVAR
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: subprocess.$FUNC(...)
        - pattern-not: subprocess.$FUNC("...", ...)
        - pattern-not: subprocess.$FUNC(["...", ...], ...)
        - pattern-not-inside: |
            $CMD = ["...", ...]
            ...
            subprocess.$FUNC($CMD, ...)
      - patterns:
        - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...)
        - metavariable-regex:
            metavariable: $SHELL
            regex: ^(sh|bash|ksh|csh|tcsh|zsh)$
      - patterns:
        - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...)
        - metavariable-regex:
            metavariable: $INTERPRETER
            regex: ^(python|python\d)$
  pattern-sanitizers:
  - patterns:
    - pattern: $DICT[$KEY]
    - focus-metavariable: $KEY
  severity: ERROR
  message: Detected user input entering a `subprocess` call unsafely. This could result
    in a command injection vulnerability. An attacker could use this vulnerability
    to execute arbitrary commands on the host, which allows them to download malware,
    scan sensitive data, or run any command they wish on the server. Do not let users
    choose the command to run. In general, prefer to use Python API versions of system
    commands. If you must use subprocess, use a dictionary to allowlist a set of commands.
  metadata:
    category: security
    technology:
    - flask
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    references:
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    confidence: HIGH
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection
    shortlink: https://sg.run/5gW3
    semgrep.dev:
      rule:
        r_id: 31147
        rv_id: 1263433
        rule_id: 8GU3qp
        version_id: bZT53gQ
        url: https://semgrep.dev/playground/r/bZT53gQ/python.flask.security.injection.subprocess-injection.subprocess-injection
        origin: community
- id: yaml.github-actions.security.github-script-injection.github-script-injection
  languages:
  - yaml
  message: 'Using variable interpolation `${{...}}` with `github` context data in
    a `actions/github-script`''s `script:` step could allow an attacker to inject
    their own code into the runner. This would allow them to steal secrets and code.
    `github` context data can have arbitrary user input and should be treated as untrusted.
    Instead, use an intermediate environment variable with `env:` to store the data
    and use the environment variable in the `run:` script. Be sure to use double-quotes
    the environment variable, like this: "$ENVVAR".'
  metadata:
    category: security
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
    - https://securitylab.github.com/research/github-actions-untrusted-input/
    - https://github.com/actions/github-script
    technology:
    - github-actions
    cwe2022-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection
    shortlink: https://sg.run/g1G0
    semgrep.dev:
      rule:
        r_id: 31441
        rv_id: 1423394
        rule_id: OrUQvK
        version_id: 5PT7Zyw
        url: https://semgrep.dev/playground/r/5PT7Zyw/yaml.github-actions.security.github-script-injection.github-script-injection
        origin: community
  patterns:
  - pattern-inside: 'steps: [...]'
  - pattern-inside: |
      uses: $ACTION
      ...
  - pattern-inside: |
      with:
        ...
        script: ...
        ...
  - pattern: 'script: $SHELL'
  - metavariable-regex:
      metavariable: $ACTION
      regex: actions/github-script@.*
  - metavariable-pattern:
      language: generic
      metavariable: $SHELL
      patterns:
      - pattern-either:
        - pattern: ${{ ... github.event.issue.title ... }}
        - pattern: ${{ ... github.event.issue.body ... }}
        - pattern: ${{ ... github.event.pull_request.title ... }}
        - pattern: ${{ ... github.event.pull_request.body ... }}
        - pattern: ${{ ... github.event.comment.body ... }}
        - pattern: ${{ ... github.event.review.body ... }}
        - pattern: ${{ ... github.event.review_comment.body ... }}
        - pattern: ${{ ... github.event.pages ... .page_name ... }}
        - pattern: ${{ ... github.event.head_commit.message ... }}
        - pattern: ${{ ... github.event.head_commit.author.email ... }}
        - pattern: ${{ ... github.event.head_commit.author.name ... }}
        - pattern: ${{ ... github.event.commits ... .author.email ... }}
        - pattern: ${{ ... github.event.commits ... .author.name ... }}
        - pattern: ${{ ... github.event.commits ... .message ... }}
        - pattern: ${{ ... github.event.pull_request.head.ref ... }}
        - pattern: ${{ ... github.event.pull_request.head.label ... }}
        - pattern: ${{ ... github.event.pull_request.head.repo.default_branch ...
