ARC/backend/app/sandbox/rules/security-audit.yaml

rules:
- id: dockerfile.security.last-user-is-root.last-user-is-root
  patterns:
  - pattern: USER root
  - pattern-not-inside:
      patterns:
      - pattern: |
          USER root
          ...
          USER $X
      - metavariable-pattern:
          metavariable: $X
          patterns:
          - pattern-not: root
  message: The last user in the container is 'root'. This is a security hazard because
    if an attacker gains control of the container they will have root access. Switch
    back to another user after running commands as 'root'.
  severity: ERROR
  languages:
  - dockerfile
  metadata:
    cwe:
    - 'CWE-269: Improper Privilege Management'
    source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3002
    references:
    - https://github.com/hadolint/hadolint/wiki/DL3002
    category: security
    technology:
    - dockerfile
    confidence: MEDIUM
    owasp:
    - A04:2021 - Insecure Design
    - A06:2025 - Insecure Design
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authorization
    source: https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root
    shortlink: https://sg.run/5Z43
    semgrep.dev:
      rule:
        r_id: 20147
        rv_id: 1262658
        rule_id: ReU2n5
        version_id: 6xT29Eg
        url: https://semgrep.dev/playground/r/6xT29Eg/dockerfile.security.last-user-is-root.last-user-is-root
        origin: community
- id: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn
  pattern: gets(...)
  message: Avoid 'gets()'. This function does not consider buffer boundaries and can
    lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead.
  metadata:
    cwe:
    - 'CWE-676: Use of Potentially Dangerous Function'
    references:
    - https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s
    category: security
    technology:
    - c
    confidence: MEDIUM
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Dangerous Method or Function
    source: https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn
    shortlink: https://sg.run/dKqX
    semgrep.dev:
      rule:
        r_id: 8834
        rv_id: 945170
        rule_id: GdU7OE
        version_id: YDTvRlQ
        url: https://semgrep.dev/playground/r/YDTvRlQ/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn
        origin: community
  languages:
  - c
  severity: ERROR
- id: c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn
  message: Avoid using user-controlled format strings passed into 'sprintf', 'printf'
    and 'vsprintf'. These functions put you at risk of buffer overflow vulnerabilities
    through the use of format string exploits. Instead, use 'snprintf' and 'vsnprintf'.
  metadata:
    cwe:
    - 'CWE-134: Use of Externally-Controlled Format String'
    references:
    - https://doc.castsoftware.com/display/SBX/Never+use+sprintf%28%29+or+vsprintf%28%29+functions
    - https://www.cvedetails.com/cwe-details/134/Uncontrolled-Format-String.html
    category: security
    technology:
    - c
    confidence: LOW
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Validation
    source: https://semgrep.dev/r/c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn
    shortlink: https://sg.run/ZvJx
    semgrep.dev:
      rule:
        r_id: 8835
        rv_id: 945172
        rule_id: ReUgWx
        version_id: o5TZeB2
        url: https://semgrep.dev/playground/r/o5TZeB2/c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn
        origin: community
  languages:
  - c
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: |
        $FUNC($BUFFER, argv[$NUM], ...);
        ...
        vsprintf(..., $BUFFER, ...);
    - pattern: vsprintf(..., argv[$NUM], ...)
    - pattern: |
        $FUNC($BUFFER, argv[$NUM], ...);
        ...
        sprintf(..., $BUFFER, ...);
    - pattern: sprintf(...,argv[$NUM],...)
    - pattern: |
        $FUNC($BUFFER, argv[$NUM], ...);
        ...
        printf(..., $BUFFER, ...);
    - pattern: printf(...,argv[$NUM],...)
  - metavariable-comparison:
      metavariable: $NUM
      comparison: int($NUM) > 0
- id: c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn
  pattern-either:
  - pattern: strcat(...)
  - pattern: strncat(...)
  message: Finding triggers whenever there is a strcat or strncat used. This is an
    issue because strcat or strncat can lead to buffer overflow vulns. Fix this by
    using strcat_s instead.
  metadata:
    cwe:
    - 'CWE-676: Use of Potentially Dangerous Function'
    references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-12553
    - https://techblog.mediaservice.net/2020/04/cve-2020-2851-stack-based-buffer-overflow-in-cde-libdtsvc/
    category: security
    technology:
    - c
    confidence: LOW
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Dangerous Method or Function
    source: https://semgrep.dev/r/c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn
    shortlink: https://sg.run/EkRP
    semgrep.dev:
      rule:
        r_id: 8837
        rv_id: 945174
        rule_id: BYUNjA
        version_id: pZTNOXb
        url: https://semgrep.dev/playground/r/pZTNOXb/c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn
        origin: community
  languages:
  - c
  severity: WARNING
- id: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn
  pattern: strtok(...)
  message: Avoid using 'strtok()'. This function directly modifies the first argument
    buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead.
  metadata:
    cwe:
    - 'CWE-676: Use of Potentially Dangerous Function'
    references:
    - https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged
    - https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS
    - https://stackoverflow.com/a/40335556
    category: security
    technology:
    - c
    confidence: LOW
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Dangerous Method or Function
    source: https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn
    shortlink: https://sg.run/LwqG
    semgrep.dev:
      rule:
        r_id: 8839
        rv_id: 1028278
        rule_id: WAUo5v
        version_id: qkTx1oq
        url: https://semgrep.dev/playground/r/qkTx1oq/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn
        origin: community
  languages:
  - c
  severity: WARNING
- id: c.lang.security.double-free.double-free
  patterns:
  - pattern-not: |
      free($VAR);
      ...
      $VAR = NULL;
      ...
      free($VAR);
  - pattern-not: |
      free($VAR);
      ...
      $VAR = malloc(...);
      ...
      free($VAR);
  - pattern-inside: |
      free($VAR);
      ...
      $FREE($VAR);
  - metavariable-pattern:
      metavariable: $FREE
      pattern: free
  - focus-metavariable: $FREE
  message: Variable '$VAR' was freed twice. This can lead to undefined behavior.
  metadata:
    cwe:
    - 'CWE-415: Double Free'
    owasp:
    - A03:2021 - Injection
    - A01:2017 - Injection
    - A05:2025 - Injection
    references:
    - https://cwe.mitre.org/data/definitions/415.html
    - https://owasp.org/www-community/vulnerabilities/Doubly_freeing_memory
    category: security
    technology:
    - c
    confidence: LOW
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Memory Issues
    source: https://semgrep.dev/r/c.lang.security.double-free.double-free
    shortlink: https://sg.run/eLl0
    semgrep.dev:
      rule:
        r_id: 8832
        rv_id: 1262604
        rule_id: JDUyw8
        version_id: RGT0L3W
        url: https://semgrep.dev/playground/r/RGT0L3W/c.lang.security.double-free.double-free
        origin: community
  languages:
  - c
  severity: ERROR
- id: c.lang.security.use-after-free.use-after-free
  patterns:
  - pattern-either:
    - pattern: $VAR->$ACCESSOR
    - pattern: (*$VAR).$ACCESSOR
    - pattern: $VAR[$NUM]
  - pattern-inside: free($VAR); ...
  - pattern-not-inside: $VAR = NULL; ...
  - pattern-not-inside: free($VAR); ... $VAR = malloc(...); ...
  message: Variable '$VAR' was used after being freed. This can lead to undefined
    behavior.
  metadata:
    cwe:
    - 'CWE-416: Use After Free'
    references:
    - https://cwe.mitre.org/data/definitions/416.html
    - https://ctf-wiki.github.io/ctf-wiki/pwn/linux/glibc-heap/use_after_free/
    category: security
    technology:
    - c
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Memory Issues
    source: https://semgrep.dev/r/c.lang.security.use-after-free.use-after-free
    shortlink: https://sg.run/gL6e
    semgrep.dev:
      rule:
        r_id: 8841
        rv_id: 945178
        rule_id: KxUb9l
        version_id: 1QToKPy
        url: https://semgrep.dev/playground/r/1QToKPy/c.lang.security.use-after-free.use-after-free
        origin: community
  languages:
  - c
  severity: WARNING
- id: c.lang.security.random-fd-exhaustion.random-fd-exhaustion
  pattern-either:
  - patterns:
    - pattern: |
        $FD = open("/dev/urandom", ...);
        ...
        read($FD, ...);
    - pattern-not: |
        $FD = open("/dev/urandom", ...);
        ...
        $BYTES_READ = read($FD, ...);
  - patterns:
    - pattern: |
        $FD = open("/dev/random", ...);
        ...
        read($FD, ...);
    - pattern-not: |
        $FD = open("/dev/random", ...);
        ...
        $BYTES_READ = read($FD, ...);
  message: Call to 'read()' without error checking is susceptible to file descriptor
    exhaustion. Consider using the 'getrandom()' function.
  metadata:
    cwe:
    - 'CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling'
    references:
    - https://lwn.net/Articles/606141/
    category: security
    technology:
    - c
    confidence: MEDIUM
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Denial-of-Service (DoS)
    source: https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion
    shortlink: https://sg.run/8yNj
    semgrep.dev:
      rule:
        r_id: 8840
        rv_id: 945177
        rule_id: 0oU5k4
        version_id: jQTzvry
        url: https://semgrep.dev/playground/r/jQTzvry/c.lang.security.random-fd-exhaustion.random-fd-exhaustion
        origin: community
  languages:
  - c
  severity: WARNING
- id: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection
  metadata:
    cwe:
    - 'CWE-300: Channel Accessible by Non-Endpoint'
    references:
    - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption
    category: security
    technology:
    - grpc
    confidence: HIGH
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection
    shortlink: https://sg.run/J9yZ
    semgrep.dev:
      rule:
        r_id: 9090
        rv_id: 1262916
        rule_id: PeUZ4X
        version_id: YDTZeZB
        url: https://semgrep.dev/playground/r/YDTZeZB/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection
        origin: community
  message: 'Found an insecure gRPC connection using ''grpc.WithInsecure()''. This
    creates a connection without encryption to a gRPC server. A malicious attacker
    could tamper with the gRPC message, which could compromise the machine. Instead,
    establish a secure connection with an SSL certificate using the ''grpc.WithTransportCredentials()''
    function. You can create a create credentials using a ''tls.Config{}'' struct
    with ''credentials.NewTLS()''. The final fix looks like this: ''grpc.WithTransportCredentials(credentials.NewTLS(<config>))''.'
  languages:
  - go
  severity: ERROR
  pattern: $GRPC.Dial($ADDR, ..., $GRPC.WithInsecure(...), ...)
  fix-regex:
    regex: (.*)WithInsecure\(.*?\)
    replacement: \1WithTransportCredentials(credentials.NewTLS(<your_tls_config_here>))
- id: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection
  metadata:
    cwe:
    - 'CWE-300: Channel Accessible by Non-Endpoint'
    references:
    - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption
    category: security
    technology:
    - grpc
    confidence: HIGH
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection
    shortlink: https://sg.run/5Q5l
    semgrep.dev:
      rule:
        r_id: 9091
        rv_id: 1262917
        rule_id: JDUy0B
        version_id: 6xT2923
        url: https://semgrep.dev/playground/r/6xT2923/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection
        origin: community
  message: Found an insecure gRPC server without 'grpc.Creds()' or options with credentials.
    This allows for a connection without encryption to this server. A malicious attacker
    could tamper with the gRPC message, which could compromise the machine. Include
    credentials derived from an SSL certificate in order to create a secure gRPC connection.
    You can create credentials using 'credentials.NewServerTLSFromFile("cert.pem",
    "cert.key")'.
  languages:
  - go
  severity: ERROR
  mode: taint
  pattern-sinks:
  - requires: OPTIONS and not CREDS
    pattern: grpc.NewServer($OPT, ...)
  - requires: EMPTY_CONSTRUCTOR
    pattern: grpc.NewServer()
  pattern-sources:
  - label: OPTIONS
    pattern: grpc.ServerOption{ ... }
  - label: CREDS
    pattern: grpc.Creds(...)
  - label: EMPTY_CONSTRUCTOR
    pattern: grpc.NewServer()
- id: go.jwt-go.security.jwt.hardcoded-jwt-key
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  options:
    interfile: true
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    category: security
    technology:
    - jwt
    - secrets
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key
    shortlink: https://sg.run/Rod2
    semgrep.dev:
      rule:
        r_id: 9093
        rv_id: 1262920
        rule_id: GdU7Ny
        version_id: pZT0305
        url: https://semgrep.dev/playground/r/pZT0305/go.jwt-go.security.jwt.hardcoded-jwt-key
        origin: community
  severity: WARNING
  languages:
  - go
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-inside: |
        []byte("$F")
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $TOKEN.SignedString($F)
    - focus-metavariable: $F
- id: go.lang.security.audit.crypto.bad_imports.insecure-module-used
  message: The package `net/http/cgi` is on the import blocklist.  The package is
    vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http`
    or a web framework to build a web application instead.
  metadata:
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec
    references:
    - https://godoc.org/golang.org/x/crypto/sha3
    category: security
    technology:
    - go
    confidence: MEDIUM
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used
    shortlink: https://sg.run/l2gj
    semgrep.dev:
      rule:
        r_id: 9113
        rv_id: 1262921
        rule_id: yyUnov
        version_id: 2KTv2vJ
        url: https://semgrep.dev/playground/r/2KTv2vJ/go.lang.security.audit.crypto.bad_imports.insecure-module-used
        origin: community
  languages:
  - go
  severity: WARNING
  pattern-either:
  - patterns:
    - pattern-inside: |
        import "net/http/cgi"
        ...
    - pattern: |
        cgi.$FUNC(...)
- id: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key
  message: Disabled host key verification detected. This allows man-in-the-middle
    attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification.
    See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to
    learn more about the problem and how to fix it.
  metadata:
    cwe:
    - 'CWE-322: Key Exchange without Entity Authentication'
    owasp:
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://github.com/securego/gosec
    references:
    - https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/
    - https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d
    category: security
    technology:
    - go
    confidence: MEDIUM
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key
    shortlink: https://sg.run/Yv6X
    semgrep.dev:
      rule:
        r_id: 9114
        rv_id: 1262922
        rule_id: r6UrW9
        version_id: X0TzyzN
        url: https://semgrep.dev/playground/r/X0TzyzN/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key
        origin: community
  languages:
  - go
  severity: WARNING
  pattern: ssh.InsecureIgnoreHostKey()
- id: go.lang.security.audit.crypto.math_random.math-random-used
  metadata:
    cwe:
    - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)'
    owasp:
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation
    category: security
    technology:
    - go
    confidence: MEDIUM
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used
    shortlink: https://sg.run/6nK6
    semgrep.dev:
      rule:
        r_id: 9115
        rv_id: 1262923
        rule_id: bwUwy8
        version_id: jQTn5nj
        url: https://semgrep.dev/playground/r/jQTn5nj/go.lang.security.audit.crypto.math_random.math-random-used
        origin: community
  message: Do not use `math/rand`. Use `crypto/rand` instead.
  languages:
  - go
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: |
        import $RAND "$MATH"
    - pattern: |
        import "$MATH"
  - metavariable-regex:
      metavariable: $MATH
      regex: ^(math/rand(\/v[0-9]+)*)$
  - pattern-either:
    - pattern-inside: |
        ...
        rand.$FUNC(...)
    - pattern-inside: |
        ...
        $RAND.$FUNC(...)
  - focus-metavariable:
    - $MATH
  fix: |
    crypto/rand
- id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
  message: SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14,
    SSLv3 will be removed. Instead, use 'tls.VersionTLS13'.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go
    references:
    - https://golang.org/doc/go1.14#crypto/tls
    - https://www.us-cert.gov/ncas/alerts/TA14-290A
    category: security
    technology:
    - go
    confidence: HIGH
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
    shortlink: https://sg.run/zvE1
    semgrep.dev:
      rule:
        r_id: 9117
        rv_id: 1262926
        rule_id: kxUkJ2
        version_id: yeTxpxj
        url: https://semgrep.dev/playground/r/yeTxpxj/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
        origin: community
  languages:
  - go
  severity: WARNING
  fix-regex:
    regex: VersionSSL30
    replacement: VersionTLS13
  pattern: 'tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}'
- id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
  message: Detected an insecure CipherSuite via the 'tls' module. This suite is considered
    weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites.
    See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other
    cipher suites to use.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go
    references:
    - https://golang.org/pkg/crypto/tls/#InsecureCipherSuites
    category: security
    technology:
    - go
    confidence: HIGH
    subcategory:
    - vuln
    likelihood: HIGH
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
    shortlink: https://sg.run/px8N
    semgrep.dev:
      rule:
        r_id: 9118
        rv_id: 1262927
        rule_id: wdUJYk
        version_id: rxTAKAZ
        url: https://semgrep.dev/playground/r/rxTAKAZ/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
        origin: community
  languages:
  - go
  severity: WARNING
  pattern-either:
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256, ...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}}
  - pattern: |
      tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA, ...}
  - pattern: |
      tls.CipherSuite{..., TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}
  - pattern: |
      tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256, ...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES
  message: Detected DES cipher algorithm which is insecure. The algorithm is considered
    weak and has been deprecated. Use AES instead.
  languages:
  - go
  severity: WARNING
  metadata:
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    category: security
    technology:
    - go
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES
    shortlink: https://sg.run/jREA
    semgrep.dev:
      rule:
        r_id: 9121
        rv_id: 1262930
        rule_id: eqU8B3
        version_id: kbTzGzA
        url: https://semgrep.dev/playground/r/kbTzGzA/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES
        origin: community
  patterns:
  - pattern-inside: |
      import "crypto/des"
      ...
  - pattern-either:
    - pattern: |
        des.NewTripleDESCipher(...)
    - pattern: |
        des.NewCipher(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5
  message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
    resistant and is therefore not suitable as a cryptographic signature. Use SHA256
    or SHA3 instead.
  languages:
  - go
  severity: WARNING
  metadata:
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    cwe:
    - 'CWE-328: Use of Weak Hash'
    source-rule-url: https://github.com/securego/gosec#available-rules
    category: security
    technology:
    - go
    confidence: MEDIUM
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Insecure Hashing Algorithm
    source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5
    shortlink: https://sg.run/2xB5
    semgrep.dev:
      rule:
        r_id: 9119
        rv_id: 1262928
        rule_id: x8Un6q
        version_id: bZT535Y
        url: https://semgrep.dev/playground/r/bZT535Y/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5
        origin: community
  patterns:
  - pattern-inside: |
      import "crypto/md5"
      ...