            }}
        - pattern: ${{ ... github.ref ... }}
        - pattern: ${{ ... github.base_ref ... }}
        - pattern: ${{ ... github.head_ref ... }}
        - pattern: ${{ ... github.ref_name ... }}
        - pattern: ${{ ... github.workflow ... }}
        - pattern: ${{ ... github.event.inputs ... }}
        - pattern: ${{ ... github.event.discussion.title ... }}
        - pattern: ${{ ... github.event.discussion.body ... }}
        - pattern: ${{ ... github.event.workflow_run.head_branch ... }}
        - pattern: ${{ ... github.event.workflow_run.head_commit.message ... }}
        - pattern: ${{ ... github.event.milestone.title ... }}
        - pattern: ${{ ... github.event.milestone.description ... }}
        - pattern: ${{ ... github.event.project_card.note ... }}
        - pattern: ${{ ... github.event.project.name ... }}
        - pattern: ${{ ... github.event.project_column.name ... }}
        - pattern: ${{ ... github.event.release.name ... }}
        - pattern: ${{ ... github.event.release.body ... }}
        - pattern: ${{ ... github.event.deployment.ref ... }}
        - pattern: ${{ ... inputs ... }}
      - pattern-not: ${{ ... github.event.issue.title && ... }}
      - pattern-not: ${{ ... github.event.issue.body && ... }}
      - pattern-not: ${{ ... github.event.pull_request.title && ... }}
      - pattern-not: ${{ ... github.event.pull_request.body && ... }}
      - pattern-not: ${{ ... github.event.comment.body && ... }}
      - pattern-not: ${{ ... github.event.review.body && ... }}
      - pattern-not: ${{ ... github.event.review_comment.body && ... }}
      - pattern-not: ${{ ... github.event.pages ... .page_name && ... }}
      - pattern-not: ${{ ... github.event.head_commit.message && ... }}
      - pattern-not: ${{ ... github.event.head_commit.author.email && ... }}
      - pattern-not: ${{ ... github.event.head_commit.author.name && ... }}
      - pattern-not: ${{ ... github.event.commits ... .author.email && ... }}
      - pattern-not: ${{ ... github.event.commits ... .author.name && ... }}
      - pattern-not: ${{ ... github.event.commits ... .message && ... }}
      - pattern-not: ${{ ... github.event.pull_request.head.ref && ... }}
      - pattern-not: ${{ ... github.event.pull_request.head.label && ... }}
      - pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch &&
          ... }}
      - pattern-not: ${{ ... github.ref && ... }}
      - pattern-not: ${{ ... github.base_ref && ... }}
      - pattern-not: ${{ ... github.head_ref && ... }}
      - pattern-not: ${{ ... github.ref_name && ... }}
      - pattern-not: ${{ ... github.workflow && ... }}
      - pattern-not: ${{ ... github.event.inputs && ... }}
      - pattern-not: ${{ ... github.event.discussion.title && ... }}
      - pattern-not: ${{ ... github.event.discussion.body && ... }}
      - pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }}
      - pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ...
          }}
      - pattern-not: ${{ ... github.event.milestone.title && ... }}
      - pattern-not: ${{ ... github.event.milestone.description && ... }}
      - pattern-not: ${{ ... github.event.project_card.note && ... }}
      - pattern-not: ${{ ... github.event.project.name && ... }}
      - pattern-not: ${{ ... github.event.project_column.name && ... }}
      - pattern-not: ${{ ... github.event.release.name && ... }}
      - pattern-not: ${{ ... github.event.release.body && ... }}
      - pattern-not: ${{ ... github.event.deployment.ref && ... }}
  severity: ERROR
- id: php.lang.security.injection.echoed-request.echoed-request
  mode: taint
  message: '`Echo`ing user input risks cross-site scripting vulnerability. You should
    use `htmlentities()` when showing data to users.'
  languages:
  - php
  severity: ERROR
  pattern-sources:
  - pattern: $_REQUEST
  - pattern: $_GET
  - pattern: $_POST
  pattern-sinks:
  - pattern: echo $...VARS;
  pattern-sanitizers:
  - pattern: htmlentities(...)
  - pattern: htmlspecialchars(...)
  - pattern: strip_tags(...)
  - pattern: isset(...)
  - pattern: empty(...)
  - pattern: esc_html(...)
  - pattern: esc_attr(...)
  - pattern: wp_kses(...)
  - pattern: e(...)
  - pattern: twig_escape_filter(...)
  - pattern: xss_clean(...)
  - pattern: html_escape(...)
  - pattern: Html::escape(...)
  - pattern: Xss::filter(...)
  - pattern: escapeHtml(...)