  - pattern-either:
    - pattern: |
        md5.New()
    - pattern: |
        md5.Sum(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4
  message: Detected RC4 cipher algorithm which is insecure. The algorithm has many
    known vulnerabilities. Use AES instead.
  languages:
  - go
  severity: WARNING
  metadata:
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    category: security
    technology:
    - go
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4
    shortlink: https://sg.run/1ZAD
    semgrep.dev:
      rule:
        r_id: 9122
        rv_id: 1262931
        rule_id: v8Unl0
        version_id: w8TRoRQ
        url: https://semgrep.dev/playground/r/w8TRoRQ/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4
        origin: community
  patterns:
  - pattern-inside: |
      import "crypto/rc4"
      ...
  - pattern: rc4.NewCipher(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1
  message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
    collision resistant and is therefore not suitable as a cryptographic signature.
    Use SHA256 or SHA3 instead.
  languages:
  - go
  severity: WARNING
  metadata:
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    cwe:
    - 'CWE-328: Use of Weak Hash'
    source-rule-url: https://github.com/securego/gosec#available-rules
    category: security
    technology:
    - go
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Insecure Hashing Algorithm
    source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1
    shortlink: https://sg.run/XBYA
    semgrep.dev:
      rule:
        r_id: 9120
        rv_id: 1262929
        rule_id: OrU31O
        version_id: NdTzyz1
        url: https://semgrep.dev/playground/r/NdTzyz1/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1
        origin: community
  patterns:
  - pattern-inside: |
      import "crypto/sha1"
      ...
  - pattern-either:
    - pattern: |
        sha1.New()
    - pattern: |
        sha1.Sum(...)
- id: go.lang.security.audit.database.string-formatted-query.string-formatted-query
  languages:
  - go
  message: String-formatted SQL query detected. This could lead to SQL injection if
    the string is not sanitized properly. Audit this call to ensure the SQL is not
    manipulable by external data.
  severity: WARNING
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    source-rule-url: https://github.com/securego/gosec
    category: security
    technology:
    - go
    confidence: LOW
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query
    shortlink: https://sg.run/ydEr
    semgrep.dev:
      rule:
        r_id: 9124
        rv_id: 1262937
        rule_id: ZqU5bD
        version_id: ZRTKA2q
        url: https://semgrep.dev/playground/r/ZRTKA2q/go.lang.security.audit.database.string-formatted-query.string-formatted-query
        origin: community
  patterns:
  - metavariable-regex:
      metavariable: $OBJ
      regex: (?i).*(db|database)
  - pattern-not-inside: |
      $VAR = "..." + "..."
      ...
      $OBJ.$SINK(..., $VAR, ...)
  - pattern-not: $OBJ.Exec("...")
  - pattern-not: $OBJ.ExecContext($CTX, "...")
  - pattern-not: $OBJ.Query("...")
  - pattern-not: $OBJ.QueryContext($CTX, "...")
  - pattern-not: $OBJ.QueryRow("...")
  - pattern-not: $OBJ.QueryRow($CTX, "...")
  - pattern-not: $OBJ.QueryRowContext($CTX, "...")
  - pattern-either:
    - pattern: $OBJ.Exec($X + ...)
    - pattern: $OBJ.ExecContext($CTX, $X + ...)
    - pattern: $OBJ.Query($X + ...)
    - pattern: $OBJ.QueryContext($CTX, $X + ...)
    - pattern: $OBJ.QueryRow($X + ...)
    - pattern: $OBJ.QueryRow($CTX, $X + ...)
    - pattern: $OBJ.QueryRowContext($CTX, $X + ...)
    - pattern: $OBJ.Exec(fmt.$P("...", ...))
    - pattern: $OBJ.ExecContext($CTX, fmt.$P("...", ...))
    - pattern: $OBJ.Query(fmt.$P("...", ...))
    - pattern: $OBJ.QueryContext($CTX, fmt.$P("...", ...))
    - pattern: $OBJ.QueryRow(fmt.$P("...", ...))
    - pattern: $OBJ.QueryRow($CTX, fmt.$U("...", ...))
    - pattern: $OBJ.QueryRowContext($CTX, fmt.$P("...", ...))
    - patterns:
      - pattern-either:
        - pattern: $QUERY = fmt.Fprintf($F, "$SQLSTR", ...)
        - pattern: $QUERY = fmt.Sprintf("$SQLSTR", ...)
        - pattern: $QUERY = fmt.Printf("$SQLSTR", ...)
        - pattern: $QUERY = $X + ...
      - pattern-either:
        - pattern-inside: |
            func $FUNC(...) {
                ...
                $OBJ.Query($QUERY, ...)
                ...
            }
        - pattern-inside: |
            func $FUNC(...) {
                ...
                $OBJ.ExecContext($CTX, $QUERY, ...)
                ...
            }
        - pattern-inside: |
            func $FUNC(...) {
                ...
                $OBJ.Exec($QUERY, ...)
                ...
            }
        - pattern-inside: |
            func $FUNC(...) {
                ...
                $OBJ.QueryRow($CTX, $QUERY)
                ...
            }
        - pattern-inside: |
            func $FUNC(...) {
                ...
                $OBJ.QueryRow($QUERY)
                ...
            }
        - pattern-inside: |
            func $FUNC(...) {
                ...
                $OBJ.QueryContext($CTX, $QUERY)
                ...
            }
        - pattern-inside: |
            func $FUNC(...) {
                ...
                $OBJ.QueryRowContext($CTX, $QUERY, ...)
                ...
            }
- id: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
  message: Detected a network listener listening on 0.0.0.0 or an empty string. This
    could unexpectedly expose the server publicly as it binds to all available interfaces.
    Instead, specify another IP address that is not 0.0.0.0 nor the empty string.
  languages:
  - go
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    source-rule-url: https://github.com/securego/gosec
    category: security
    technology:
    - go
    confidence: HIGH
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mishandled Sensitive Information
    source: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
    shortlink: https://sg.run/rdE0
    semgrep.dev:
      rule:
        r_id: 9125
        rv_id: 1262939
        rule_id: nJUz3J
        version_id: ExTExoK
        url: https://semgrep.dev/playground/r/ExTExoK/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
        origin: community
  pattern-either:
  - pattern: tls.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...)
  - pattern: net.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...)
  - pattern: tls.Listen($NETWORK, "=~/^:.*$/", ...)
  - pattern: net.Listen($NETWORK, "=~/^:.*$/", ...)
- id: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace
  message: Detected a potentially dynamic ClientTrace. This occurred because semgrep
    could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous
    because they deserialize function code to run when certain Request events occur,
    which could lead to code being run without your knowledge. Ensure that your ClientTrace
    is statically defined.
  metadata:
    cwe:
    - 'CWE-913: Improper Control of Dynamically-Managed Code Resources'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://github.com/returntocorp/semgrep-rules/issues/518
    category: security
    technology:
    - go
    confidence: MEDIUM
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace
    shortlink: https://sg.run/kXEK
    semgrep.dev:
      rule:
        r_id: 9128
        rv_id: 1262942
        rule_id: L1Uyjp
        version_id: 8KT5rNv
        url: https://semgrep.dev/playground/r/8KT5rNv/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace
        origin: community
  patterns:
  - pattern-not-inside: |
      package $PACKAGE
      ...
      &httptrace.ClientTrace { ... }
      ...
  - pattern: httptrace.WithClientTrace($ANY, $TRACE)
  severity: WARNING
  languages:
  - go
- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string
  message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()'
    does not escape contents. Be absolutely sure there is no user-controlled data
    in this template. If user data can reach this template, you may have a XSS vulnerability.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://golang.org/pkg/html/template/#HTML
    category: security
    technology:
    - go
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string
    shortlink: https://sg.run/weE0
    semgrep.dev:
      rule:
        r_id: 9129
        rv_id: 1262943
        rule_id: 8GUjDW
        version_id: gETB7Pe
        url: https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string
        origin: community
  languages:
  - go
  severity: WARNING
  patterns:
  - pattern-not: template.HTML("..." + "...")
  - pattern-either:
    - pattern: template.HTML($T + $X, ...)
    - pattern: template.HTML(fmt.$P("...", ...), ...)
    - pattern: |
        $T = "..."
        ...
        $T = $FXN(..., $T, ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = fmt.$P("...", ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T, $ERR = fmt.$P("...", ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = $X + $Y
        ...
        template.HTML($T, ...)
    - pattern: |-
        $T = "..."
        ...
        $OTHER, $ERR = fmt.$P(..., $T, ...)
        ...
        template.HTML($OTHER, ...)
- id: go.lang.security.audit.net.pprof.pprof-debug-exposure
  metadata:
    cwe:
    - 'CWE-489: Active Debug Code'
    owasp: A06:2017 - Security Misconfiguration
    source-rule-url: https://github.com/securego/gosec#available-rules
    references:
    - https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/
    category: security
    technology:
    - go
    confidence: LOW
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Active Debug Code
    source: https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure
    shortlink: https://sg.run/x1Ep
    semgrep.dev:
      rule:
        r_id: 9130
        rv_id: 945583
        rule_id: gxU1Kp
        version_id: 9lTy168
        url: https://semgrep.dev/playground/r/9lTy168/go.lang.security.audit.net.pprof.pprof-debug-exposure
        origin: community
  message: The profiling 'pprof' endpoint is automatically exposed on /debug/pprof.
    This could leak information about the server. Instead, use `import "net/http/pprof"`.
    See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/
    for more information and mitigation.
  languages:
  - go
  severity: WARNING
  patterns:
  - pattern-inside: |
      import _ "net/http/pprof"
      ...
  - pattern-inside: |
      func $ANY(...) {
        ...
      }
  - pattern-not-inside: |
      $MUX = http.NewServeMux(...)
      ...
      http.ListenAndServe($ADDR, $MUX)
  - pattern-not: http.ListenAndServe("=~/^localhost.*/", ...)
  - pattern-not: http.ListenAndServe("=~/^127[.]0[.]0[.]1.*/", ...)
  - pattern: http.ListenAndServe(...)
- id: go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr
  message: Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()'
    does not escape contents. Be absolutely sure there is no user-controlled data
    in this template or validate and sanitize the data before passing it into the
    template.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://golang.org/pkg/html/template/#HTMLAttr
    category: security
    technology:
    - go
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr
    shortlink: https://sg.run/OPRp
    semgrep.dev:
      rule:
        r_id: 9131
        rv_id: 1262945
        rule_id: QrUz9R
        version_id: 3ZT4XRr
        url: https://semgrep.dev/playground/r/3ZT4XRr/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr
        origin: community
  languages:
  - go
  severity: WARNING
  pattern-either:
  - pattern: template.HTMLAttr($T + $X, ...)
  - pattern: template.HTMLAttr(fmt.$P("...", ...), ...)
  - pattern: |
      $T = "..."
      ...
      $T = $FXN(..., $T, ...)
      ...
      template.HTMLAttr($T, ...)
  - pattern: |
      $T = fmt.$P("...", ...)
      ...
      template.HTMLAttr($T, ...)
  - pattern: |
      $T, $ERR = fmt.$P("...", ...)
      ...
      template.HTMLAttr($T, ...)
  - pattern: |
      $T = $X + $Y
      ...
      template.HTMLAttr($T, ...)
  - pattern: |-
      $T = "..."
      ...
      $OTHER, $ERR = fmt.$P(..., $T, ...)
      ...
      template.HTMLAttr($OTHER, ...)
- id: go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js
  message: Found a formatted template string passed to 'template.JS()'. 'template.JS()'
    does not escape contents. Be absolutely sure there is no user-controlled data
    in this template.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://golang.org/pkg/html/template/#JS
    category: security
    technology:
    - go
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js
    shortlink: https://sg.run/eLNl
    semgrep.dev:
      rule:
        r_id: 9132
        rv_id: 1262946
        rule_id: 3qUP8K
        version_id: 44TEj9E
        url: https://semgrep.dev/playground/r/44TEj9E/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js
        origin: community
  languages:
  - go
  severity: WARNING
  pattern-either:
  - pattern: template.JS($T + $X, ...)
  - pattern: template.JS(fmt.$P("...", ...), ...)
  - pattern: |
      $T = "..."
      ...
      $T = $FXN(..., $T, ...)
      ...
      template.JS($T, ...)
  - pattern: |
      $T = fmt.$P("...", ...)
      ...
      template.JS($T, ...)
  - pattern: |
      $T, $ERR = fmt.$P("...", ...)
      ...
      template.JS($T, ...)
  - pattern: |
      $T = $X + $Y
      ...
      template.JS($T, ...)
  - pattern: |
      $T = "..."
      ...
      $OTHER, $ERR = fmt.$P(..., $T, ...)
      ...
      template.JS($OTHER, ...)
- id: go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url
  message: Found a formatted template string passed to 'template.URL()'. 'template.URL()'
    does not escape contents, and this could result in XSS (cross-site scripting)
    and therefore confidential data being stolen. Sanitize data coming into this function
    or make sure that no user-controlled input is coming into the function.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://golang.org/pkg/html/template/#URL
    category: security
    technology:
    - go
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url
    shortlink: https://sg.run/vzE4
    semgrep.dev:
      rule:
        r_id: 9133
        rv_id: 1262947
        rule_id: 4bUkDW
        version_id: PkTR3zz
        url: https://semgrep.dev/playground/r/PkTR3zz/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url
        origin: community
  languages:
  - go
  severity: WARNING
  pattern-either:
  - pattern: template.URL($T + $X, ...)
  - pattern: template.URL(fmt.$P("...", ...), ...)
  - pattern: |
      $T = "..."
      ...
      $T = $FXN(..., $T, ...)
      ...
      template.URL($T, ...)
  - pattern: |
      $T = fmt.$P("...", ...)
      ...
      template.URL($T, ...)
  - pattern: |
      $T, $ERR = fmt.$P("...", ...)
      ...
      template.URL($T, ...)
  - pattern: |
      $T = $X + $Y
      ...
      template.URL($T, ...)
  - pattern: |-
      $T = "..."
      ...
      $OTHER, $ERR = fmt.$P(..., $T, ...)
      ...
      template.URL($OTHER, ...)
- id: go.lang.security.audit.net.use-tls.use-tls
  pattern: http.ListenAndServe($ADDR, $HANDLER)
  fix: http.ListenAndServeTLS($ADDR, certFile, keyFile, $HANDLER)
  metadata:
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    references:
    - https://golang.org/pkg/net/http/#ListenAndServeTLS
    category: security
    technology:
    - go
    confidence: MEDIUM
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mishandled Sensitive Information
    source: https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls
    shortlink: https://sg.run/dKbY
    semgrep.dev:
      rule:
        r_id: 9134
        rv_id: 1262948
        rule_id: PeUZ8X
        version_id: JdTzxkn
        url: https://semgrep.dev/playground/r/JdTzxkn/go.lang.security.audit.net.use-tls.use-tls
        origin: community
  message: Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead.
    See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.
  languages:
  - go
  severity: WARNING
- id: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
  patterns:
  - pattern-inside: |
      func $FUNC(..., $W http.ResponseWriter, ...) {
        ...
        var $TEMPLATE = "..."
        ...
        $W.Write([]byte(fmt.$PRINTF($TEMPLATE, ...)), ...)
        ...
      }
  - pattern-either:
    - pattern: |
        $PARAMS = r.URL.Query()
        ...
        $DATA, $ERR := $PARAMS[...]
        ...
        $INTERM = $ANYTHING(..., $DATA, ...)
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
    - pattern: |
        $PARAMS = r.URL.Query()
        ...
        $DATA, $ERR := $PARAMS[...]
        ...
        $INTERM = $DATA[...]
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
    - pattern: |
        $DATA, $ERR := r.URL.Query()[...]
        ...
        $INTERM = $DATA[...]
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
    - pattern: |
        $DATA, $ERR := r.URL.Query()[...]
        ...
        $INTERM = $ANYTHING(..., $DATA, ...)
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
    - pattern: |
        $PARAMS = r.URL.Query()
        ...
        $DATA, $ERR := $PARAMS[...]
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $DATA, ...)))
  message: Found data going from url query parameters into formatted data written
    to ResponseWriter. This could be XSS and should not be done. If you must do this,
    ensure your data is sanitized or escaped.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - go
    confidence: MEDIUM
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
    shortlink: https://sg.run/Zvon
    semgrep.dev:
      rule:
        r_id: 9135
        rv_id: 1262949
        rule_id: JDUyXB
        version_id: 5PTo1qr
        url: https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
        origin: community
  severity: WARNING
  languages:
  - go
- id: go.lang.security.audit.reflect-makefunc.reflect-makefunc
  message: '''reflect.MakeFunc'' detected. This will sidestep protections that are
    normally afforded by Go''s type system. Audit this call and be sure that user
    input cannot be used to affect the code generated by MakeFunc; otherwise, you
    will have a serious security vulnerability.'
  metadata:
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-913: Improper Control of Dynamically-Managed Code Resources'
    category: security
    technology:
    - go
    confidence: LOW
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc
    shortlink: https://sg.run/KlPd
    semgrep.dev:
      rule:
        r_id: 9111
        rv_id: 1262950
        rule_id: 10UKGb
        version_id: GxTkeqB
        url: https://semgrep.dev/playground/r/GxTkeqB/go.lang.security.audit.reflect-makefunc.reflect-makefunc
        origin: community
  severity: ERROR
  pattern: reflect.MakeFunc(...)
  languages:
  - go
- id: go.lang.security.audit.unsafe.use-of-unsafe-block
  message: Using the unsafe package in Go gives you low-level memory management and
    many of the strengths of the C language, but also steps around the type safety
    of Go and can lead to buffer overflows and possible arbitrary code execution by
    an attacker. Only use this package if you absolutely know what you're doing.
  languages:
  - go
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-242: Use of Inherently Dangerous Function'
    source_rule_url: https://github.com/securego/gosec/blob/master/rules/unsafe.go
    category: security
    technology:
    - go
    confidence: LOW
    references:
    - https://cwe.mitre.org/data/definitions/242.html
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Dangerous Method or Function
    source: https://semgrep.dev/r/go.lang.security.audit.unsafe.use-of-unsafe-block
    shortlink: https://sg.run/qxEx
    semgrep.dev:
      rule:
        r_id: 9112
        rv_id: 945595
        rule_id: 9AU1p1
        version_id: ZRT35Wd
        url: https://semgrep.dev/playground/r/ZRT35Wd/go.lang.security.audit.unsafe.use-of-unsafe-block
        origin: community
  pattern: unsafe.$FUNC(...)
- id: go.lang.security.bad_tmp.bad-tmp-file-creation
  message: File creation in shared tmp directory without using `io.CreateTemp`.
  languages:
  - go
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-377: Insecure Temporary File'
    source-rule-url: https://github.com/securego/gosec
    category: security
    technology:
    - go
    confidence: LOW
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    - https://pkg.go.dev/io/ioutil#TempFile
    - https://pkg.go.dev/os#CreateTemp
    - https://github.com/securego/gosec/blob/5fd2a370447223541cddb35da8d1bc707b7bb153/rules/tempfiles.go#L67
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation
    shortlink: https://sg.run/Gejn
    semgrep.dev:
      rule:
        r_id: 9104
        rv_id: 1262965
        rule_id: 6JUjnL
        version_id: 2KTv2pJ
        url: https://semgrep.dev/playground/r/2KTv2pJ/go.lang.security.bad_tmp.bad-tmp-file-creation
        origin: community
  pattern-either:
  - pattern: ioutil.WriteFile("=~//tmp/.*$/", ...)
  - pattern: os.Create("=~//tmp/.*$/", ...)
  - pattern: os.WriteFile("=~//tmp/.*$/", ...)
- id: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb
  message: 'Detected a possible denial-of-service via a zip bomb attack. By limiting
    the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. '
  severity: WARNING
  languages:
  - go
  patterns:
  - pattern-either:
    - pattern: io.Copy(...)
    - pattern: io.CopyBuffer(...)
  - pattern-either:
    - pattern-inside: |
        gzip.NewReader(...)
        ...
    - pattern-inside: |
        zlib.NewReader(...)
        ...
    - pattern-inside: |
        zlib.NewReaderDict(...)
        ...
    - pattern-inside: |
        bzip2.NewReader(...)
        ...
    - pattern-inside: |
        flate.NewReader(...)
        ...
    - pattern-inside: |
        flate.NewReaderDict(...)
        ...
    - pattern-inside: |
        lzw.NewReader(...)
        ...
    - pattern-inside: |
        tar.NewReader(...)
        ...
    - pattern-inside: |
        zip.NewReader(...)
        ...
    - pattern-inside: |
        zip.OpenReader(...)
        ...
  fix-regex:
    regex: (.*)(Copy|CopyBuffer)\((.*?),(.*?)(\)|,.*\))
    replacement: \1CopyN(\3, \4, 1024*1024*256)
  metadata:
    cwe:
    - 'CWE-400: Uncontrolled Resource Consumption'
    source-rule-url: https://github.com/securego/gosec
    references:
    - https://golang.org/pkg/io/#CopyN
    - https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go
    category: security
    technology:
    - go
    confidence: LOW
    cwe2022-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Denial-of-Service (DoS)
    source: https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb
    shortlink: https://sg.run/RodK
    semgrep.dev:
      rule:
        r_id: 9105
        rv_id: 945606
        rule_id: oqUeqn
        version_id: JdTDye5
        url: https://semgrep.dev/playground/r/JdTDye5/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb
        origin: community
- id: go.lang.security.zip.path-traversal-inside-zip-extraction
  message: File traversal when extracting zip archive
  metadata:
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    source_rule_url: https://github.com/securego/gosec/issues/205
    category: security
    technology:
    - go
    confidence: LOW
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction
    shortlink: https://sg.run/Av64
    semgrep.dev:
      rule:
        r_id: 9106
        rv_id: 1262971
        rule_id: zdUkoR
        version_id: rxTAK1Z
        url: https://semgrep.dev/playground/r/rxTAK1Z/go.lang.security.zip.path-traversal-inside-zip-extraction
        origin: community
  languages:
  - go
  severity: WARNING
  pattern: |
    reader, $ERR := zip.OpenReader($ARCHIVE)
    ...
    for _, $FILE := range reader.File {
      ...
      path := filepath.Join($TARGET, $FILE.Name)
      ...
    }
- id: go.otto.security.audit.dangerous-execution.dangerous-execution
  message: Detected non-static script inside otto VM. Audit the input to 'VM.Run'.
    If unverified user data can reach this call site, this is a code injection vulnerability.
    A malicious actor can inject a malicious script to execute arbitrary code.
  metadata:
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - otto
    - vm
    confidence: LOW
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution
    shortlink: https://sg.run/4xWE
    semgrep.dev:
      rule:
        r_id: 9144
        rv_id: 1262972
        rule_id: KxUbxk
        version_id: bZT53ZY
        url: https://semgrep.dev/playground/r/bZT53ZY/go.otto.security.audit.dangerous-execution.dangerous-execution
        origin: community
  severity: ERROR
  patterns:
  - pattern-inside: |
      $VM = otto.New(...)
      ...
  - pattern-not: $VM.Run("...", ...)
  - pattern: $VM.Run(...)
  languages:
  - go
- id: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
  metadata:
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN
    references:
    - https://www.owasp.org/index.php/Path_Traversal
    category: security
    technology:
    - jax-rs
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
    shortlink: https://sg.run/DoWj
    semgrep.dev:
      rule:
        r_id: 9152
        rv_id: 1262984
        rule_id: 2ZUb9l
        version_id: 7ZTE3KW
        url: https://semgrep.dev/playground/r/7ZTE3KW/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
        origin: community
  message: Detected a potential path traversal. A malicious actor could control the
    location of this file, to include going backwards in the directory with '../'.
    To address this, ensure that user-controlled variables in file paths are sanitized.
    You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...)
    to only retrieve the file name from the path.
  severity: WARNING
  languages:
  - java
  pattern-either:
  - pattern: |
      $RETURNTYPE $FUNC (..., @PathParam(...) $TYPE $VAR, ...) {
        ...
        new File(..., $VAR, ...);
        ...
      }
  - pattern: |-
      $RETURNTYPE $FUNC (..., @javax.ws.rs.PathParam(...) $TYPE $VAR, ...) {
        ...
        new File(..., $VAR, ...);
        ...
      }
- id: java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind
  metadata:
    cwe:
    - 'CWE-287: Improper Authentication'
    owasp:
    - A02:2017 - Broken Authentication
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind
    shortlink: https://sg.run/jR6A
    semgrep.dev:
      rule:
        r_id: 9165
        rv_id: 1262988
        rule_id: eqU8J3
        version_id: QkTGqE0
        url: https://semgrep.dev/playground/r/QkTGqE0/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind
        origin: community
  message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP
    statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html
    for more information.
  severity: WARNING
  pattern: |
    $ENV.put($CTX.SECURITY_AUTHENTICATION, "none");
    ...
    $DCTX = new InitialDirContext($ENV, ...);
  languages:
  - java
- id: java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion
  metadata:
    cwe:
    - 'CWE-704: Incorrect Type Conversion or Cast'
    owasp: A03:2017 - Sensitive Data Exposure
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BAD_HEXA_CONVERSION
    category: security
    technology:
    - java
    references:
    - https://cwe.mitre.org/data/definitions/704.html
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Validation
    source: https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion
    shortlink: https://sg.run/1Z7D
    semgrep.dev:
      rule:
        r_id: 9166
        rv_id: 945646
        rule_id: v8Uny0
        version_id: QkTZzgy
        url: https://semgrep.dev/playground/r/QkTZzgy/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion
        origin: community
  message: '''Integer.toHexString()'' strips leading zeroes from each byte if read
    byte-by-byte. This mistake weakens the hash value computed since it introduces
    more collisions. Use ''String.format("%02X", ...)'' instead.'
  severity: WARNING
  languages:
  - java
  pattern: |-
    $X $METHOD(...) {
      ...
      MessageDigest $MD = ...;
      ...
      $MD.digest(...);
      ...
      Integer.toHexString(...);
    }
- id: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle
  message: Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A
    malicious actor could discern the difference between plaintext with valid or invalid
    padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding'
    instead.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PADDING_ORACLE
    references:
    - https://capec.mitre.org/data/definitions/463.html
    - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes
    - https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY
    category: security
    technology:
    - java
    subcategory:
    - audit
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle
    shortlink: https://sg.run/ydxr
    semgrep.dev:
      rule:
        r_id: 9168
        rv_id: 1262990
        rule_id: ZqU5oD
        version_id: 44TEjbE
        url: https://semgrep.dev/playground/r/44TEjbE/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle
        origin: community
  severity: WARNING
  fix: |
    "AES/GCM/NoPadding"
  languages:
  - java
  patterns:
  - pattern-inside: Cipher.getInstance("=~/.*\/CBC\/PKCS5Padding/")
  - pattern: |
      "=~/.*\/CBC\/PKCS5Padding/"
- id: java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call
  patterns:
  - metavariable-pattern:
      metavariable: $RUNTIME
      patterns:
      - pattern-either:
        - pattern: (java.lang.Runtime $R)
        - pattern: java.lang.Runtime.getRuntime(...)
  - pattern-either:
    - pattern: $RUNTIME.exec($X + $Y);
    - pattern: $RUNTIME.exec(String.format(...));
    - pattern: $RUNTIME.loadLibrary($X + $Y);
    - pattern: $RUNTIME.loadLibrary(String.format(...));
    - patterns:
      - pattern-either:
        - pattern: |
            $RUNTIME.exec("=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $ARG,...)
        - pattern: |
            $RUNTIME.exec(Arrays.asList("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...),...)
        - pattern: |
            $RUNTIME.exec(new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...},...)
        - patterns:
          - pattern-either:
            - pattern: |
                $RUNTIME.exec($CMD,"-c",$ARG,...)
            - pattern: |
                $RUNTIME.exec(Arrays.asList($CMD,"-c",$ARG,...),...)
            - pattern: |
                $RUNTIME.exec(new String[]{$CMD,"-c",$ARG,...},...)
          - pattern-inside: |
              $CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/";
              ...
        - patterns:
          - pattern-either:
            - pattern: |
                $RUNTIME.exec($CMD, $EXECUTE, $ARG, ...)
          - pattern-inside: |
              $CMD = new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/", ...};
              ...
        - patterns:
          - pattern-either:
            - pattern: |
                $RUNTIME.exec("=~/(sh|bash|ksh|csh|tcsh|zsh)/", $BASH, $ARG,...)
            - pattern: |
                $RUNTIME.exec(Arrays.asList("=~/(sh|bash|ksh|csh|tcsh|zsh)/",$BASH,$ARG,...),...)
            - pattern: |
                $RUNTIME.exec(new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/",$BASH,$ARG,...},...)
          - pattern-inside: |
              $BASH = new String[]{"=~/(-c)/", ...};
              ...
      - pattern-not-inside: |
          $ARG = "...";
          ...
      - pattern-not: |
          $RUNTIME.exec("...","...","...",...)
      - pattern-not: |
          $RUNTIME.exec(new String[]{"...","...","...",...},...)
      - pattern-not: |
          $RUNTIME.exec(Arrays.asList("...","...","...",...),...)
  message: A formatted or concatenated string was detected as input to a java.lang.Runtime
    call. This is dangerous if a variable is controlled by user input and could result
    in a command injection. Ensure your variables are not controlled by users or sufficiently
    sanitized.
  metadata:
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#COMMAND_INJECTION.
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call
    shortlink: https://sg.run/rd90
    semgrep.dev:
      rule:
        r_id: 9169
        rv_id: 1262991
        rule_id: nJUzvJ
        version_id: PkTR3ez
        url: https://semgrep.dev/playground/r/PkTR3ez/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call
        origin: community
  severity: ERROR
  languages:
  - java
- id: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly
  metadata:
    cwe:
    - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTPONLY_COOKIE
    asvs:
      section: 'V3: Session Management Verification Requirements'
      control_id: 3.4.2 Missing Cookie Attribute
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management
      version: '4'
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cookie Security
    source: https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly
    shortlink: https://sg.run/b7Be
    semgrep.dev:
      rule:
        r_id: 9170
        rv_id: 1262993
        rule_id: EwU2z6
        version_id: 5PTo17r
        url: https://semgrep.dev/playground/r/5PTo17r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly
        origin: community
  message: A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly'
    flag for cookies instructs the browser to forbid client-side scripts from reading
    the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'
  severity: WARNING
  languages:
  - java
  patterns:
  - pattern-not-inside: $COOKIE.setValue(""); ...
  - pattern-either:
    - pattern: $COOKIE.setHttpOnly(false);
    - patterns:
      - pattern-not-inside: $COOKIE.setHttpOnly(...); ...
      - pattern-not-inside: $COOKIE = ResponseCookie.from(...). ...; ...
      - pattern: $RESPONSE.addCookie($COOKIE);
- id: java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag
  metadata:
    cwe:
    - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_COOKIE
    asvs:
      section: 'V3: Session Management Verification Requirements'
      control_id: 3.4.1 Missing Cookie Attribute
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management
      version: '4'
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cookie Security
    source: https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag
    shortlink: https://sg.run/kXoK
    semgrep.dev:
      rule:
        r_id: 9172
        rv_id: 1262994
        rule_id: L1Uyvp
        version_id: GxTkelB
        url: https://semgrep.dev/playground/r/GxTkelB/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag
        origin: community
  message: A cookie was detected without setting the 'secure' flag. The 'secure' flag
    for cookies prevents the client from transmitting the cookie over insecure channels
    such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'
  severity: WARNING
  languages:
  - java
  patterns:
  - pattern-not-inside: $COOKIE.setValue(""); ...
  - pattern-either:
    - pattern: $COOKIE.setSecure(false);
    - patterns:
      - pattern-not-inside: $COOKIE.setSecure(...); ...
      - pattern-not-inside: $COOKIE = ResponseCookie.from(...). ...; ...
      - pattern: $RESPONSE.addCookie($COOKIE);
- id: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs
  message: When data from an untrusted source is put into a logger and not neutralized
    correctly, an attacker could forge log entries or include malicious content.
  metadata:
    cwe:
    - 'CWE-93: Improper Neutralization of CRLF Sequences (''CRLF Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#CRLF_INJECTION_LOGS
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Validation
    source: https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs
    shortlink: https://sg.run/wek0
    semgrep.dev:
      rule:
        r_id: 9173
        rv_id: 1262995
        rule_id: 8GUjwW
        version_id: RGT0LEr
        url: https://semgrep.dev/playground/r/RGT0LEr/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs
        origin: community
  severity: WARNING
  languages:
  - java
  patterns:
  - pattern-either:
    - patterns:
      - pattern-inside: |
          class $CLASS {
            ...
            Logger $LOG = ...;
            ...
          }
      - pattern-either:
        - pattern-inside: |
            $X $METHOD(...,HttpServletRequest $REQ,...) {
              ...
            }
        - pattern-inside: |
            $X $METHOD(...,ServletRequest $REQ,...) {
              ...
            }
        - pattern-inside: |
            $X $METHOD(...) {
              ...
              HttpServletRequest $REQ = ...;
              ...
            }
        - pattern-inside: |
            $X $METHOD(...) {
              ...
              ServletRequest $REQ = ...;
              ...
            }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          Logger $LOG = ...;
          ...
          HttpServletRequest $REQ = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          Logger $LOG = ...;
          ...
          ServletRequest $REQ = ...;
          ...
        }
  - pattern-either:
    - pattern: |
        String $VAL = $REQ.getParameter(...);
        ...
        $LOG.$LEVEL(<... $VAL ...>);
    - pattern: |
        String $VAL = $REQ.getParameter(...);
        ...
        $LOG.log($LEVEL,<... $VAL ...>);
    - pattern: |
        $LOG.$LEVEL(<... $REQ.getParameter(...) ...>);
    - pattern: |
        $LOG.log($LEVEL,<... $REQ.getParameter(...) ...>);
- id: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated
  message: DES is considered deprecated. AES is the recommended cipher. Upgrade to
    use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard
    for more information.
  metadata:
    functional-categories:
    - crypto::search::symmetric-algorithm::javax.crypto
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DES_USAGE
    asvs:
      section: V6 Stored Cryptography Verification Requirements
      control_id: 6.2.5 Insecure Algorithm
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
      version: '4'
    references:
    - https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard
    - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms
    category: security
    technology:
    - java
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated
    shortlink: https://sg.run/5Q73
    semgrep.dev:
      rule:
        r_id: 9191
        rv_id: 1262996
        rule_id: PeUZNg
        version_id: A8TgdEn
        url: https://semgrep.dev/playground/r/A8TgdEn/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated
        origin: community
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern-inside: $CIPHER.getInstance("=~/DES/.*/")
    - pattern-inside: $CIPHER.getInstance("DES")
  - pattern-either:
    - pattern: |
        "=~/DES/.*/"
    - pattern: |
        "DES"
  fix: |
    "AES/GCM/NoPadding"
  languages:
  - java
  - kt
- id: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated
  message: Triple DES (3DES or DESede) is considered deprecated. AES is the recommended
    cipher. Upgrade to use AES.
  metadata:
    functional-categories:
    - crypto::search::symmetric-algorithm::javax.crypto
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#TDES_USAGE
    references:
    - https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA
    category: security
    technology:
    - java
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated
    shortlink: https://sg.run/Geqn
    semgrep.dev:
      rule:
        r_id: 9192
        rv_id: 1262997
        rule_id: JDUy8J
        version_id: BjTkZyQ
        url: https://semgrep.dev/playground/r/BjTkZyQ/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated
        origin: community
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: |
        $CIPHER.getInstance("=~/DESede.*/")
    - pattern: |
        $CRYPTO.KeyGenerator.getInstance("DES")
  languages:
  - java
  - kt
- id: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher
  patterns:
  - pattern-either:
    - pattern: new NullCipher(...);
    - pattern: new javax.crypto.NullCipher(...);
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER
    asvs:
      section: V6 Stored Cryptography Verification Requirements
      control_id: 6.2.5 Insecure Algorithm
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
      version: '4'
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher
    shortlink: https://sg.run/AvA4
    semgrep.dev:
      rule:
        r_id: 9194
        rv_id: 1263001
        rule_id: GdU7pw
        version_id: K3TKkgB
        url: https://semgrep.dev/playground/r/K3TKkgB/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher
        origin: community
  message: 'NullCipher was detected. This will not encrypt anything; the cipher text
    will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING").
    See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for
    more information.'
  severity: WARNING
  languages:
  - java
- id: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector
  message: Initialization Vectors (IVs) for block ciphers should be randomly generated
    each time they are used. Using a static IV means the same plaintext encrypts to
    the same ciphertext every time, weakening the strength of the encryption.
  metadata:
    cwe:
    - 'CWE-329: Generation of Predictable IV with CBC Mode'
    owasp:
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#STATIC_IV
    asvs:
      section: V6 Stored Cryptography Verification Requirements
      control_id: 6.2.5 Insecure Algorithm
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
      version: '4'
    references:
    - https://cwe.mitre.org/data/definitions/329.html
    category: security
    technology:
    - java
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector
    shortlink: https://sg.run/BkB5
    semgrep.dev:
      rule:
        r_id: 9195
        rv_id: 1263002
        rule_id: ReUgj1
        version_id: qkTR7vP
        url: https://semgrep.dev/playground/r/qkTR7vP/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector
        origin: community
  severity: WARNING
  languages:
  - java
  pattern-either:
  - pattern: |
      byte[] $IV = {
          ...
      };
      ...
      new IvParameterSpec($IV, ...);
  - pattern: |
      class $CLASS {
          byte[] $IV = {
              ...
          };
          ...
          $METHOD(...) {
              ...
              new IvParameterSpec($IV, ...);
              ...