  - pattern: escapeHtml(...)
  - pattern: escapeHtmlAttr(...)
  fix: echo htmlentities($...VARS);
  metadata:
    technology:
    - php
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    references:
    - https://www.php.net/manual/en/function.htmlentities.php
    - https://www.php.net/manual/en/reserved.variables.request.php
    - https://www.php.net/manual/en/reserved.variables.post.php
    - https://www.php.net/manual/en/reserved.variables.get.php
    - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/php.lang.security.injection.echoed-request.echoed-request
    shortlink: https://sg.run/Bqqb
    semgrep.dev:
      rule:
        r_id: 31707
        rv_id: 1263283
        rule_id: BYUyyg
        version_id: d6TyxE9
        url: https://semgrep.dev/playground/r/d6TyxE9/php.lang.security.injection.echoed-request.echoed-request
        origin: community
- id: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://semgrep.dev/blog/2022/xml-security-in-java
    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
    - https://blog.sonarsource.com/secure-xml-processor
    - https://xerces.apache.org/xerces2-j/features.html
    category: security
    technology:
    - java
    - xml
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing
    shortlink: https://sg.run/Gj32
    semgrep.dev:
      rule:
        r_id: 59048
        rv_id: 1263061
        rule_id: j2Udpk
        version_id: YDTZeko
        url: https://semgrep.dev/playground/r/YDTZeko/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing
        origin: community
  message: DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable
    to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl`
    to true. Alternatively, allow DOCTYPE declarations and only prohibit external
    entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities`
    and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE -
    The previous links are not meant to be clicked. They are the literal config key
    values that are supposed to be used to disable these features. For more information,
    see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory.
  mode: taint
  pattern-sources:
  - by-side-effect: true
    patterns:
    - pattern-either:
      - pattern: |
          $FACTORY = SAXParserFactory.newInstance();
      - patterns:
        - pattern: $FACTORY
        - pattern-inside: |
            class $C {
              ...
              $V $FACTORY = SAXParserFactory.newInstance();
              ...
            }
        - pattern-not-inside: |
            class $C {
              ...
              $V $FACTORY = SAXParserFactory.newInstance();
              static {
                ...
                $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
                ...
              }
              ...
            }
        - pattern-not-inside: |
            class $C {
              ...
              $V $FACTORY = SAXParserFactory.newInstance();
              static {
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
                ...
              }
              ...
            }
        - pattern-not-inside: |
            class $C {
              ...
              $V $FACTORY = SAXParserFactory.newInstance();
              static {
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
                ...
              }
              ...
            }
  pattern-sinks:
  - patterns:
    - pattern: $FACTORY.newSAXParser();
  pattern-sanitizers:
  - by-side-effect: true
    pattern-either:
    - patterns:
      - pattern-either:
        - pattern: |
            $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        - pattern: |
            $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
            ...
            $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        - pattern: |
            $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
            ...
            $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
      - focus-metavariable: $FACTORY
    - patterns:
      - pattern-either:
        - pattern-inside: |
            class $C {
              ...
              $T $M(...) {
                ...
                $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
                true);
                ...
              }
              ...
            }
        - pattern-inside: |
            class $C {
              ...
              $T $M(...) {
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
                ...
              }
              ...
            }
        - pattern-inside: |
            class $C {
              ...
              $T $M(...) {
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
                ...
                $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities",false);
                ...
              }
              ...
            }
      - pattern: $M($X)
      - focus-metavariable: $X
  fix: |
    $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
    $FACTORY.newSAXParser();
  languages:
  - java
- id: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://semgrep.dev/blog/2022/xml-security-in-java
    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
    - https://blog.sonarsource.com/secure-xml-processor
    - https://xerces.apache.org/xerces2-j/features.html
    category: security
    technology:
    - java
    - xml
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled
    shortlink: https://sg.run/1wyQ
    semgrep.dev:
      rule:
        r_id: 59622
        rv_id: 1263062
        rule_id: v8UeQ1
        version_id: 6xT29GK
        url: https://semgrep.dev/playground/r/6xT29GK/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled
        origin: community
  message: DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable
    to XML external entity attacks. Disable this by setting the attributes "accessExternalDTD"
    and "accessExternalStylesheet" to "".
  mode: taint
  pattern-sources:
  - by-side-effect: true
    patterns:
    - pattern-either:
      - pattern: |
          $FACTORY = TransformerFactory.newInstance();
      - patterns:
        - pattern: $FACTORY
        - pattern-inside: |
            class $C {
              ...