          }
      }
- id: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding
  metadata:
    functional-categories:
    - crypto::search::mode::javax.crypto
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_NO_PADDING
    references:
    - https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/
    asvs:
      section: V6 Stored Cryptography Verification Requirements
      control_id: 6.2.5 Insecure Algorithm
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
      version: '4'
    category: security
    technology:
    - java
    - kotlin
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding
    shortlink: https://sg.run/DoOj
    semgrep.dev:
      rule:
        r_id: 9196
        rv_id: 1263003
        rule_id: AbUzoj
        version_id: l4TJRpK
        url: https://semgrep.dev/playground/r/l4TJRpK/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding
        origin: community
  message: Using RSA without OAEP mode weakens the encryption.
  severity: WARNING
  languages:
  - java
  - kt
  pattern: $CIPHER.getInstance("=~/RSA/[Nn][Oo][Nn][Ee]/NoPadding/")
- id: java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated
  metadata:
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DEFAULT_HTTP_CLIENT
    asvs:
      section: V9 Communications Verification Requirements
      control_id: 9.1.3 Weak TLS
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements
      version: '4'
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated
    shortlink: https://sg.run/J9Gj
    semgrep.dev:
      rule:
        r_id: 9202
        rv_id: 1263005
        rule_id: qNUj8b
        version_id: JdTzxnb
        url: https://semgrep.dev/playground/r/JdTzxnb/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated
        origin: community
  message: DefaultHttpClient is deprecated. Further, it does not support connections
    using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder
    instead.
  severity: WARNING
  languages:
  - java
  pattern: new DefaultHttpClient(...);
  fix-regex:
    regex: DefaultHttpClient
    replacement: HttpClientBuilder
- id: java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier
  message: Insecure HostnameVerifier implementation detected. This will accept any
    SSL certificate with any hostname, which creates the possibility for man-in-the-middle
    attacks.
  metadata:
    cwe:
    - 'CWE-295: Improper Certificate Validation'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_HOSTNAME_VERIFIER
    asvs:
      section: V9 Communications Verification Requirements
      control_id: 9.2.1 Weak TLS
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements
      version: '4'
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier
    shortlink: https://sg.run/5QoD
    semgrep.dev:
      rule:
        r_id: 9203
        rv_id: 1263006
        rule_id: lBU9n8
        version_id: 5PTo17W
        url: https://semgrep.dev/playground/r/5PTo17W/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier
        origin: community
  severity: WARNING
  languages:
  - java
  pattern-either:
  - pattern: |
      class $CLASS implements HostnameVerifier {
        ...
        public boolean verify(...) { return true; }
      }
  - pattern: |-
      new HostnameVerifier(...){
        public boolean verify(...) {
          return true;
        }
      }
  - pattern: import org.apache.http.conn.ssl.NoopHostnameVerifier;
- id: java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager
  metadata:
    cwe:
    - 'CWE-295: Improper Certificate Validation'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_TRUST_MANAGER
    asvs:
      section: V9 Communications Verification Requirements
      control_id: 9.2.1 Weak TLS
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements
      version: '4'
    references:
    - https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https
    category: security
    technology:
    - java
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager
    shortlink: https://sg.run/GePy
    semgrep.dev:
      rule:
        r_id: 9204
        rv_id: 1263007
        rule_id: YGUR9A
        version_id: GxTkel1
        url: https://semgrep.dev/playground/r/GxTkel1/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager
        origin: community
  message: Detected empty trust manager implementations. This is dangerous because
    it accepts any certificate, enabling man-in-the-middle attacks. Consider using
    a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https
    for more information.
  severity: WARNING
  languages:
  - java
  patterns:
  - pattern-either:
    - pattern-inside: |
        class $CLASS implements X509TrustManager {
          ...
        }
    - pattern-inside: |
        new X509TrustManager() {
          ...
        }
    - pattern-inside: |
        class $CLASS implements X509ExtendedTrustManager {
          ...
        }
    - pattern-inside: |
        new X509ExtendedTrustManager() {
          ...
        }
  - pattern-not: public void checkClientTrusted(...) { $SOMETHING; }
  - pattern-not: public void checkServerTrusted(...) { $SOMETHING; }
  - pattern-either:
    - pattern: public void checkClientTrusted(...) {}
    - pattern: public void checkServerTrusted(...) {}
    - pattern: public X509Certificate[] getAcceptedIssuers(...) { return null; }
- id: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket
  metadata:
    functional-categories:
    - net::search::crypto-config::java.net
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNENCRYPTED_SOCKET
    asvs:
      section: V6 Stored Cryptography Verification Requirements
      control_id: 6.2.5 Insecure Algorithm
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
      version: '4'
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mishandled Sensitive Information
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket
    shortlink: https://sg.run/W8zA
    semgrep.dev:
      rule:
        r_id: 9197
        rv_id: 1263008
        rule_id: BYUN3X
        version_id: RGT0LEj
        url: https://semgrep.dev/playground/r/RGT0LEj/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket
        origin: community
  message: Detected use of a Java socket that is not encrypted. As a result, the traffic
    could be read by an attacker intercepting the network traffic. Use an SSLSocket
    created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead.
  severity: WARNING
  languages:
  - java
  pattern-either:
  - pattern: new ServerSocket(...)
  - pattern: new Socket(...)
- id: java.lang.security.audit.el-injection.el-injection
  metadata:
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#EL_INJECTION
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection
    shortlink: https://sg.run/x1wp
    semgrep.dev:
      rule:
        r_id: 9174
        rv_id: 1263021
        rule_id: gxU1Np
        version_id: pZT03e1
        url: https://semgrep.dev/playground/r/pZT03e1/java.lang.security.audit.el-injection.el-injection
        origin: community
  message: An expression is built with a dynamic value. The source of the value(s)
    should be verified to avoid that unfiltered values fall into this risky code evaluation.
  severity: WARNING
  languages:
  - java
  patterns:
  - pattern-either:
    - pattern: |
        class $CLASS {
          ...
          ExpressionFactory $EF;
          ...
          $X $METHOD(...) {
            ...
            $EF.createValueExpression($CTX,$INPUT,...);
            ...
          }
          ...
        }
    - pattern: |
        class $CLASS {
          ...
          ExpressionFactory $EF = ...;
          ...
          $X $METHOD(...) {
            ...
            $EF.createValueExpression($CTX,$INPUT,...);
            ...
          }
          ...
        }
    - pattern: |
        $X $METHOD(...) {
          ...
          ExpressionFactory $EF = ...;
          ...
          $EF.createValueExpression($CTX,$INPUT,...);
          ...
        }
    - pattern: |
        $X $METHOD(...,ExpressionFactory $EF,...) {
          ...
          $EF.createValueExpression($CTX,$INPUT,...);
          ...
        }
    - pattern: |
        class $CLASS {
          ...
          ExpressionFactory $EF;
          ...
          $X $METHOD(...) {
            ...
            $EF.createMethodExpression($CTX,$INPUT,...);
            ...
          }
          ...
        }
    - pattern: |
        class $CLASS {
          ...
          ExpressionFactory $EF = ...;
          ...
          $X $METHOD(...) {
            ...
            $EF.createMethodExpression($CTX,$INPUT,...);
            ...
          }
          ...
        }
    - pattern: |
        $X $METHOD(...) {
          ...
          ExpressionFactory $EF = ...;
          ...
          $EF.createMethodExpression($CTX,$INPUT,...);
          ...
        }
    - pattern: |
        $X $METHOD(...,ExpressionFactory $EF,...) {
          ...
          $EF.createMethodExpression($CTX,$INPUT,...);
          ...
        }
    - pattern: |
        $X $METHOD(String $INPUT, ...) {
          ...
          $OBJECT.buildConstraintViolationWithTemplate($INPUT, ...);
          ...
        }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        $EF.createValueExpression($CTX,"...",...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        String $S = "...";
        ...
        $EF.createValueExpression($CTX,$S,...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        $EF.createMethodExpression($CTX,"...",...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        String $S = "...";
        ...
        $EF.createMethodExpression($CTX,$S,...);
        ...
      }
- id: java.lang.security.audit.formatted-sql-string.formatted-sql-string
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.5 Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
    - https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps
    - https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement
    category: security
    technology:
    - java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string
    shortlink: https://sg.run/OPXp
    semgrep.dev:
      rule:
        r_id: 9175
        rv_id: 1409389
        rule_id: QrUzxR
        version_id: ExTeyBP
        url: https://semgrep.dev/playground/r/ExTeyBP/java.lang.security.audit.formatted-sql-string.formatted-sql-string
        origin: community
  options:
    taint_assume_safe_numbers: true
    taint_assume_safe_booleans: true
  message: Detected a formatted string in a SQL statement. This could lead to SQL
    injection if variables in the SQL statement are not properly sanitized. Use a
    prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement
    using 'connection.prepareStatement'.
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletRequest $REQ)
      - patterns:
        - pattern-inside: |
            $ANNOT $FUNC (..., $INPUT, ...) {
              ...
            }
        - pattern: (String $INPUT)
        - focus-metavariable: $INPUT
    label: INPUT
  - patterns:
    - pattern-either:
      - pattern: $X + $INPUT
      - pattern: $X += $INPUT
      - pattern: String.format(..., $INPUT, ...)
      - pattern: String.join(..., $INPUT, ...)
      - pattern: (String $STR).concat($INPUT)
      - pattern: $INPUT.concat(...)
      - patterns:
        - pattern-either:
          - pattern: $STRB.append($INPUT)
          - pattern: new $STRB(..., $INPUT, ...)
        - metavariable-type:
            metavariable: $STRB
            type: StringBuilder
    label: CONCAT
    requires: INPUT
  pattern-propagators:
  - pattern: (StringBuffer $S).append($X)
    from: $X
    to: $S
  - pattern: (StringBuilder $S).append($X)
    from: $X
    to: $S
  pattern-sinks:
  - patterns:
    - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE *$/" ...>)
    - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE %s$/" ...>)
    - pattern-either:
      - pattern: (Statement $S).$SQLFUNC(...)
      - pattern: (PreparedStatement $P).$SQLFUNC(...)
      - pattern: (Connection $C).createStatement(...).$SQLFUNC(...)
      - pattern: (Connection $C).prepareStatement(...).$SQLFUNC(...)
      - pattern: (EntityManager $EM).$SQLFUNC(...)
    - metavariable-regex:
        metavariable: $SQLFUNC
        regex: execute|executeQuery|createQuery|query|addBatch|nativeSQL|create|prepare
    requires: CONCAT
  pattern-sanitizers:
  - patterns:
    - pattern: (CriteriaBuilder $CB).$ANY(...)
  severity: ERROR
  languages:
  - java
- id: java.lang.security.audit.http-response-splitting.http-response-splitting
  metadata:
    cwe:
    - 'CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (''HTTP
      Request/Response Splitting'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTP_RESPONSE_SPLITTING
    references:
    - https://www.owasp.org/index.php/HTTP_Response_Splitting
    category: security
    technology:
    - java
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Validation
    source: https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting
    shortlink: https://sg.run/eL0l
    semgrep.dev:
      rule:
        r_id: 9176
        rv_id: 1263023
        rule_id: 3qUPyK
        version_id: X0Tzykw
        url: https://semgrep.dev/playground/r/X0Tzykw/java.lang.security.audit.http-response-splitting.http-response-splitting
        origin: community
  message: Older Java application servers are vulnerable to HTTP response splitting,
    which may occur if an HTTP request can be injected with CRLF characters. This
    finding is reported for completeness; it is recommended to ensure your environment
    is not affected by testing this yourself.
  severity: INFO
  languages:
  - java
  pattern-either:
  - pattern: |
      $VAR = $REQ.getParameter(...);
      ...
      $COOKIE = new Cookie(..., $VAR, ...);
      ...
      $RESP.addCookie($COOKIE, ...);
  - patterns:
    - pattern-inside: |
        $RETTYPE $FUNC(...,@PathVariable $TYPE $VAR, ...) {
          ...
        }
    - pattern: |
        $COOKIE = new Cookie(..., $VAR, ...);
        ...
        $RESP.addCookie($COOKIE, ...);
- id: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection
  metadata:
    cwe:
    - 'CWE-297: Improper Validation of Certificate with Host Mismatch'
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_SMTP_SSL
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection
    shortlink: https://sg.run/vzN4
    semgrep.dev:
      rule:
        r_id: 9177
        rv_id: 1263024
        rule_id: 4bUkrW
        version_id: jQTn5Dv
        url: https://semgrep.dev/playground/r/jQTn5Dv/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection
        origin: community
  message: Insecure SMTP connection detected. This connection will trust any SSL certificate.
    Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.
  severity: WARNING
  patterns:
  - pattern-not-inside: |
      $EMAIL.setSSLCheckServerIdentity(true);
      ...
  - pattern-inside: |
      $EMAIL = new SimpleEmail(...);
      ...
  - pattern: $EMAIL.send(...);
  languages:
  - java
- id: java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION_SPRING_JDBC
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.5 Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    category: security
    technology:
    - jdbc
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string
    shortlink: https://sg.run/dKWY
    semgrep.dev:
      rule:
        r_id: 9178
        rv_id: 1263026
        rule_id: PeUZNX
        version_id: 9lT4bqk
        url: https://semgrep.dev/playground/r/9lT4bqk/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string
        origin: community
  message: 'Possible JDBC injection detected. Use the parameterized query feature
    available in queryForObject instead of concatenating or formatting strings: ''jdbc.queryForObject("select
    * from table where name = ?", Integer.class, parameterName);'''
  patterns:
  - pattern-inside: |
      $JDBC = new JdbcTemplate(...);
      ...
  - pattern-either:
    - pattern: $JDBC.queryForObject($STR + $VAR, ...);
    - pattern: $JDBC.queryForObject(String.format(...), ...);
    - pattern: |
        String $Q = $STR + $VAR;
        ...
        $JDBC.queryForObject($Q, ...);
    - pattern: |
        String $Q = String.format(...);
        ...
        $JDBC.queryForObject($Q, ...);
    - pattern: |
        StringBuilder $Q = new StringBuilder(...);
        ...
        $Q.append($STR + $VAR);
        ...
        $JDBC.queryForObject($Q, ...);
    - pattern: $JDBC.queryForList($STR + $VAR);
    - pattern: $JDBC.queryForList(String.format(...));
    - pattern: |
        String $Q = $STR + $VAR;
        ...
        $JDBC.queryForList($Q);
    - pattern: |
        String $Q = String.format(...);
        ...
        $JDBC.queryForList($Q);
    - pattern: |
        StringBuilder $Q = new StringBuilder(...);
        ...
        $Q.append($STR + $VAR);
        ...
        $JDBC.queryForList($Q, ...);
    - pattern: $JDBC.update($STR + $VAR);
    - pattern: $JDBC.update(String.format(...));
    - pattern: |
        String $Q = $STR + $VAR;
        ...
        $JDBC.update($Q);
    - pattern: |
        String $Q = String.format(...);
        ...
        $JDBC.update($Q);
    - pattern: |
        StringBuilder $Q = new StringBuilder(...);
        ...
        $Q.append($STR + $VAR);
        ...
        $JDBC.update($Q, ...);
    - pattern: $JDBC.execute($STR + $VAR);
    - pattern: $JDBC.execute(String.format(...));
    - pattern: |
        String $Q = $STR + $VAR;
        ...
        $JDBC.execute($Q);
    - pattern: |
        String $Q = String.format(...);
        ...
        $JDBC.execute($Q);
    - pattern: |
        StringBuilder $Q = new StringBuilder(...);
        ...
        $Q.append($STR + $VAR);
        ...
        $JDBC.execute($Q, ...);
    - pattern: $JDBC.insert($STR + $VAR);
    - pattern: $JDBC.insert(String.format(...));
    - pattern: |
        String $Q = $STR + $VAR;
        ...
        $JDBC.insert($Q);
    - pattern: |
        String $Q = String.format(...);
        ...
        $JDBC.insert($Q);
    - pattern: |
        StringBuilder $Q = new StringBuilder(...);
        ...
        $Q.append($STR + $VAR);
        ...
        $JDBC.insert($Q, ...);
  severity: WARNING
  languages:
  - java
- id: java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (''LDAP
      Injection'')'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ENTRY_POISONING
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.7 Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    references:
    - https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf
    - https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - java
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - LDAP Injection
    source: https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning
    shortlink: https://sg.run/ZvOn
    semgrep.dev:
      rule:
        r_id: 9179
        rv_id: 1263027
        rule_id: JDUy8B
        version_id: yeTxpGP
        url: https://semgrep.dev/playground/r/yeTxpGP/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning
        origin: community
  message: An object-returning LDAP search will allow attackers to control the LDAP
    response. This could lead to Remote Code Execution.
  severity: WARNING
  pattern-either:
  - pattern: |
      new SearchControls($S, $CL, $TL, $AT, true, $DEREF)
  - pattern: |
      SearchControls $VAR = new SearchControls();
      ...
      $VAR.setReturningObjFlag(true);
  languages:
  - java
- id: java.lang.security.audit.ldap-injection.ldap-injection
  message: Detected non-constant data passed into an LDAP query. If this data can
    be controlled by an external user, this is an LDAP injection. Ensure data passed
    to an LDAP query is not controllable; or properly sanitize the data.
  metadata:
    cwe:
    - 'CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (''LDAP
      Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_INJECTION
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.7 Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - LDAP Injection
    source: https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection
    shortlink: https://sg.run/nd2O
    semgrep.dev:
      rule:
        r_id: 9180
        rv_id: 1263028
        rule_id: 5rUObQ
        version_id: rxTAKl2
        url: https://semgrep.dev/playground/r/rxTAKl2/java.lang.security.audit.ldap-injection.ldap-injection
        origin: community
  severity: WARNING
  languages:
  - java
  patterns:
  - pattern-either:
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          InitialDirContext $CTX = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          DirContext $CTX = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          InitialLdapContext $CTX = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          LdapContext $CTX = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          LdapCtx $CTX = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          EventDirContext $CTX = ...;
          ...
        }
  - pattern: |
      $X $METHOD(...) {
        ...
        $CTX.search($Y,$INPUT,...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        $CTX.search($Y,"...",...);
        ...