              $V $FACTORY = TransformerFactory.newInstance();
              ...
            }
        - pattern-not-inside: |
            class $C {
              ...
              $V $FACTORY = TransformerFactory.newInstance();
              static {
                ...
                $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
                ...
                $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
                ...
              }
              ...
            }
        - pattern-not-inside: |
            class $C {
              ...
              $V $FACTORY = TransformerFactory.newInstance();
              static {
                ...
                $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
                ...
                $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
                ...
              }
              ...
            }
        - pattern-not-inside: |
            class $C {
              ...
              $V $FACTORY = TransformerFactory.newInstance();
              static {
                ...
                $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
                ...
                $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
                ...
              }
              ...
            }
        - pattern-not-inside: |
            class $C {
              ...
              $V $FACTORY = TransformerFactory.newInstance();
              static {
                ...
                $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
                ...
                $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
                ...
              }
              ...
            }
  pattern-sinks:
  - patterns:
    - pattern: $FACTORY.newTransformer(...);
  pattern-sanitizers:
  - by-side-effect: true
    pattern-either:
    - patterns:
      - pattern-either:
        - pattern: |
            $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ...
            $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
        - pattern: |
            $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
            ...
            $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
        - pattern: |
            $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ...
            $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
        - pattern: |
            $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
            ...
            $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
      - focus-metavariable: $FACTORY
    - patterns:
      - pattern-either:
        - pattern-inside: |
            class $C {
              ...
              $T $M(...) {
                ...
                $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
                ...
                $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
                ...
              }
              ...
            }
        - pattern-inside: |
            class $C {
              ...
              $T $M(...) {
                ...
                $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
                ...
                $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
                ...
              }
              ...
            }
        - pattern-inside: |
            class $C {
              ...
              $T $M(...) {
                ...
                $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
                ...
                $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
                ...
              }
              ...
            }
        - pattern-inside: |
            class $C {
              ...
              $T $M(...) {
                ...
                $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
                ...
                $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
                ...
              }
              ...
            }
      - pattern: $M($X)
      - focus-metavariable: $X
  fix: |
    $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
    $FACTORY.newTransformer(...);
  languages:
  - java
- id: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request
  message: Detected input from a HTTPServletRequest going into the environment variables
    of an 'exec' command.  Instead, call the command with user-supplied arguments
    by using the overloaded method with one String array as the argument. `exec({"command",
    "arg1", "arg2"})`.
  languages:
  - java
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletRequest $REQ)
      - patterns:
        - pattern-inside: |
            (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
            ...
            for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
              ...
            }
        - pattern: |
            $COOKIE.getValue(...)
  pattern-sinks:
  - patterns:
    - pattern: (java.lang.Runtime $R).exec($CMD, $ENV_ARGS, ...);
    - focus-metavariable: $ENV_ARGS
  metadata:
    category: security
    technology:
    - java
    cwe:
    - 'CWE-454: External Initialization of Trusted Variables or Data Stores'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: false
    cwe2021-top25: false
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request
    shortlink: https://sg.run/EJAB
    semgrep.dev:
      rule:
        r_id: 70981
        rv_id: 1409391
        rule_id: nJULjy
        version_id: LjTRL6W
        url: https://semgrep.dev/playground/r/LjTRL6W/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request
        origin: community
- id: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe
  languages:
  - clojure
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://semgrep.dev/blog/2022/xml-security-in-java
    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
    - https://xerces.apache.org/xerces2-j/features.html
    source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/xxe-clojure-xml/xxe-clojure-xml.yml
    category: security
    technology:
    - clojure
    - xml
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe
    shortlink: https://sg.run/v7An
    semgrep.dev:
      rule:
        r_id: 71533
        rv_id: 1262608
        rule_id: bwU3Gj
        version_id: WrTqKyD
        url: https://semgrep.dev/playground/r/WrTqKyD/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe
        origin: community
  message: DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory.
    Without prohibiting external entity declarations, this is vulnerable to XML external
    entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl"
    to true. Alternatively, allow DOCTYPE declarations and only prohibit external
    entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities"
    and "http://xml.org/sax/features/external-parameter-entities" to false.
  patterns:
  - pattern-inside: |
      (ns ... (:require [clojure.xml :as ...]))
      ...
  - pattern-either:
    - pattern-inside: |
        (def ... ... ( ... ))
    - pattern-inside: |
        (defn ... ... ( ... ))
  - pattern-either:
    - pattern: (clojure.xml/parse $INPUT)
    - patterns:
      - pattern-inside: |
          (doto (javax.xml.parsers.SAXParserFactory/newInstance) ...)
      - pattern: (.setFeature "http://apache.org/xml/features/disallow-doctype-decl"
          false)
      - pattern-not-inside: |
          (doto (javax.xml.parsers.SAXParserFactory/newInstance)
            ...
            (.setFeature "http://xml.org/sax/features/external-general-entities" false)
            ...
            (.setFeature "http://xml.org/sax/features/external-parameter-entities" false)
            ...)
      - pattern-not-inside: |
          (doto (javax.xml.parsers.SAXParserFactory/newInstance)
            ...
            (.setFeature "http://xml.org/sax/features/external-parameter-entities" false)
            ...
            (.setFeature "http://xml.org/sax/features/external-general-entities" false)
            ...)
- id: generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param
  languages:
  - generic
  severity: ERROR
  message: To remediate this issue, ensure that all URL parameters are properly escaped
    before including them in scripts. Please update your code to use either the JSENCODE
    method to escape URL parameters or the escape="true" attribute on <apex:outputText>
    tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity
    for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type
    of injection, in which malicious scripts are injected into otherwise benign and
    trusted websites. To remediate this issue, ensure that all URL parameters are
    properly escaped before including them in scripts.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm
    category: security
    subcategory:
    - vuln
    technology:
    - salesforce
    - visualforce
    cwe2022-top25: true
    cwe2021-top25: true
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param
    shortlink: https://sg.run/9bGk
    semgrep.dev:
      rule:
        r_id: 72423
        rv_id: 1262906
        rule_id: BYUAJ2
        version_id: GxTkekB
        url: https://semgrep.dev/playground/r/GxTkekB/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param
        origin: community
  patterns:
  - pattern-either:
    - pattern: <apex:outputText...escape="false"...value="{!...CurrentPage.parameters.$URL_PARAM}".../>
    - pattern: <apex:outputText...value="{!...CurrentPage.parameters.$URL_PARAM}"...escape="false".../>
    - pattern: <script>...'{!...CurrentPage.parameters.$URL_PARAM}'...</script>
  - pattern-not: <script>...'{!...JSENCODE(...CurrentPage.parameters.$URL_PARAM})'...</script>
  paths:
    include:
    - '*.component'
    - '*.page'
- id: generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute
  languages:
  - generic
  severity: INFO
  message: Visualforce Pages must have the cspHeader attribute set to true. This attribute
    is available in API version 55 or higher.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5
    category: security
    subcategory:
    - vuln
    technology:
    - salesforce
    - visualforce
    cwe2022-top25: true
    cwe2021-top25: true
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute
    shortlink: https://sg.run/yoj8
    semgrep.dev:
      rule:
        r_id: 72424
        rv_id: 1262907
        rule_id: DbUj7d
        version_id: RGT0L0r
        url: https://semgrep.dev/playground/r/RGT0L0r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute
        origin: community
  patterns:
  - pattern: <apex:page...>...</apex:page>
  - pattern-not: <apex:page...cspHeader="true"...>...</apex:page>
  - pattern-not: <apex:page...>...<!--deprecated-->...</apex:page>
  - pattern-not: <apex:page...>...<!-- deprecated -->...</apex:page>
  paths:
    include:
    - '*.page'
- id: generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version
  languages:
  - generic
  severity: WARNING
  message: Visualforce Pages must use API version 55 or higher for required use of
    the cspHeader attribute set to true.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm
    category: security
    subcategory:
    - vuln
    technology:
    - salesforce
    - visualforce
    cwe2022-top25: true
    cwe2021-top25: true
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version
    shortlink: https://sg.run/rWr6
    semgrep.dev:
      rule:
        r_id: 72425
        rv_id: 1262908
        rule_id: WAUwJW
        version_id: A8Tgdgn
        url: https://semgrep.dev/playground/r/A8Tgdgn/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version
        origin: community
  patterns:
  - pattern-inside: <apiVersion.../apiVersion>
  - pattern-either:
    - pattern-regex: '[>][0-9].[0-9][<]'
    - pattern-regex: '[>][1-4][0-9].[0-9][<]'
    - pattern-regex: '[>][5][0-4].[0-9][<]'
  paths:
    include:
    - '*.page-meta.xml'
- id: python.lang.security.use-defused-xml-parse.use-defused-xml-parse
  metadata:
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    references:
    - https://docs.python.org/3/library/xml.html
    - https://github.com/tiran/defusedxml
    - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse
    shortlink: https://sg.run/n3jG
    semgrep.dev:
      rule:
        r_id: 72436
        rv_id: 1263541
        rule_id: X5Uqnx
        version_id: vdT06ER
        url: https://semgrep.dev/playground/r/vdT06ER/python.lang.security.use-defused-xml-parse.use-defused-xml-parse
        origin: community
  message: The native Python `xml` library is vulnerable to XML External Entity (XXE)
    attacks.  These attacks can leak confidential data and "XML bombs" can cause denial
    of service. Do not use this library to parse untrusted input. Instead  the Python
    documentation recommends using `defusedxml`.