      }
- id: java.lang.security.audit.object-deserialization.object-deserialization
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#OBJECT_DESERIALIZATION
    references:
    - https://www.owasp.org/index.php/Deserialization_of_untrusted_data
    - https://www.oracle.com/java/technologies/javase/seccodeguide.html#8
    category: security
    technology:
    - java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization
    shortlink: https://sg.run/Ek0A
    semgrep.dev:
      rule:
        r_id: 9181
        rv_id: 1263030
        rule_id: GdU7py
        version_id: NdTzyGe
        url: https://semgrep.dev/playground/r/NdTzyGe/java.lang.security.audit.object-deserialization.object-deserialization
        origin: community
  message: Found object deserialization using ObjectInputStream. Deserializing entire
    Java objects is dangerous because malicious actors can create Java object streams
    with unintended consequences. Ensure that the objects being deserialized are not
    user-controlled. If this must be done, consider using HMACs to sign the data stream
    to make sure it is not tampered with, or consider only transmitting object fields
    and populating a new object.
  severity: WARNING
  languages:
  - java
  pattern: new ObjectInputStream(...);
- id: java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission
  message: Detected file permissions that are overly permissive (read, write, and
    execute). It is generally a bad practices to set overly permissive file permission
    such as read+write+exec for all users. If the file affected is a configuration,
    a binary, a script or sensitive data, it can lead to privilege escalation or information
    leakage. Instead, follow the principle of least privilege and give users only
    the  permissions they need.
  severity: WARNING
  languages:
  - java
  metadata:
    cwe:
    - 'CWE-276: Incorrect Default Permissions'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#OVERLY_PERMISSIVE_FILE_PERMISSION
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authorization
    source: https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission
    shortlink: https://sg.run/LwzJ
    semgrep.dev:
      rule:
        r_id: 9183
        rv_id: 1263032
        rule_id: AbUzwB
        version_id: w8TRoNn
        url: https://semgrep.dev/playground/r/w8TRoNn/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission
        origin: community
  pattern-either:
  - pattern: java.nio.file.Files.setPosixFilePermissions($FILE, java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x$)/"));
  - pattern: |
      $TYPE $P = java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x$)/");
      ...
      java.nio.file.Files.setPosixFilePermissions($FILE, $P);
  - pattern: |
      $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_READ);
      ...
      java.nio.file.Files.setPosixFilePermissions($FILE, $P);
  - pattern: |
      $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_WRITE);
      ...
      java.nio.file.Files.setPosixFilePermissions($FILE, $P);
  - pattern: |-
      $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_EXECUTE);
      ...
      java.nio.file.Files.setPosixFilePermissions($FILE, $P);
- id: java.lang.security.audit.permissive-cors.permissive-cors
  message: https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS
    policy will allow a malicious application to communicate with the victim application
    in an inappropriate way, leading to spoofing, data theft, relay and other attacks.
  metadata:
    cwe:
    - 'CWE-183: Permissive List of Allowed Inputs'
    asvs:
      section: 'V14: Configuration Verification Requirements'
      control_id: 14.4.8 Permissive CORS
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x22-V14-Config.md#v144-http-security-headers-requirements
      version: '4'
    category: security
    technology:
    - java
    owasp:
    - A04:2021 - Insecure Design
    - A06:2025 - Insecure Design
    references:
    - https://owasp.org/Top10/A04_2021-Insecure_Design
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Validation
    source: https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors
    shortlink: https://sg.run/8y77
    semgrep.dev:
      rule:
        r_id: 9184
        rv_id: 1263033
        rule_id: BYUN66
        version_id: xyTjz0p
        url: https://semgrep.dev/playground/r/xyTjz0p/java.lang.security.audit.permissive-cors.permissive-cors
        origin: community
  severity: WARNING
  languages:
  - java
  pattern-either:
  - pattern: |
      HttpServletResponse $RES = ...;
      ...
      $RES.addHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
  - pattern: |
      HttpServletResponse $RES = ...;
      ...
      $RES.setHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
  - pattern: |
      ServerHttpResponse $RES = ...;
      ...
      $RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
  - pattern: |
      HttpHeaders $HEADERS = ...;
      ...
      $HEADERS.set("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
  - pattern: |
      ServerWebExchange $SWE = ...;
      ...
      $SWE.getResponse().getHeaders().add("Access-Control-Allow-Origin", "*");
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.addHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.setHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
        ...
      }
  - pattern: |
      $X $METHOD(...,ServerHttpResponse $RES,...) {
        ...
        $RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
        ...
      }
  - pattern: |
      $X $METHOD(...,ServerWebExchange $SWE,...) {
        ...
        $SWE.getResponse().getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
        ...
      }
  - pattern: ResponseEntity.$RES().header("=~/access-control-allow-origin/i", "=~/^\*|null$/i")
  - pattern: ServerResponse.$RES().header("=~/access-control-allow-origin/i", "=~/^\*|null$/i")
- id: java.lang.security.audit.script-engine-injection.script-engine-injection
  message: Detected potential code injection using ScriptEngine. Ensure user-controlled
    data cannot enter '.eval()', otherwise, this is a code injection vulnerability.
  metadata:
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SCRIPT_ENGINE_INJECTION
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection
    shortlink: https://sg.run/gLqn
    semgrep.dev:
      rule:
        r_id: 9185
        rv_id: 1263034
        rule_id: DbUpAr
        version_id: O9TpxEp
        url: https://semgrep.dev/playground/r/O9TpxEp/java.lang.security.audit.script-engine-injection.script-engine-injection
        origin: community
  severity: WARNING
  languages:
  - java
  patterns:
  - pattern-either:
    - pattern-inside: |
        class $CLASS {
          ...
          ScriptEngine $SE;
          ...
        }
    - pattern-inside: |
        class $CLASS {
          ...
          ScriptEngine $SE = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          ScriptEngine $SE = ...;
          ...
        }
  - pattern: |
      $X $METHOD(...) {
        ...
        $SE.eval(...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        $SE.eval("...");
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        String $S = "...";
        ...
        $SE.eval($S);
        ...
      }
- id: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect
  message: Application redirects to a destination URL specified by a user-supplied
    parameter that is not validated. This could direct users to malicious locations.
    Consider using an allowlist to validate URLs.
  metadata:
    cwe:
    - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.1.5 Open Redirect
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation-requirements
      version: '4'
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    subcategory:
    - vuln
    impact: LOW
    likelihood: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Open Redirect
    source: https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect
    shortlink: https://sg.run/Q51P
    semgrep.dev:
      rule:
        r_id: 9186
        rv_id: 1263048
        rule_id: WAUo0p
        version_id: PkTR329
        url: https://semgrep.dev/playground/r/PkTR329/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect
        origin: community
  severity: WARNING
  languages:
  - java
  pattern-either:
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {
        ...
        $RES.sendRedirect($URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {
        ...
        $RES.sendRedirect($URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
        ...
        String $URL = $REQ.getParameter(...);
        ...
        $RES.sendRedirect($URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
        ...
        String $URL = $REQ.getParameter(...);
        ...
        $RES.sendRedirect($URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,String $URL,...) {
        ...
        HttpServletResponse $RES = ...;
        ...
        $RES.sendRedirect($URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
        ...
        $RES.sendRedirect($REQ.getParameter(...));
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
        ...
        $RES.sendRedirect($REQ.getParameter(...));
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {
        ...
        $RES.addHeader("Location",$URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {
        ...
        $RES.addHeader("Location",$URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
        ...
        String $URL = $REQ.getParameter(...);
        ...
        $RES.addHeader("Location",$URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
        ...
        String $URL = $REQ.getParameter(...);
        ...
        $RES.addHeader("Location",$URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,String $URL,...) {
        ...
        HttpServletResponse $RES = ...;
        ...
        $RES.addHeader("Location",$URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
        ...
        $RES.addHeader("Location",$REQ.getParameter(...));
        ...
      }
  - pattern: |-
      $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
        ...
        $RES.addHeader("Location",$REQ.getParameter(...));
        ...
      }
- id: java.lang.security.audit.url-rewriting.url-rewriting
  message: URL rewriting has significant security risks. Since session ID appears
    in the URL, it may be easily seen by third parties.
  metadata:
    cwe:
    - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#URL_REWRITING
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mishandled Sensitive Information
    source: https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting
    shortlink: https://sg.run/3x7b
    semgrep.dev:
      rule:
        r_id: 9187
        rv_id: 1263049
        rule_id: 0oU5j3
        version_id: JdTzxGb
        url: https://semgrep.dev/playground/r/JdTzxGb/java.lang.security.audit.url-rewriting.url-rewriting
        origin: community
  severity: WARNING
  languages:
  - java
  pattern-either:
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.encodeURL(...);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.encodeUrl(...);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.encodeRedirectURL(...);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.encodeRedirectUrl(...);
        ...
      }
  - pattern: |
      $X $METHOD(...) {
        ...
        HttpServletResponse $RES = ...;
        ...
        $RES.encodeURL(...);
        ...
      }
  - pattern: |
      $X $METHOD(...) {
        ...
        HttpServletResponse $RES = ...;
        ...
        $RES.encodeUrl(...);
        ...
      }
  - pattern: |
      $X $METHOD(...) {
        ...
        HttpServletResponse $RES = ...;
        ...
        $RES.encodeRedirectURL(...);
        ...
      }
  - pattern: |-
      $X $METHOD(...) {
        ...
        HttpServletResponse $RES = ...;
        ...
        $RES.encodeRedirectUrl(...);
        ...
      }
- id: java.lang.security.audit.weak-ssl-context.weak-ssl-context
  metadata:
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source_rule_url: https://find-sec-bugs.github.io/bugs.htm#SSL_CONTEXT
    references:
    - https://tools.ietf.org/html/rfc7568
    - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html
    category: security
    technology:
    - java
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context
    shortlink: https://sg.run/4x7E
    semgrep.dev:
      rule:
        r_id: 9188
        rv_id: 1263050
        rule_id: KxUb1k
        version_id: 5PTo1rW
        url: https://semgrep.dev/playground/r/5PTo1rW/java.lang.security.audit.weak-ssl-context.weak-ssl-context
        origin: community
  message: An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL
    versions are considered weak encryption and are deprecated. Use SSLContext.getInstance("TLSv1.2")
    for the best security.
  severity: WARNING
  languages:
  - java
  patterns:
  - pattern-not: SSLContext.getInstance("TLSv1.3")
  - pattern-not: SSLContext.getInstance("TLSv1.2")
  - pattern: SSLContext.getInstance("...")
  fix-regex:
    regex: (.*?)\.getInstance\(.*?\)
    replacement: \1.getInstance("TLSv1.2")
- id: java.lang.security.audit.xml-decoder.xml-decoder
  message: XMLDecoder should not be used to parse untrusted data. Deserializing user
    input can lead to arbitrary code execution. Use an alternative and explicitly
    disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
    for alternatives and vulnerability prevention.
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XML_DECODER
    references:
    - https://semgrep.dev/blog/2022/xml-security-in-java
    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
    - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder
    shortlink: https://sg.run/PJjq
    semgrep.dev:
      rule:
        r_id: 9189
        rv_id: 1263051
        rule_id: qNUj3y
        version_id: GxTkeY1
        url: https://semgrep.dev/playground/r/GxTkeY1/java.lang.security.audit.xml-decoder.xml-decoder
        origin: community
  severity: WARNING
  languages:
  - java
  patterns:
  - pattern: |
      $X $METHOD(...) {
        ...
        new XMLDecoder(...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        new XMLDecoder("...");
        ...
      }
  - pattern-not: |-
      $X $METHOD(...) {
        ...
        String $STR = "...";
        ...
        new XMLDecoder($STR);
        ...
      }
- id: java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure
  metadata:
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_REQUEST_WRAPPER
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure
    shortlink: https://sg.run/J96Q
    semgrep.dev:
      rule:
        r_id: 9190
        rv_id: 1263056
        rule_id: lBU9Gj
        version_id: WrTqKGK
        url: https://semgrep.dev/playground/r/WrTqKGK/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure
        origin: community
  message: It looks like you're using an implementation of XSSRequestWrapper from
    dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html)
    The XSS filtering in this code is not secure and can be bypassed by malicious
    actors. It is recommended to use a stack that automatically escapes in your view
    or templates instead of filtering yourself.
  severity: WARNING
  languages:
  - java
  pattern-either:
  - pattern: |
      class XSSRequestWrapper extends HttpServletRequestWrapper {
        ...
      }
  - pattern: |-
      $P = $X.compile("</script>", $X.CASE_INSENSITIVE);
      $V = $P.matcher(...).replaceAll("");
- id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
  metadata:
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN
    references:
    - https://www.owasp.org/index.php/Path_Traversal
    category: security
    technology:
    - java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
    shortlink: https://sg.run/oxXN
    semgrep.dev:
      rule:
        r_id: 9160
        rv_id: 1263064
        rule_id: NbUk7X
        version_id: zyTb2rq
        url: https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
        origin: community
  message: Detected a potential path traversal. A malicious actor could control the
    location of this file, to include going backwards in the directory with '../'.
    To address this, ensure that user-controlled variables in file paths are sanitized.
    You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...)
    to only retrieve the file name from the path.
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletRequest $REQ)
      - patterns:
        - pattern-inside: |
            (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
            ...
            for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
              ...
            }
        - pattern: |
            $COOKIE.getValue(...)
      - patterns:
        - pattern-inside: |
            $TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...);
            ...
        - pattern: |
            $PARAM = $VALS[$INDEX];
  pattern-sanitizers:
  - pattern: org.apache.commons.io.FilenameUtils.getName(...)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          (java.io.File $FILE) = ...
      - pattern: |
          (java.io.FileOutputStream $FOS) = ...
      - pattern: |
          new java.io.FileInputStream(...)
  severity: ERROR
  languages:
  - java
- id: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
  message: 'Cross-site scripting detected in HttpServletResponse writer with variable
    ''$VAR''. User input was detected going directly from the HttpServletRequest into
    output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml:
    ''Encode.forHtml($VAR)''.'
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
    shortlink: https://sg.run/pxjN
    semgrep.dev:
      rule:
        r_id: 9162
        rv_id: 1263066
        rule_id: wdUJOk
        version_id: 2KTv2EG
        url: https://semgrep.dev/playground/r/2KTv2EG/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
        origin: community
  severity: ERROR
  patterns:
  - pattern-inside: $TYPE $FUNC(..., HttpServletResponse $RESP, ...) { ... }
  - pattern-inside: $VAR = $REQ.getParameter(...); ...
  - pattern-either:
    - pattern: $RESP.getWriter(...).write(..., $VAR, ...);
    - pattern: |
        $WRITER = $RESP.getWriter(...);
        ...
        $WRITER.write(..., $VAR, ...);
  languages:
  - java
- id: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://semgrep.dev/blog/2022/xml-security-in-java
    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
    - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf
    category: security
    technology:
    - java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled
    shortlink: https://sg.run/2x75
    semgrep.dev:
      rule:
        r_id: 9163
        rv_id: 1263068
        rule_id: x8Unkq
        version_id: jQTn5Jv
        url: https://semgrep.dev/playground/r/jQTn5Jv/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled
        origin: community
  message: XML external entities are enabled for this XMLInputFactory. This is vulnerable
    to XML external entity attacks. Disable external entities by setting "javax.xml.stream.isSupportingExternalEntities"
    to false.
  patterns:
  - pattern-either:
    - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities",
        true);
    - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES,
        true);
    - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD,
        true);
    - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities",
        Boolean.TRUE);
    - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES,
        Boolean.TRUE);
    - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD,
        Boolean.TRUE);
  languages:
  - java
- id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://semgrep.dev/blog/2022/xml-security-in-java
    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
    - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf
    - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser
    category: security
    technology:
    - java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
    shortlink: https://sg.run/XBwA
    semgrep.dev:
      rule:
        r_id: 9164
        rv_id: 1263069
        rule_id: OrU35O
        version_id: 1QTypQZ
        url: https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
        origin: community
  message: XML external entities are not explicitly disabled for this XMLInputFactory.
    This could be vulnerable to XML external entity vulnerabilities. Explicitly disable
    external entities by setting "javax.xml.stream.isSupportingExternalEntities" to
    false.
  patterns:
  - pattern-not-inside: |
      $METHOD(...) {
        ...
        $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
        ...
      }
  - pattern-not-inside: |
      $METHOD(...) {
        ...
        $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
        ...
      }
  - pattern-not-inside: |
      $METHOD(...) {
        ...
        $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.FALSE);
        ...
      }
  - pattern-not-inside: |
      $METHOD(...) {
        ...
        $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
        ...
      }
  - pattern-either:
    - pattern: javax.xml.stream.XMLInputFactory.newFactory(...)
    - pattern: new XMLInputFactory(...)
  languages:
  - java
- id: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    references:
    - https://frohoff.github.io/appseccali-marshalling-pickles/
    - https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi
    - https://youtu.be/t_aw1mDNhzI
    - https://github.com/qtc-de/remote-method-guesser
    - https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331
    category: security
    technology:
    - rmi
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization
    shortlink: https://sg.run/zvnl
    semgrep.dev:
      rule:
        r_id: 9217
        rv_id: 1263072
        rule_id: NbUkw5
        version_id: rxTAKN2
        url: https://semgrep.dev/playground/r/rxTAKN2/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization
        origin: community
  message: Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure
    deserialization vulnerability. This object can be manipulated by a malicious actor
    allowing them to execute code on your system. Instead, use an integer ID to look
    up your object, or consider alternative serialization schemes such as JSON.
  languages:
  - java
  patterns:
  - pattern: |
      interface $INTERFACE extends Remote {
        $RETURNTYPE $METHOD($PARAMTYPE $PARAM) throws RemoteException;
      }
  - metavariable-pattern:
      metavariable: $PARAMTYPE
      language: generic
      patterns:
      - pattern-not: String
      - pattern-not: java.lang.String
      - pattern-not: boolean
      - pattern-not: Boolean
      - pattern-not: java.lang.Boolean
      - pattern-not: byte
      - pattern-not: Byte
      - pattern-not: java.lang.Byte
      - pattern-not: char
      - pattern-not: Character
      - pattern-not: java.lang.Character
      - pattern-not: double
      - pattern-not: Double
      - pattern-not: java.lang.Double
      - pattern-not: float
      - pattern-not: Float
      - pattern-not: java.lang.Float
      - pattern-not: int
      - pattern-not: Integer
      - pattern-not: java.lang.Integer
      - pattern-not: long
      - pattern-not: Long
      - pattern-not: java.lang.Long
      - pattern-not: short
      - pattern-not: Short
      - pattern-not: java.lang.Short
- id: java.spring.security.audit.spel-injection.spel-injection
  message: A Spring expression is built with a dynamic value. The source of the value(s)
    should be verified to avoid that unfiltered values fall into this risky code evaluation.
  metadata:
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPEL_INJECTION
    category: security
    technology:
    - spring
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection
    shortlink: https://sg.run/XBp4
    semgrep.dev:
      rule:
        r_id: 9220
        rv_id: 1263075
        rule_id: x8Un7b
        version_id: kbTzG5Y
        url: https://semgrep.dev/playground/r/kbTzG5Y/java.spring.security.audit.spel-injection.spel-injection
        origin: community
  severity: WARNING
  languages:
  - java
  patterns:
  - pattern-either:
    - pattern-inside: |
        class $CLASS {
          ...