  languages:
  - python
  severity: ERROR
  patterns:
  - pattern: xml.etree.ElementTree.parse($...ARGS)
  - pattern-not: xml.etree.ElementTree.parse("...")
  fix: defusedxml.etree.ElementTree.parse($...ARGS)
- id: php.lang.security.tainted-exec.tainted-exec
  mode: taint
  pattern-sources:
  - pattern: $_REQUEST
  - pattern: $_GET
  - pattern: $_POST
  - pattern: $_COOKIE
  pattern-sinks:
  - pattern: exec(...)
  - pattern: system(...)
  - pattern: popen(...)
  - pattern: passthru(...)
  - pattern: shell_exec(...)
  - pattern: pcntl_exec(...)
  - pattern: proc_open(...)
  pattern-sanitizers:
  - pattern: escapeshellarg(...)
  message: Executing non-constant commands. This can lead to command injection. You
    should use `escapeshellarg()` when using command.
  metadata:
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    references:
    - https://www.stackhawk.com/blog/php-command-injection/
    - https://brightsec.com/blog/code-injection-php/
    - https://www.acunetix.com/websitesecurity/php-security-2/
    category: security
    technology:
    - php
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe2022-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec
    shortlink: https://sg.run/JAkP
    semgrep.dev:
      rule:
        r_id: 73146
        rv_id: 1263300
        rule_id: 9AUw06
        version_id: BjTkZ4y
        url: https://semgrep.dev/playground/r/BjTkZ4y/php.lang.security.tainted-exec.tainted-exec
        origin: community
  languages:
  - php
  severity: ERROR
- id: php.lang.security.injection.tainted-session.tainted-session
  severity: WARNING
  message: Session key based on user input risks session poisoning. The user can determine
    the key used for the session, and thus write any session variable. Session variables
    are typically trusted to be set only by the application, and manipulating the
    session can result in access control issues.
  metadata:
    technology:
    - php
    category: security
    cwe:
    - 'CWE-284: Improper Access Control'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://en.wikipedia.org/wiki/Session_poisoning
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authorization
    source: https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session
    shortlink: https://sg.run/bxNp
    semgrep.dev:
      rule:
        r_id: 73470
        rv_id: 1263289
        rule_id: 4bUdoP
        version_id: 8KT5rPE
        url: https://semgrep.dev/playground/r/8KT5rPE/php.lang.security.injection.tainted-session.tainted-session
        origin: community
  languages:
  - php
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: $_GET
      - pattern: $_POST
      - pattern: $_COOKIE
      - pattern: $_REQUEST
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern: $A . $B
      - pattern: bin2hex(...)
      - pattern: crc32(...)
      - pattern: crypt(...)
      - pattern: filter_input(...)
      - pattern: filter_var(...)
      - pattern: hash(...)
      - pattern: md5(...)
      - pattern: preg_filter(...)
      - pattern: preg_grep(...)
      - pattern: preg_match_all(...)
      - pattern: sha1(...)
      - pattern: sprintf(...)
      - pattern: str_contains(...)
      - pattern: str_ends_with(...)
      - pattern: str_starts_with(...)
      - pattern: strcasecmp(...)
      - pattern: strchr(...)
      - pattern: stripos(...)
      - pattern: stristr(...)
      - pattern: strnatcasecmp(...)
      - pattern: strnatcmp(...)
      - pattern: strncmp(...)
      - pattern: strpbrk(...)
      - pattern: strpos(...)
      - pattern: strripos(...)
      - pattern: strrpos(...)
      - pattern: strspn(...)
      - pattern: strstr(...)
      - pattern: strtok(...)
      - pattern: substr_compare(...)
      - pattern: substr_count(...)
      - pattern: vsprintf(...)
  pattern-sinks:
  - patterns:
    - pattern-inside: $_SESSION[$KEY] = $VAL;
    - pattern: $KEY
- id: php.lang.security.injection.printed-request.printed-request
  mode: taint
  message: '`Printing user input risks cross-site scripting vulnerability. You should
    use `htmlentities()` when showing data to users.'
  languages:
  - php
  severity: ERROR
  pattern-sources:
  - pattern: $_REQUEST
  - pattern: $_GET
  - pattern: $_POST
  pattern-sinks:
  - pattern: print($...VARS);
  pattern-sanitizers:
  - pattern: htmlentities(...)
  - pattern: htmlspecialchars(...)
  - pattern: strip_tags(...)
  - pattern: isset(...)
  - pattern: empty(...)
  - pattern: esc_html(...)
  - pattern: esc_attr(...)
  - pattern: wp_kses(...)
  - pattern: e(...)
  - pattern: twig_escape_filter(...)
  - pattern: xss_clean(...)
  - pattern: html_escape(...)
  - pattern: Html::escape(...)
  - pattern: Xss::filter(...)
  - pattern: escapeHtml(...)
  - pattern: escapeHtml(...)
  - pattern: escapeHtmlAttr(...)
  fix: print(htmlentities($...VARS));
  metadata:
    technology:
    - php
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    references:
    - https://www.php.net/manual/en/function.htmlentities.php
    - https://www.php.net/manual/en/reserved.variables.request.php
    - https://www.php.net/manual/en/reserved.variables.post.php
    - https://www.php.net/manual/en/reserved.variables.get.php
    - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request
    shortlink: https://sg.run/QrxEJ
    semgrep.dev:
      rule:
        r_id: 128886
        rv_id: 1263284
        rule_id: KxUvRBw
        version_id: ZRTKAk4
        url: https://semgrep.dev/playground/r/ZRTKAk4/php.lang.security.injection.printed-request.printed-request
        origin: community
- id: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded
  message: A secret is hard-coded in the application. Secrets stored in source code,
    such as credentials, identifiers, and other types of sensitive data, can be leaked
    and used by internal or external malicious actors. It is recommended to rotate
    the secret and retrieve them from a secure secret vault or Hardware Security Module
    (HSM), alternatively environment variables can be used if allowed by your company
    policy.
  severity: WARNING
  metadata:
    likelihood: LOW
    impact: HIGH
    confidence: MEDIUM
    category: security
    subcategory:
    - vuln
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    cwe2020-top25: true
    cwe2021-top25: true
    cwe2022-top25: true
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    references:
    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
    technology:
    - secrets
    vulnerability_class:
    - Hard-coded Secrets
    source_rule_url: https://semgrep.dev/playground/r/d8Ur5BA/achufistov6_personal_org.build-gradle-password-hardcoded
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    source: https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded
    shortlink: https://sg.run/qN29x
    semgrep.dev:
      rule:
        r_id: 137856
        rv_id: 1263257
        rule_id: ReUD6Kg
        version_id: DkTRbLX
        url: https://semgrep.dev/playground/r/DkTRbLX/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded
        origin: community
  languages:
  - kotlin
  options:
    symbolic_propagation: true
  patterns:
  - pattern-either:
    - pattern: '$PASS = env[...] ?: $VALUE'
  - metavariable-regex:
      metavariable: $PASS
      regex: (password|pass|passwd|loginPassword)
  - metavariable-pattern:
      language: generic
      metavariable: $VALUE
      patterns:
      - pattern-either:
        - pattern-regex: ^[A-Za-z0-9/+=]+$
  paths:
    include:
    - '*build.gradle.kts'
- id: yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor
  languages:
  - yaml
  message: The Shai-hulud backdoor creates a purposefully vulnerable github action
    with the name `discussion.yaml`.
  paths:
    include:
    - '**/.github/workflows/discussion.yaml'
  metadata:
    category: security
    cwe:
    - 'CWE-509: Replicating Malicious Code (Virus or Worm)'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    technology:
    - github-actions
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source_rule_url: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
    references:
    - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
    source: https://semgrep.dev/r/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor
    shortlink: https://sg.run/JdYPZ
    semgrep.dev:
      rule:
        r_id: 238946
        rv_id: 1263927
        rule_id: 7KUDRPj
        version_id: 6xT29ol
        url: https://semgrep.dev/playground/r/6xT29ol/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor
        origin: community
  patterns:
  - pattern-inside: 'steps: [...]'
  - pattern-inside: |
      - run: ...
        ...