          ExpressionParser $PARSER;
          ...
        }
    - pattern-inside: |
        class $CLASS {
          ...
          ExpressionParser $PARSER = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          ExpressionParser $PARSER = ...;
          ...
        }
    - pattern-inside: |
        class $CLASS {
          ...
          SpelExpressionParser $PARSER;
          ...
        }
    - pattern-inside: |
        class $CLASS {
          ...
          SpelExpressionParser $PARSER = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          SpelExpressionParser $PARSER = ...;
          ...
        }
    - pattern-inside: |
        class $CLASS {
          ...
          TemplateAwareExpressionParser $PARSER;
          ...
        }
    - pattern-inside: |
        class $CLASS {
          ...
          TemplateAwareExpressionParser $PARSER = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          TemplateAwareExpressionParser $PARSER = ...;
          ...
        }
  - pattern: |
      $X $METHOD(...) {
        ...
        $PARSER.parseExpression(...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        $PARSER.parseExpression("...");
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        String $S = "...";
        ...
        $PARSER.parseExpression($S);
        ...
      }
- id: java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled
  message: CSRF protection is disabled for this configuration. This is a security
    risk.
  metadata:
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_PROTECTION_DISABLED
    asvs:
      section: V4 Access Control
      control_id: 4.2.2 CSRF
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control
      version: '4'
    category: security
    technology:
    - spring
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site Request Forgery (CSRF)
    source: https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled
    shortlink: https://sg.run/jRnl
    semgrep.dev:
      rule:
        r_id: 9221
        rv_id: 1263080
        rule_id: OrU3gK
        version_id: vdT06dL
        url: https://semgrep.dev/playground/r/vdT06dL/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled
        origin: community
  severity: WARNING
  languages:
  - java
  pattern: $OBJ.csrf(...).disable(...)
- id: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect
  message: Application redirects a user to a destination URL specified by a user supplied
    parameter that is not validated.
  metadata:
    cwe:
    - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT
    category: security
    technology:
    - spring
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Open Redirect
    source: https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect
    shortlink: https://sg.run/9oXz
    semgrep.dev:
      rule:
        r_id: 9223
        rv_id: 1263083
        rule_id: v8Un7w
        version_id: nWT2Lk0
        url: https://semgrep.dev/playground/r/nWT2Lk0/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect
        origin: community
  severity: WARNING
  languages:
  - java
  pattern-either:
  - pattern: |
      $X $METHOD(...,String $URL,...) {
        return "redirect:" + $URL;
      }
  - pattern: |
      $X $METHOD(...,String $URL,...) {
        ...
        String $REDIR = "redirect:" + $URL;
        ...
        return $REDIR;
        ...
      }
  - pattern: |
      $X $METHOD(...,String $URL,...) {
        ...
        new ModelAndView("redirect:" + $URL);
        ...
      }
  - pattern: |-
      $X $METHOD(...,String $URL,...) {
        ...
        String $REDIR = "redirect:" + $URL;
        ...
        new ModelAndView($REDIR);
        ...
      }
- id: java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping
  patterns:
  - pattern-inside: |
      @RequestMapping(...)
      $RETURNTYPE $METHOD(...) { ... }
  - pattern-not-inside: |
      @RequestMapping(..., method = $X, ...)
      $RETURNTYPE $METHOD(...) { ... }
  - pattern: |
      RequestMapping
  message: Detected a method annotated with 'RequestMapping' that does not specify
    the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS,
    and by default all HTTP methods are allowed when the HTTP method is not explicitly
    specified. This means that a method that performs state changes could be vulnerable
    to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method
    (such as 'RequestMethod.POST').
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING
    references:
    - https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING
    category: security
    technology:
    - spring
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site Request Forgery (CSRF)
    source: https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping
    shortlink: https://sg.run/2xlq
    semgrep.dev:
      rule:
        r_id: 9219
        rv_id: 1263089
        rule_id: wdUJ7q
        version_id: QkTGq2l
        url: https://semgrep.dev/playground/r/QkTGq2l/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping
        origin: community
  languages:
  - java
- id: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection
  message: Found an insecure gRPC connection. This creates a connection without encryption
    to a gRPC client/server. A malicious attacker could tamper with the gRPC message,
    which could compromise the machine.
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    category: security
    technology:
    - grpc
    references:
    - https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection
    shortlink: https://sg.run/5QkD
    semgrep.dev:
      rule:
        r_id: 9291
        rv_id: 1263180
        rule_id: lBU9D8
        version_id: e1TyjAl
        url: https://semgrep.dev/playground/r/e1TyjAl/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  pattern-either:
  - pattern: |
      require('grpc');
      ...
      $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...);
  - pattern: |
      require('grpc');
      ...
      new $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...);
  - pattern: |-
      require('grpc');
      ...
      $CREDS = <... $CREDENTIALS.createInsecure() ...>;
      ...
      $GRPC($ADDR,...,$CREDS,...);
  - pattern: |-
      require('grpc');
      ...
      $CREDS = <... $CREDENTIALS.createInsecure() ...>;
      ...
      new $GRPC($ADDR,...,$CREDS,...);
- id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  metadata:
    interfile: true
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    asvs:
      section: 'V3: Session Management Verification Requirements'
      control_id: 3.5.2 Static API keys or secret
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
      version: '4'
    category: security
    technology:
    - jose
    - jwt
    - secrets
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
    shortlink: https://sg.run/Ro1g
    semgrep.dev:
      rule:
        r_id: 9293
        rv_id: 1263182
        rule_id: JDUyRl
        version_id: d6TyxbX
        url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  patterns:
  - pattern-inside: |
      $JOSE = require("jose");
      ...
  - pattern-either:
    - pattern-inside: |
        var {JWT} = $JOSE;
        ...
    - pattern-inside: |
        var {JWK, JWT} = $JOSE;
        ...
    - pattern-inside: |
        const {JWT} = $JOSE;
        ...
    - pattern-inside: |
        const {JWK, JWT} = $JOSE;
        ...
    - pattern-inside: |
        let {JWT} = $JOSE;
        ...
    - pattern-inside: |
        let {JWK, JWT} = $JOSE;
        ...
  - pattern-either:
    - pattern: |
        JWT.verify($P, "...", ...);
    - pattern: |
        JWT.sign($P, "...", ...);
    - pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...);     \n"
    - pattern: |
        $JWT.sign($P, JWK.asKey("..."), ...);
  options:
    symbolic_propagation: true
    interfile: true
- id: javascript.jose.security.jwt-none-alg.jwt-none-alg
  message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm
    assumes the integrity of the token has already been verified. This would allow
    a malicious actor to forge a JWT token that will automatically be verified. Do
    not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    asvs:
      section: 'V3: Session Management Verification Requirements'
      control_id: 3.5.3 Insecue Stateless Session Tokens
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
      version: '4'
    category: security
    technology:
    - jose
    - jwt
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg
    shortlink: https://sg.run/AvRL
    semgrep.dev:
      rule:
        r_id: 9294
        rv_id: 1263183
        rule_id: 5rUOGN
        version_id: ZRTKAyb
        url: https://semgrep.dev/playground/r/ZRTKAyb/javascript.jose.security.jwt-none-alg.jwt-none-alg
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  pattern-either:
  - pattern: |
      var $JOSE = require("jose");
      ...
      var { JWK, JWT } = $JOSE;
      ...
      var $T = JWT.verify($P, JWK.None,...);
  - pattern: |
      var $JOSE = require("jose");
      ...
      var { JWK, JWT } = $JOSE;
      ...
      $T = JWT.verify($P, JWK.None,...);
  - pattern: |
      var $JOSE = require("jose");
      ...
      var { JWK, JWT } = $JOSE;
      ...
      JWT.verify($P, JWK.None,...);
- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    asvs:
      section: 'V3: Session Management Verification Requirements'
      control_id: 3.5.2 Static API keys or secret
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
      version: '4'
    category: security
    technology:
    - jwt
    - javascript
    - secrets
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
    shortlink: https://sg.run/4xN9
    semgrep.dev:
      rule:
        r_id: 9300
        rv_id: 1263189
        rule_id: WAUon7
        version_id: gETB75D
        url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: "$X = '...' \n"
    - pattern: "$X = '$Y' \n"
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $JWT.sign($DATA,"...",...);
      - pattern-inside: |
          $JWT.verify($DATA,"...",...);
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $JWT = require("jsonwebtoken")
          ...
      - pattern-inside: |
          import $JWT from "jsonwebtoken"
          ...
      - pattern-inside: |
          import * as $JWT from "jsonwebtoken"
          ...
      - pattern-inside: |
          import {...,$JWT,...} from "jsonwebtoken"
          ...
    - pattern-either:
      - pattern-inside: |
          $JWT.sign($DATA,$VALUE,...);
      - pattern-inside: |
          $JWT.verify($DATA,$VALUE,...);
    - focus-metavariable: $VALUE
- id: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg
  message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm
    assumes the integrity of the token has already been verified. This would allow
    a malicious actor to forge a JWT token that will automatically be verified. Do
    not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    asvs:
      section: 'V3: Session Management Verification Requirements'
      control_id: 3.5.3 Insecue Stateless Session Tokens
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
      version: '4'
    category: security
    technology:
    - jwt
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg
    shortlink: https://sg.run/PJXv
    semgrep.dev:
      rule:
        r_id: 9301
        rv_id: 1263190
        rule_id: 0oU53g
        version_id: QkTGqQo
        url: https://semgrep.dev/playground/r/QkTGqQo/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  patterns:
  - pattern-inside: |
      $JWT = require("jsonwebtoken");
      ...
  - pattern: $JWT.verify($P, $X, {algorithms:[...,'none',...]},...)
- id: javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert
  message: Detected usage of noassert in Buffer API, which allows the offset the be
    beyond the end of the buffer. This could result in writing or reading beyond the
    end of the buffer.
  metadata:
    cwe:
    - 'CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer'
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-buffer-noassert.js
    category: security
    technology:
    - javascript
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    references:
    - https://cwe.mitre.org/data/definitions/119.html
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Memory Issues
    source: https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert
    shortlink: https://sg.run/qxpO
    semgrep.dev:
      rule:
        r_id: 9312
        rv_id: 945886
        rule_id: j2Uvj8
        version_id: 9lTy1Y6
        url: https://semgrep.dev/playground/r/9lTy1Y6/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  patterns:
  - pattern: $OBJ.$API(..., true)
  - metavariable-regex:
      metavariable: $API
      regex: (read|write)(U?Int8|(U?Int(16|32)|Float|Double)(LE|BE))
- id: javascript.lang.security.detect-child-process.detect-child-process
  message: 'Detected calls to child_process from a function argument `$FUNC`. This
    could lead to a command injection if the input is user controllable. Try to avoid
    calls to child_process, and if it is needed ensure user input is correctly sanitized
    or sandboxed. '
  metadata:
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-child-process.js
    category: security
    technology:
    - javascript
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process
    shortlink: https://sg.run/l2lo
    semgrep.dev:
      rule:
        r_id: 9313
        rv_id: 1409399
        rule_id: 10UKNB
        version_id: 5PT7KnG
        url: https://semgrep.dev/playground/r/5PT7KnG/javascript.lang.security.detect-child-process.detect-child-process
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-inside: |
        function ... (...,$FUNC,...) {
          ...
        }
    - focus-metavariable: $FUNC
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $CP = require('child_process')
          ...
      - pattern-inside: |
          import * as $CP from 'child_process'
          ...
      - pattern-inside: |
          import $CP from 'child_process'
          ...
    - pattern-either:
      - pattern: $CP.exec($CMD,...)
      - pattern: $CP.execSync($CMD,...)
      - pattern: $CP.spawn($CMD,...)
      - pattern: $CP.spawnSync($CMD,...)
    - pattern-not-inside: $CP.$EXEC("...",...)
    - pattern-not-inside: $CP.$EXEC(["...",...],...)
    - pattern-not-inside: |
        $CMD = "..."
        ...
    - pattern-not-inside: |
        $CMD = ["...",...]
        ...
    - focus-metavariable: $CMD
  - patterns:
    - pattern-either:
      - pattern: child_process.exec($CMD,...)
      - pattern: child_process.execSync($CMD,...)
      - pattern: child_process.spawn($CMD,...)
      - pattern: child_process.spawnSync($CMD,...)
    - pattern-not-inside: child_process.$EXEC("...",...)
    - pattern-not-inside: child_process.$EXEC(["...",...],...)
    - pattern-not-inside: |
        $CMD = "..."
        ...
    - pattern-not-inside: |
        $CMD = ["...",...]
        ...
    - focus-metavariable: $CMD
- id: javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape
  message: Markup escaping disabled. This can be used with some template engines to
    escape disabling of HTML entities, which can lead to XSS attacks.
  metadata:
    cwe:
    - 'CWE-116: Improper Encoding or Escaping of Output'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-disable-mustache-escape.js
    category: security
    technology:
    - mustache
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Encoding
    source: https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape
    shortlink: https://sg.run/Yvwd
    semgrep.dev:
      rule:
        r_id: 9314
        rv_id: 1263213
        rule_id: 9AU17r
        version_id: DkTRb3X
        url: https://semgrep.dev/playground/r/DkTRb3X/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  pattern: $OBJ.escapeMarkup = false
- id: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression
  message: Detected use of dynamic execution of JavaScript which may come from user-input,
    which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input
    in functions which dynamically execute user-input.
  metadata:
    cwe:
    - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
      (''Eval Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js
    references:
    - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!
    category: security
    technology:
    - javascript
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression
    shortlink: https://sg.run/6nwK
    semgrep.dev:
      rule:
        r_id: 9315
        rv_id: 1263214
        rule_id: yyUngo
        version_id: WrTqKkJ
        url: https://semgrep.dev/playground/r/WrTqKkJ/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $PROP = new URLSearchParams($WINDOW. ... .location.search).get('...')
            ...
      - pattern-inside: |
          $PROP = new URLSearchParams(location.search).get('...')
            ...
      - pattern-inside: |
          $PROP = new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...')
            ...
      - pattern-inside: |
          $PROP = new URLSearchParams(location.hash.substring(1)).get('...')
            ...
    - focus-metavariable: $PROP
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $PROPS = new URLSearchParams($WINDOW. ... .location.search)
            ...
      - pattern-inside: |
          $PROPS = new URLSearchParams(location.search)
            ...
      - pattern-inside: |
          $PROPS = new
          URLSearchParams($WINDOW. ... .location.hash.substring(1))
            ...
      - pattern-inside: |
          $PROPS = new URLSearchParams(location.hash.substring(1))
          ...
    - pattern: $PROPS.get('...')
    - focus-metavariable: $PROPS
  - patterns:
    - pattern-either:
      - pattern: location.href
      - pattern: location.hash
      - pattern: location.search
      - pattern: $WINDOW. ... .location.href
      - pattern: $WINDOW. ... .location.hash
      - pattern: $WINDOW. ... .location.search
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: eval(<... $SINK ...>)
      - pattern: window.eval(<... $SINK ...>)
      - pattern: new Function(<... $SINK ...>)
      - pattern: new Function(<... $SINK ...>)(...)
      - pattern: setTimeout(<... $SINK ...>,...)
      - pattern: setInterval(<... $SINK ...>,...)
    - focus-metavariable: $SINK
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern: location.href = $FUNC(...)
      - pattern: location.hash = $FUNC(...)
      - pattern: location.search = $FUNC(...)
      - pattern: $WINDOW. ... .location.href = $FUNC(...)
      - pattern: $WINDOW. ... .location.hash = $FUNC(...)
      - pattern: $WINDOW. ... .location.search = $FUNC(...)
- id: javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override
  message: Detected use of express.csrf() middleware before express.methodOverride().
    This can allow GET requests (which are not checked by csrf) to turn into POST
    requests later.
  metadata:
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-no-csrf-before-method-override.js
    references:
    - https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md
    category: security
    technology:
    - javascript
    owasp:
    - A01:2021 - Broken Access Control
    - A05:2017 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site Request Forgery (CSRF)
    source: https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override
    shortlink: https://sg.run/oxoX
    semgrep.dev:
      rule:
        r_id: 9316
        rv_id: 1263216
        rule_id: r6UrvQ
        version_id: K3TKkPO
        url: https://semgrep.dev/playground/r/K3TKkPO/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  pattern: |
    express.csrf();
    ...
    express.methodOverride();
- id: javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes
  message: Detected usage of crypto.pseudoRandomBytes, which does not produce secure
    random numbers.
  metadata:
    cwe:
    - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)'
    owasp:
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-pseudoRandomBytes.js
    asvs:
      section: 'V6: Stored Cryptography Verification Requirements'
      control_id: 6.3.1 Insecure Randomness
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v63-random-values
      version: '4'
    category: security
    technology:
    - javascript
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes
    shortlink: https://sg.run/pxze
    semgrep.dev:
      rule:
        r_id: 9318
        rv_id: 1263217
        rule_id: NbUkR2
        version_id: qkTR799
        url: https://semgrep.dev/playground/r/qkTR799/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  pattern: crypto.pseudoRandomBytes
- id: javascript.lang.security.spawn-git-clone.spawn-git-clone
  message: Git allows shell commands to be specified in ext URLs for remote repositories.
    For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command
    to try to connect to a remote repository. Make sure that the URL is not controlled
    by external input.
  metadata:
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - git
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone
    shortlink: https://sg.run/2xrr
    semgrep.dev:
      rule:
        r_id: 9319
        rv_id: 1263220
        rule_id: kxUkPP
        version_id: 6xT29A7
        url: https://semgrep.dev/playground/r/6xT29A7/javascript.lang.security.spawn-git-clone.spawn-git-clone
        origin: community
  languages:
  - javascript
  - typescript
  severity: ERROR
  patterns:
  - pattern-either:
    - pattern: spawn('git', ['clone',...,$F])
    - pattern: $X.spawn('git', ['clone',...,$F])
    - pattern: spawn('git', ['clone',...,$P,$F])
    - pattern: $X.spawn('git', ['clone',...,$P,$F])
  - pattern-not: spawn('git', ['clone',...,"..."])
  - pattern-not: $X.spawn('git', ['clone',...,"..."])
  - pattern-not: spawn('git', ['clone',...,"...","..."])
  - pattern-not: $X.spawn('git', ['clone',...,"...","..."])
- id: javascript.node-expat.security.audit.expat-xxe.expat-xxe
  message: If unverified user data can reach the XML Parser it can result in XML External
    or Internal Entity (XXE) Processing vulnerabilities
  metadata:
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    category: security
    technology:
    - node-expat
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    references:
    - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe
    shortlink: https://sg.run/eLdL
    semgrep.dev:
      rule:
        r_id: 9332
        rv_id: 1263224
        rule_id: gxU171
        version_id: 2KTv2AZ
        url: https://semgrep.dev/playground/r/2KTv2AZ/javascript.node-expat.security.audit.expat-xxe.expat-xxe
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: |
        var $EXPAT = require('node-expat');
        ...
        new $EXPAT.Parser(...);
        ...
        $PARSER.parse(...);
    - pattern: |
        var $EXPAT = require('node-expat');
        ...
        new $EXPAT.Parser(...);
        ...
        $PARSER.write(...);
    - pattern: |
        require('node-expat');
        ...
        new Parser(...);
        ...
        $PARSER.parse(...);
    - pattern: |
        require('node-expat');
        ...
        new Parser(...);
        ...
        $PARSER.write(...);
  - pattern-not: |
      var $EXPAT = require('node-expat');
      ...
      new $EXPAT.Parser(...);
      ...
      $PARSER.parse("...");
  - pattern-not: |
      var $EXPAT = require('node-expat');
      ...
      new $EXPAT.Parser(...);
      ...
      $PARSER.write("...");
  - pattern-not: |
      require('node-expat');
      ...
      new Parser(...);
      ...
      $PARSER.parse("...");
  - pattern-not: |
      require('node-expat');
      ...
      new Parser(...);
      ...
      $PARSER.write("...");
  - pattern-not: |
      $X = "...";
      ...
      $PARSER.parse($X);
  - pattern-not: |-
      $X = "...";
      ...
      $PARSER.write($X);
- id: javascript.sax.security.audit.sax-xxe.sax-xxe
  message: Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do
    anything with custom DTD entity definitions. If you're implementing a custom DTD
    entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities,
    or be absolutely sure that external entities received from a trusted source while
    processing XML.
  metadata:
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    references:
    - https://github.com/Leonidas-from-XIV/node-xml2js/issues/415
    - https://github.com/isaacs/sax-js
    category: security
    technology:
    - sax
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe
    shortlink: https://sg.run/5QEj
    semgrep.dev:
      rule:
        r_id: 9347
        rv_id: 1263239
        rule_id: qNUj7e
        version_id: d6Tyxn9
        url: https://semgrep.dev/playground/r/d6Tyxn9/javascript.sax.security.audit.sax-xxe.sax-xxe
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  pattern-either:
  - pattern: |
      require('sax');
      ...
      $PARSER.ondoctype = ...;
  - pattern: |-
      require('sax');
      ...
      $PARSER.on('doctype',...);
- id: javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe
  message: If unverified user data can reach the XML Parser it can result in XML External
    or Internal Entity (XXE) Processing vulnerabilities
  metadata:
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.2 Insecue XML Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    category: security
    technology:
    - xml2json
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    references:
    - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe
    shortlink: https://sg.run/l27o
    semgrep.dev:
      rule:
        r_id: 9357
        rv_id: 1263253
        rule_id: 10UKpB
        version_id: GxTkeg8
        url: https://semgrep.dev/playground/r/GxTkeg8/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  patterns:
  - pattern: |
      var $XML = require('xml2json');
      ...
      $XML.toJson(...);
  - pattern-not: |
      var $XML = require('xml2json');
      ...
      $XML.toJson("...",...);
  - pattern-not: |-
      var $XML = require('xml2json');
      ...
      var $S = "...";
      ...
      $XML.toJson($S,...);
- id: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
  message: Cannot determine what '$UNK' is and it is used with a '<script>' tag. This
    could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally
    controlled, or sanitize this data.
  metadata:
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    references:
    - https://www.developsec.com/2017/11/09/xss-in-a-script-tag/
    - https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68
    category: security
    technology:
    - javascript
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
    shortlink: https://sg.run/1Zy1
    semgrep.dev:
      rule:
        r_id: 9322
        rv_id: 1263209
        rule_id: OrU37Y
        version_id: GxTke48
        url: https://semgrep.dev/playground/r/GxTke48/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  patterns:
  - pattern-inside: |
      $UNK = $ANYFUNC(...);
      ...
      $OTHERFUNC(..., <... $UNK ...>, ...);
  - pattern: $OTHERFUNC(..., <... "=~/.*<script.*/" ...>, ...)
  - pattern: $UNK
- id: javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect
  message: It looks like '$UNK' is read from user input and it is used to as a redirect.
    Ensure '$UNK' is not externally controlled, otherwise this is an open redirect.
  metadata:
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.1 Insecue Redirect
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation
      version: '4'
    category: security
    technology:
    - express
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Open Redirect
    source: https://semgrep.dev/r/javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect
    shortlink: https://sg.run/OPv2
    semgrep.dev:
      rule:
        r_id: 9275
        rv_id: 1263147
        rule_id: gxU12X
        version_id: 3ZT4Xev
        url: https://semgrep.dev/playground/r/3ZT4Xev/javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect
        origin: community
  languages:
  - javascript
  - typescript
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern-inside: |
        $UNK = query.$B;
        ...
    - pattern-inside: |
        $UNK = $A.query.$B;
        ...
    - pattern-inside: |
        $UNK = req.$SOMETHING;
        ...
  - pattern: $RES.redirect(..., <... $UNK ...>, ...)
- id: python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator
  message: 'Found a formatted string in BashOperator: $CMD. This could be vulnerable
    to injection. Be extra sure your variables are not controllable by external sources.'
  metadata:
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - airflow
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator
    shortlink: https://sg.run/ndBY
    semgrep.dev:
      rule:
        r_id: 9436
        rv_id: 1263330
        rule_id: 4bUkOY
        version_id: yeTxpb3
        url: https://semgrep.dev/playground/r/yeTxpb3/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator
        origin: community
  languages:
  - python
  severity: ERROR
  pattern-either:
  - pattern: |
      airflow.operators.bash_operator.BashOperator(..., bash_command="..." + $CONCAT, ...)
  - pattern: |
      airflow.operators.bash_operator.BashOperator(..., bash_command="...".format(...), ...)
  - pattern: |
      airflow.operators.bash_operator.BashOperator(..., bash_command=f"...", ...)
  - pattern: |
      airflow.operators.bash_operator.BashOperator(..., bash_command="..." % $PARAMS, ...)
  - pattern: |
      $CMD = "..." % $PARAMS
      ...
      airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
  - pattern: |
      $CMD = $STR.format(...)
      ...
      airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
  - pattern: |
      $CMD = f"..."
      ...
      airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
  - pattern: |
      $CMD = "..." + $CONCAT
      ...
      airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
  - pattern: |
      $CMD = "..."
      ...
      $CMD += $CONCAT
      ...
      airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
- id: python.boto3.security.hardcoded-token.hardcoded-token
  message: A hard-coded credential was detected. It is not recommended to store credentials
    in source-code, as this risks secrets being leaked and used by either an internal
    or external malicious adversary. It is recommended to use environment variables
    to securely provide credentials or retrieve credentials from a secure vault or
    HSM (Hardware Security Module).
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    - https://bento.dev/checks/boto3/hardcoded-access-token/
    - https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    category: security
    technology:
    - boto3
    - secrets
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token
    shortlink: https://sg.run/LwQ6
    semgrep.dev:
      rule:
        r_id: 9439
        rv_id: 1263347
        rule_id: 5rUOwK
        version_id: gETB78n
        url: https://semgrep.dev/playground/r/gETB78n/python.boto3.security.hardcoded-token.hardcoded-token
        origin: community
  languages:
  - python
  severity: WARNING
  mode: taint
  pattern-sources:
  - pattern: |
      "..."
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: $W(...,$TOKEN="$VALUE",...)
      - pattern: $BOTO. ... .$W(...,$TOKEN="$VALUE",...)
    - metavariable-regex:
        metavariable: $TOKEN
        regex: (aws_session_token|aws_access_key_id|aws_secret_access_key)
    - metavariable-pattern:
        language: generic
        metavariable: $VALUE
        patterns:
        - pattern-either:
          - pattern-regex: ^AKI
          - pattern-regex: ^[A-Za-z0-9/+=]+$
    - metavariable-analysis:
        metavariable: $VALUE
        analyzer: entropy
- id: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea
  message: IDEA (International Data Encryption Algorithm) is a block cipher created
    in 1991.  It is an optional component of the OpenPGP standard. This cipher is
    susceptible to attacks when using weak keys.  It is recommended that you do not
    use this cipher for new applications. Use a strong symmetric cipher such as EAS
    instead. With the `cryptography` package it is recommended to use `Fernet` which
    is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively,
    keep using the `Cipher` class from the hazmat primitives but use the AES algorithm
    instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    bandit-code: B304
    references:
    - https://tools.ietf.org/html/rfc5469
    - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA
    category: security
    technology:
    - cryptography
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    functional-categories:
    - crypto::search::symmetric-algorithm::cryptography
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea
    shortlink: https://sg.run/3xyK
    semgrep.dev:
      rule:
        r_id: 9443
        rv_id: 1263350
        rule_id: BYUNPg
        version_id: 44TEjNJ
        url: https://semgrep.dev/playground/r/44TEjNJ/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea
        origin: community
  severity: WARNING
  languages:
  - python
  patterns:
  - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$IDEA($KEY)
  - metavariable-regex:
      metavariable: $IDEA
      regex: ^(IDEA)$
  - focus-metavariable: $IDEA
  fix: AES
- id: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb
  message: ECB (Electronic Code Book) is the simplest mode of operation for block
    ciphers.  Each block of data is encrypted in the same way.  This means identical
    plaintext blocks will always result in identical ciphertext blocks, which can
    leave significant patterns in the output. Use a different, cryptographically strong
    mode instead, such as GCM.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L101
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    bandit-code: B305
    references:
    - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes
    - https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption
    category: security
    technology:
    - cryptography
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: MEDIUM
    functional-categories:
    - crypto::search::mode::cryptography
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb
    shortlink: https://sg.run/4xr5
    semgrep.dev:
      rule:
        r_id: 9444
        rv_id: 1263351
        rule_id: DbUp5g
        version_id: PkTR3w7
        url: https://semgrep.dev/playground/r/PkTR3w7/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb
        origin: community
  severity: WARNING
  languages:
  - python
  pattern: cryptography.hazmat.primitives.ciphers.modes.ECB($IV)
  fix: cryptography.hazmat.primitives.ciphers.modes.GCM($IV)
- id: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
  patterns:
  - pattern: cryptography.hazmat.primitives.hashes.$SHA(...)
  - metavariable-pattern:
      metavariable: $SHA
      pattern: |
        SHA1
  - focus-metavariable: $SHA
  fix: |
    SHA256
  message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
    collision resistant and is therefore not suitable as a cryptographic signature.
    Use SHA256 or SHA3 instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    bandit-code: B303
    references:
    - https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1
    - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
    - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
    - http://2012.sharcs.org/slides/stevens.pdf
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    category: security
    technology:
    - cryptography
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    functional-categories:
    - crypto::search::symmetric-algorithm::cryptography
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
    shortlink: https://sg.run/J9Qy
    semgrep.dev:
      rule:
        r_id: 9446
        rv_id: 1263353
        rule_id: 0oU5dN
        version_id: 5PTo1l0
        url: https://semgrep.dev/playground/r/5PTo1l0/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
        origin: community
  severity: WARNING
  languages:
  - python
- id: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size
  patterns:
  - pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...)
  - pattern: cryptography.hazmat.primitives.asymmetric.ec.$SIZE
  - metavariable-pattern:
      metavariable: $SIZE
      pattern-either:
      - pattern: SECP192R1
      - pattern: SECT163K1
      - pattern: SECT163R2
  - focus-metavariable: $SIZE
  fix: |
    SECP256R1
  message: Detected an insufficient curve size for EC. NIST recommends a key size
    of 224 or higher. For example, use 'ec.SECP256R1'.
  metadata:
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py
    references:
    - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf
    - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves
    category: security
    technology:
    - cryptography
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    functional-categories:
    - crypto::search::key-length::cryptography
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size
    shortlink: https://sg.run/GeQq
    semgrep.dev:
      rule:
        r_id: 9448
        rv_id: 1263355
        rule_id: qNUjZ3
        version_id: RGT0LW6
        url: https://semgrep.dev/playground/r/RGT0LW6/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
    shortlink: https://sg.run/9oyr
    semgrep.dev:
      rule:
        r_id: 9467
        rv_id: 1409400
        rule_id: OrU3e6
        version_id: GxTlb9e
        url: https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
        origin: community
  message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`,
    `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code
    execution vulnerabilities.
  languages:
  - python
  severity: ERROR
  mode: taint
  pattern-sources:
  - pattern-either:
    - patterns:
      - pattern-inside: |
          def $INSIDE(..., $PARAM, ...):
            ...
      - pattern-either:
        - pattern: request.$REQFUNC(...)
        - pattern: request.$REQFUNC.get(...)
        - pattern: request.$REQFUNC[...]
  pattern-sinks:
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern: |
            pickle.$PICKLEFUNC(...)
        - pattern: |
            _pickle.$PICKLEFUNC(...)
        - pattern: |
            cPickle.$PICKLEFUNC(...)
        - pattern: |
            shelve.$PICKLEFUNC(...)
      - metavariable-regex:
          metavariable: $PICKLEFUNC
          regex: dumps|dump|load|loads
    - patterns:
      - pattern: dill.$DILLFUNC(...)
      - metavariable-regex:
          metavariable: $DILLFUNC
          regex: dump|dump_session|dumps|load|load_session|loads
    - patterns:
      - pattern: yaml.$YAMLFUNC(...)
      - pattern-not: yaml.$YAMLFUNC(..., Dumper=SafeDumper, ...)
      - pattern-not: yaml.$YAMLFUNC(..., Dumper=yaml.SafeDumper, ...)
      - pattern-not: yaml.$YAMLFUNC(..., Loader=SafeLoader, ...)
      - pattern-not: yaml.$YAMLFUNC(..., Loader=yaml.SafeLoader, ...)
      - metavariable-regex:
          metavariable: $YAMLFUNC
          regex: dump|dump_all|load|load_all
- id: python.django.security.audit.avoid-mark-safe.avoid-mark-safe
  patterns:
  - pattern-not-inside: django.utils.html.format_html(...)
  - pattern-not: django.utils.safestring.mark_safe("...")
  - pattern: django.utils.safestring.mark_safe(...)
  message: '''mark_safe()'' is used to mark a string as "safe" for HTML output. This
    disables escaping and could therefore subject the content to XSS attacks. Use
    ''django.utils.html.format_html()'' to build HTML for rendering instead.'
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b703_django_mark_safe.html
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe
    - https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe
    shortlink: https://sg.run/yd0P
    semgrep.dev:
      rule:
        r_id: 9468
        rv_id: 1263360
        rule_id: eqU8Wr
        version_id: 0bTKzkj
        url: https://semgrep.dev/playground/r/0bTKzkj/python.django.security.audit.avoid-mark-safe.avoid-mark-safe
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.django.security.audit.csrf-exempt.no-csrf-exempt
  pattern: |
    @django.views.decorators.csrf.csrf_exempt
    def $R(...):
      ...
  message: Detected usage of @csrf_exempt, which indicates that there is no CSRF token
    set for this route. This could lead to an attacker manipulating the user's account
    and exfiltration of private data. Instead, create a function without this decorator.
  metadata:
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    category: security
    technology:
    - django
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site Request Forgery (CSRF)
    source: https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt
    shortlink: https://sg.run/rd5e
    semgrep.dev:
      rule:
        r_id: 9469
        rv_id: 1263361
        rule_id: v8UnqO
        version_id: K3TKk9W
        url: https://semgrep.dev/playground/r/K3TKk9W/python.django.security.audit.csrf-exempt.no-csrf-exempt
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql
  languages:
  - python
  message: Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This
    could lead to SQL injection, which can result in attackers exfiltrating sensitive
    data. Instead, ensure no user input enters this function or that user input is
    properly sanitized.
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql
    - https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql
    shortlink: https://sg.run/b7bW
    semgrep.dev:
      rule:
        r_id: 9470
        rv_id: 1263362
        rule_id: d8Ujk6
        version_id: qkTR7gn
        url: https://semgrep.dev/playground/r/qkTR7gn/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql
        origin: community
  pattern: $EXPRESSION.as_sql(...)
  severity: WARNING
- id: python.django.security.audit.extends-custom-expression.extends-custom-expression
  languages:
  - python
  message: 'Found extension of custom expression: $CLASS. Extending expressions in
    this way could inadvertently lead to a SQL injection vulnerability, which can
    result in attackers exfiltrating sensitive data. Instead, ensure no user input
    enters this function or that user input is properly sanitized.'
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection
    - https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression
    shortlink: https://sg.run/N4Ay
    semgrep.dev:
      rule:
        r_id: 9471
        rv_id: 1263364
        rule_id: ZqU5z3
        version_id: YDTZeGe
        url: https://semgrep.dev/playground/r/YDTZeGe/python.django.security.audit.extends-custom-expression.extends-custom-expression
        origin: community
  severity: WARNING
  pattern-either:
  - pattern: |
      class $CLASS(..., django.db.models.Func, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.Func, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.Expression, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.Expression, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.Value, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.Value, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.DurationValue, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.DurationValue, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.RawSQL, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.RawSQL, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.Star, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.Star, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.Random, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.Random, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.Col, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.Col, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.Ref, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.Ref, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.ExpressionList, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.ExpressionList, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.ExpressionWrapper, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.ExpressionWrapper, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.When, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.When, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.Case, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.Case, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.Subquery, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.Subquery, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.Exists, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.Exists, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.Window, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.Window, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.WindowFrame, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.WindowFrame, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.RowRange, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.RowRange, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.ValueRange, ...):
          ...
  - pattern: |
      class $CLASS(..., django.db.models.expressions.ValueRange, ...):
          ...
- id: python.django.security.audit.query-set-extra.avoid-query-set-extra
  message: QuerySet.extra' does not provide safeguards against SQL injection and requires
    very careful use. SQL injection can lead to critical data being stolen by attackers.
    Instead of using '.extra', use the Django ORM and parameterized queries such as
    `People.objects.get(name='Bob')`.
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b610_django_extra_used.html
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra
    - https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra
    shortlink: https://sg.run/kXZP
    semgrep.dev:
      rule:
        r_id: 9472
        rv_id: 1263365
        rule_id: nJUzBP
        version_id: 6xT297o
        url: https://semgrep.dev/playground/r/6xT297o/python.django.security.audit.query-set-extra.avoid-query-set-extra
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern: $MODEL.extra(...)