  - pattern: 'run: $SHELL'
  - metavariable-pattern:
      language: generic
      metavariable: $SHELL
      patterns:
      - pattern-either:
        - pattern: ${{ github.event.issue.title }}
        - pattern: ${{ github.event.issue.body }}
        - pattern: ${{ github.event.pull_request.title }}
        - pattern: ${{ github.event.pull_request.body }}
        - pattern: ${{ github.event.comment.body }}
        - pattern: ${{ github.event.review.body }}
        - pattern: ${{ github.event.review_comment.body }}
        - pattern: ${{ github.event.pages. ... .page_name}}
        - pattern: ${{ github.event.head_commit.message }}
        - pattern: ${{ github.event.head_commit.author.email }}
        - pattern: ${{ github.event.head_commit.author.name }}
        - pattern: ${{ github.event.commits ... .author.email }}
        - pattern: ${{ github.event.commits ... .author.name }}
        - pattern: ${{ github.event.pull_request.head.ref }}
        - pattern: ${{ github.event.pull_request.head.label }}
        - pattern: ${{ github.event.pull_request.head.repo.default_branch }}
        - pattern: ${{ github.head_ref }}
        - pattern: ${{ github.event.inputs ... }}
        - pattern: ${{ github.event.discussion.title }}
        - pattern: ${{ github.event.discussion.body }}
        - pattern: ${{ inputs ... }}
  severity: ERROR
- id: yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
  languages:
  - yaml
  message: "A `run:` step pipes the output of `curl` or `wget` directly into a shell
    interpreter. This is the \"curl | bash\" install pattern \u2014 if the remote
    server is compromised or the URL is hijacked, an attacker can execute arbitrary
    code in your CI runner. Consider downloading the file first, verifying its checksum
    or signature, and then executing it."
  metadata:
    category: security
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A03:2021 - Injection
    - A03:2025 - Injection
    references:
    - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
    - https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/
    technology:
    - github-actions
    - bash
    - curl
    cwe2021-top25: true
    cwe2022-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
    shortlink: https://sg.run/GR8K1
    semgrep.dev:
      rule:
        r_id: 309392
        rv_id: 1443456
        rule_id: x8UAgrE
        version_id: 9lT3zYb
        url: https://semgrep.dev/playground/r/9lT3zYb/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
        origin: community
  patterns:
  - pattern-inside: 'steps: [...]'
  - pattern-inside: |
      - run: ...
        ...
  - pattern: 'run: $SHELL'
  - metavariable-pattern:
      language: bash
      metavariable: $SHELL
      patterns:
      - pattern-either:
        - pattern: curl ... | $CMD ...
        - pattern: wget ... | $CMD ...
      - metavariable-regex:
          metavariable: $CMD
          regex: ^(bash|sh|python3?|ruby|perl)$
  severity: ERROR
- id: scala.play.security.tainted-slick-sqli.tainted-slick-sqli
  mode: taint
  metadata:
    references:
    - https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values
    - https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code
    category: security
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    technology:
    - scala
    - slick
    - play
    confidence: HIGH
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli
    shortlink: https://sg.run/k9K2
    semgrep.dev:
      rule:
        r_id: 18328
        rv_id: 1263687
        rule_id: GdUDWO
        version_id: d6TyxJe
        url: https://semgrep.dev/playground/r/d6TyxJe/scala.play.security.tainted-slick-sqli.tainted-slick-sqli
        origin: community
  message: Detected a tainted SQL statement. This could lead to SQL injection if variables
    in the SQL statement are not properly sanitized. Avoid using using user input
    for generating SQL strings.
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: $REQ
        - pattern-either:
          - pattern-inside: "Action {\n  $REQ: Request[$T] => \n    ...\n}\n"
          - pattern-inside: "Action(...) {\n  $REQ: Request[$T] => \n    ...\n}\n"
          - pattern-inside: "Action.async {\n  $REQ: Request[$T] => \n    ...\n}\n"
          - pattern-inside: "Action.async(...) {\n  $REQ: Request[$T] => \n    ...\n}\n"
      - patterns:
        - pattern: $PARAM
        - pattern-either:
          - pattern-inside: |
              def $CTRL(..., $PARAM: $TYPE, ...) = Action {
                ...
              }
          - pattern-inside: |
              def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {
                ...
              }
          - pattern-inside: |
              def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {
                ...
              }
          - pattern-inside: |
              def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {
                ...
              }
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: $MODEL.overrideSql(...)
      - pattern: sql"..."
    - pattern-inside: |
        import slick.$DEPS
        ...
  severity: ERROR
  languages:
  - scala