  - pattern-not-inside: '$MODEL.extra(select = {$KEY: "..."})'
- id: python.django.security.audit.raw-query.avoid-raw-sql
  message: 'Detected the use of ''RawSQL'' or ''raw'' indicating the execution of
    a non-parameterized SQL query. This could lead to a SQL injection and therefore
    protected information could be leaked. Instead, use Django ORM and parameterized
    queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name=''Bob'')`'
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b611_django_rawsql_used.html
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions
    - https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql
    shortlink: https://sg.run/weDA
    semgrep.dev:
      rule:
        r_id: 9473
        rv_id: 1263366
        rule_id: EwU2JA
        version_id: o5TbDQN
        url: https://semgrep.dev/playground/r/o5TbDQN/python.django.security.audit.raw-query.avoid-raw-sql
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: $MODEL.objects.raw($QUERY, ...)
    - pattern: django.db.models.expressions.RawSQL(...)
  - pattern-not: $MODEL.objects.raw("...")
  - pattern-not: django.db.models.expressions.RawSQL("...")
- id: python.django.security.audit.secure-cookies.django-secure-set-cookie
  patterns:
  - pattern-either:
    - pattern-inside: |
        import django.http.HttpResponse
        ...
    - pattern-inside: |
        import django.shortcuts.render
        ...
  - pattern-not-inside: |
      LANGUAGE_QUERY_PARAMETER = 'language'
      ...
      def set_language(request):
          ...
      # Exclude vendored contrib/messages/storage/cookie.py
  - pattern-not-inside: |
      class CookieStorage(django.contrib.messages.storage.base.BaseStorage):
          ...
      # Exclude cookies handled by vendored middleware
  - pattern-not: response.set_cookie(django.conf.settings.SESSION_COOKIE_NAME, ...)
  - pattern-not: response.set_cookie(django.conf.settings.CSRF_COOKIE_NAME, ...)
  - pattern-not: response.set_cookie(django.conf.settings.LANGUAGE_COOKIE_NAME, ...)
  - pattern-not: response.set_cookie(rest_framework_jwt.settings.api_settings.JWT_AUTH_COOKIE,
      ...)
  - pattern-not: response.set_cookie(..., secure=$A, httponly=$B, samesite=$C, ...)
  - pattern-not: response.set_cookie(..., **$A)
  - pattern: response.set_cookie(...)
  message: Django cookies should be handled securely by setting secure=True, httponly=True,
    and samesite='Lax' in response.set_cookie(...). If your situation calls for different
    settings, explicitly disable the setting. If you want to send the cookie over
    http, set secure=False. If you want to let client-side JavaScript read the cookie,
    set httponly=False. If you want to attach cookies to requests for external sites,
    set samesite=None.
  metadata:
    cwe:
    - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    asvs:
      section: 'V3: Session Management Verification Requirements'
      control_id: 3.4 Missing Cookie Attributes
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management
      version: '4'
    references:
    - https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie
    - https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/
    - https://bento.dev/checks/flask/secure-set-cookie/
    category: security
    technology:
    - django
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cookie Security
    source: https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie
    shortlink: https://sg.run/x1WL
    semgrep.dev:
      rule:
        r_id: 9474
        rv_id: 1263367
        rule_id: 7KUQ2E
        version_id: zyTb2gp
        url: https://semgrep.dev/playground/r/zyTb2gp/python.django.security.audit.secure-cookies.django-secure-set-cookie
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.django.security.audit.unvalidated-password.unvalidated-password
  patterns:
  - pattern-not-inside: |
      if <... django.contrib.auth.password_validation.validate_password(...) ...>:
          ...
  - pattern-not-inside: |
      django.contrib.auth.password_validation.validate_password(...)
      ...
  - pattern-not-inside: |
      try:
        ...
        django.contrib.auth.password_validation.validate_password(...)
        ...
      except $EX:
        ...
      ...
  - pattern-not-inside: |
      try:
        ...
        django.contrib.auth.password_validation.validate_password(...)
        ...
      except $EX as $E:
        ...
      ...
  - pattern-not: UserModel().set_password($X)
  - pattern: $MODEL.set_password($X)
  fix: |
    if django.contrib.auth.password_validation.validate_password($X, user=$MODEL):
        $MODEL.set_password($X)
  message: The password on '$MODEL' is being set without validating the password.
    Call django.contrib.auth.password_validation.validate_password() with validation
    functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/
    for more information.
  metadata:
    cwe:
    - 'CWE-521: Weak Password Requirements'
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    references:
    - https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation
    category: security
    technology:
    - django
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password
    shortlink: https://sg.run/OPBL
    semgrep.dev:
      rule:
        r_id: 9475
        rv_id: 1263368
        rule_id: L1UywG
        version_id: pZT03gB
        url: https://semgrep.dev/playground/r/pZT03gB/python.django.security.audit.unvalidated-password.unvalidated-password
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution
  message: Found request data as an index to 'globals()'. This is extremely dangerous
    because it allows an attacker to execute arbitrary code on the system. Refactor
    your code not to use 'globals()'.
  metadata:
    cwe:
    - 'CWE-96: Improper Neutralization of Directives in Statically Saved Code (''Static
      Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186
    category: security
    technology:
    - django
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution
    shortlink: https://sg.run/Kl55
    semgrep.dev:
      rule:
        r_id: 9499
        rv_id: 1263382
        rule_id: AbUzAA
        version_id: e1TyjXZ
        url: https://semgrep.dev/playground/r/e1TyjXZ/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals().get($DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals().get("..." % $DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals().get(f"...{$DATA}...", ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals().get("...".format(..., $DATA, ...), ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals()[$DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals()["..." % $DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals()[f"...{$DATA}..."]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals()["...".format(..., $DATA, ...)]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals().get($DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals().get("..." % $DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals().get(f"...{$DATA}...", ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals().get("...".format(..., $DATA, ...), ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals()[$DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals()["..." % $DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals()[f"...{$DATA}..."]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals()["...".format(..., $DATA, ...)]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals().get($DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals().get("..." % $DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals().get(f"...{$DATA}...", ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals().get("...".format(..., $DATA, ...), ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals()[$DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals()["..." % $DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals()[f"...{$DATA}..."]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals()["...".format(..., $DATA, ...)]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals().get($DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals().get("..." % $DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals().get(f"...{$DATA}...", ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals().get("...".format(..., $DATA, ...), ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals()[$DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals()["..." % $DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals()[f"...{$DATA}..."]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals()["...".format(..., $DATA, ...)]
        ...
        $INTERM(...)
- id: python.django.security.injection.code.user-eval.user-eval
  message: Found user data in a call to 'eval'. This is extremely dangerous because
    it can enable an attacker to execute arbitrary remote code on the system. Instead,
    refactor your code to not use 'eval' and instead use a safe library for the specific
    functionality you need.
  metadata:
    cwe:
    - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
      (''Eval Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html
    - https://owasp.org/www-community/attacks/Code_Injection
    category: security
    technology:
    - django
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval
    shortlink: https://sg.run/PJDW
    semgrep.dev:
      rule:
        r_id: 9501
        rv_id: 1263384
        rule_id: DbUpDQ
        version_id: d6Tyx2A
        url: https://semgrep.dev/playground/r/d6Tyx2A/python.django.security.injection.code.user-eval.user-eval
        origin: community
  patterns:
  - pattern-inside: |
      def $F(...):
        ...
  - pattern-either:
    - pattern: eval(..., request.$W.get(...), ...)
    - pattern: |
        $V = request.$W.get(...)
        ...
        eval(..., $V, ...)
    - pattern: eval(..., request.$W(...), ...)
    - pattern: |
        $V = request.$W(...)
        ...
        eval(..., $V, ...)
    - pattern: eval(..., request.$W[...], ...)
    - pattern: |
        $V = request.$W[...]
        ...
        eval(..., $V, ...)
  languages:
  - python
  severity: WARNING
- id: python.django.security.injection.code.user-exec.user-exec
  message: Found user data in a call to 'exec'. This is extremely dangerous because
    it can enable an attacker to execute arbitrary remote code on the system. Instead,
    refactor your code to not use 'eval' and instead use a safe library for the specific
    functionality you need.
  metadata:
    cwe:
    - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
      (''Eval Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    category: security
    technology:
    - django
    references:
    - https://owasp.org/www-community/attacks/Code_Injection
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec
    shortlink: https://sg.run/5Q3X
    semgrep.dev:
      rule:
        r_id: 9503
        rv_id: 1263386
        rule_id: 0oU5AW
        version_id: nWT2LA2
        url: https://semgrep.dev/playground/r/nWT2LA2/python.django.security.injection.code.user-exec.user-exec
        origin: community
  patterns:
  - pattern-inside: |
      def $F(...):
        ...
  - pattern-either:
    - pattern: exec(..., request.$W.get(...), ...)
    - pattern: |
        $V = request.$W.get(...)
        ...
        exec(..., $V, ...)
    - pattern: exec(..., request.$W(...), ...)
    - pattern: |
        $V = request.$W(...)
        ...
        exec(..., $V, ...)
    - pattern: exec(..., request.$W[...], ...)
    - pattern: |
        $V = request.$W[...]
        ...
        exec(..., $V, ...)
    - pattern: |
        loop = asyncio.get_running_loop()
        ...
        await loop.run_in_executor(None, exec, request.$W[...])
    - pattern: |
        $V = request.$W[...]
        ...
        loop = asyncio.get_running_loop()
        ...
        await loop.run_in_executor(None, exec, $V)
    - pattern: |
        loop = asyncio.get_running_loop()
        ...
        await loop.run_in_executor(None, exec, request.$W.get(...))
    - pattern: |
        $V = request.$W.get(...)
        ...
        loop = asyncio.get_running_loop()
        ...
        await loop.run_in_executor(None, exec, $V)
  languages:
  - python
  severity: WARNING
- id: python.django.security.injection.mass-assignment.mass-assignment
  languages:
  - python
  severity: WARNING
  message: Mass assignment detected. This can result in assignment to model fields
    that are unintended and can be exploited by an attacker. Instead of using '**request.$W',
    assign each field you want to edit individually to prevent mass assignment. You
    can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html.
  metadata:
    cwe:
    - 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
      Attributes'
    owasp:
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    owaspapi: 'API6: Mass Assignment'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html
    category: security
    technology:
    - django
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mass Assignment
    source: https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment
    shortlink: https://sg.run/Ro0q
    semgrep.dev:
      rule:
        r_id: 9493
        rv_id: 1263392
        rule_id: lBU97n
        version_id: QkTGqlQ
        url: https://semgrep.dev/playground/r/QkTGqlQ/python.django.security.injection.mass-assignment.mass-assignment
        origin: community
  pattern-either:
  - pattern: $MODEL.objects.create(**request.$W)
  - pattern: |
      $OBJ.update(**request.$W)
      ...
      $OBJ.save()
- id: python.django.security.injection.email.xss-html-email-body.xss-html-email-body
  message: Found request data in an EmailMessage that is set to use HTML. This is
    dangerous because HTML emails are susceptible to XSS. An attacker could inject
    data into this HTML email, causing XSS.
  metadata:
    cwe:
    - 'CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream
      Component (''Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://www.damonkohler.com/2008/12/email-injection.html
    category: security
    technology:
    - django
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body
    shortlink: https://sg.run/RoBe
    semgrep.dev:
      rule:
        r_id: 9505
        rv_id: 1263390
        rule_id: qNUj02
        version_id: 8KT5rOn
        url: https://semgrep.dev/playground/r/8KT5rOn/python.django.security.injection.email.xss-html-email-body.xss-html-email-body
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
        $EMAIL.content_subtype = "html"
        ...
  - pattern-either:
    - pattern: django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.core.mail.EmailMessage($SUBJ, $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $B.$C(..., $DATA, ...)
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...)
    - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...)
    - pattern: django.core.mail.EmailMessage($SUBJ, request.$W(...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.core.mail.EmailMessage($SUBJ, $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $B.$C(..., $DATA, ...)
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W(...), ...)
    - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W(...), ...)
    - pattern: django.core.mail.EmailMessage($SUBJ, request.$W[...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.core.mail.EmailMessage($SUBJ, $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $B.$C(..., $DATA, ...)
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W[...], ...)
    - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W[...], ...)
    - pattern: django.core.mail.EmailMessage($SUBJ, request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.core.mail.EmailMessage($SUBJ, $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $B.$C(..., $DATA, ...)
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
    - pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W, ...)
    - pattern: return django.core.mail.EmailMessage($SUBJ, request.$W, ...)
- id: python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message
  message: Found request data in 'send_mail(...)' that uses 'html_message'. This is
    dangerous because HTML emails are susceptible to XSS. An attacker could inject
    data into this HTML email, causing XSS.
  metadata:
    cwe:
    - 'CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream
      Component (''Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://www.damonkohler.com/2008/12/email-injection.html
    category: security
    technology:
    - django
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message
    shortlink: https://sg.run/Avx8
    semgrep.dev:
      rule:
        r_id: 9506
        rv_id: 1263391
        rule_id: lBU9Ll
        version_id: gETB7Gn
        url: https://semgrep.dev/playground/r/gETB7Gn/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: django.core.mail.send_mail(..., html_message=request.$W.get(...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.core.mail.send_mail(..., html_message=$DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.core.mail.send_mail(..., html_message=$STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.core.mail.send_mail(..., html_message=$STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W.get(...),
        ...)
    - pattern: return django.core.mail.send_mail(..., html_message=request.$W.get(...),
        ...)
    - pattern: django.core.mail.send_mail(..., html_message=request.$W(...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.core.mail.send_mail(..., html_message=$DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.core.mail.send_mail(..., html_message=$STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.core.mail.send_mail(..., html_message=$STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W(...),
        ...)
    - pattern: return django.core.mail.send_mail(..., html_message=request.$W(...),
        ...)
    - pattern: django.core.mail.send_mail(..., html_message=request.$W[...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.core.mail.send_mail(..., html_message=$DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.core.mail.send_mail(..., html_message=$STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.core.mail.send_mail(..., html_message=$STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W[...],
        ...)
    - pattern: return django.core.mail.send_mail(..., html_message=request.$W[...],
        ...)
    - pattern: django.core.mail.send_mail(..., html_message=request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.core.mail.send_mail(..., html_message=$DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.core.mail.send_mail(..., html_message=$STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.core.mail.send_mail(..., html_message=$STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        django.core.mail.send_mail(..., html_message=$INTERM, ...)
    - pattern: $A = django.core.mail.send_mail(..., html_message=request.$W, ...)
    - pattern: return django.core.mail.send_mail(..., html_message=request.$W, ...)
- id: python.django.security.injection.command.command-injection-os-system.command-injection-os-system
  message: Request data detected in os.system. This could be vulnerable to a command
    injection and should be avoided. If this must be done, use the 'subprocess' module
    instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection
    for more information.
  metadata:
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/www-community/attacks/Command_Injection
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system
    shortlink: https://sg.run/Gen2
    semgrep.dev:
      rule:
        r_id: 9504
        rv_id: 1263387
        rule_id: KxUbp2
        version_id: ExTExPo
        url: https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system
        origin: community
  languages:
  - python
  severity: ERROR
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: os.system(..., request.$W.get(...), ...)
    - pattern: os.system(..., $S.format(..., request.$W.get(...), ...), ...)
    - pattern: os.system(..., $S % request.$W.get(...), ...)
    - pattern: os.system(..., f"...{request.$W.get(...)}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        os.system(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        os.system(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        os.system(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR % $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        os.system(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        os.system(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = $STR + $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: $A = os.system(..., request.$W.get(...), ...)
    - pattern: $A = os.system(..., $S.format(..., request.$W.get(...), ...), ...)
    - pattern: $A = os.system(..., $S % request.$W.get(...), ...)
    - pattern: $A = os.system(..., f"...{request.$W.get(...)}...", ...)
    - pattern: return os.system(..., request.$W.get(...), ...)
    - pattern: return os.system(..., $S.format(..., request.$W.get(...), ...), ...)
    - pattern: return os.system(..., $S % request.$W.get(...), ...)
    - pattern: return os.system(..., f"...{request.$W.get(...)}...", ...)
    - pattern: os.system(..., request.$W(...), ...)
    - pattern: os.system(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: os.system(..., $S % request.$W(...), ...)
    - pattern: os.system(..., f"...{request.$W(...)}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        os.system(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        os.system(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        os.system(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR % $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        os.system(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = f"...{$DATA}..."
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        os.system(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = $STR + $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: $A = os.system(..., request.$W(...), ...)
    - pattern: $A = os.system(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: $A = os.system(..., $S % request.$W(...), ...)
    - pattern: $A = os.system(..., f"...{request.$W(...)}...", ...)
    - pattern: return os.system(..., request.$W(...), ...)
    - pattern: return os.system(..., $S.format(..., request.$W(...), ...), ...)
    - pattern: return os.system(..., $S % request.$W(...), ...)
    - pattern: return os.system(..., f"...{request.$W(...)}...", ...)
    - pattern: os.system(..., request.$W[...], ...)
    - pattern: os.system(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: os.system(..., $S % request.$W[...], ...)
    - pattern: os.system(..., f"...{request.$W[...]}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        os.system(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        os.system(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        os.system(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR % $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        os.system(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = f"...{$DATA}..."
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        os.system(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = $STR + $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: $A = os.system(..., request.$W[...], ...)
    - pattern: $A = os.system(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: $A = os.system(..., $S % request.$W[...], ...)
    - pattern: $A = os.system(..., f"...{request.$W[...]}...", ...)
    - pattern: return os.system(..., request.$W[...], ...)
    - pattern: return os.system(..., $S.format(..., request.$W[...], ...), ...)
    - pattern: return os.system(..., $S % request.$W[...], ...)
    - pattern: return os.system(..., f"...{request.$W[...]}...", ...)
    - pattern: os.system(..., request.$W, ...)
    - pattern: os.system(..., $S.format(..., request.$W, ...), ...)
    - pattern: os.system(..., $S % request.$W, ...)
    - pattern: os.system(..., f"...{request.$W}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        os.system(..., $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        os.system(..., $STR.format(..., $DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR.format(..., $DATA, ...)
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        os.system(..., $STR % $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR % $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        os.system(..., f"...{$DATA}...", ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = f"...{$DATA}..."
        ...
        os.system(..., $INTERM, ...)
    - pattern: |
        $DATA = request.$W
        ...
        os.system(..., $STR + $DATA, ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = $STR + $DATA
        ...
        os.system(..., $INTERM, ...)
    - pattern: $A = os.system(..., request.$W, ...)
    - pattern: $A = os.system(..., $S.format(..., request.$W, ...), ...)
    - pattern: $A = os.system(..., $S % request.$W, ...)
    - pattern: $A = os.system(..., f"...{request.$W}...", ...)
    - pattern: return os.system(..., request.$W, ...)
    - pattern: return os.system(..., $S.format(..., request.$W, ...), ...)
    - pattern: return os.system(..., $S % request.$W, ...)
    - pattern: return os.system(..., f"...{request.$W}...", ...)
- id: python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name
  message: Data from request is passed to a file name `$FILE`. This is a path traversal
    vulnerability, which can lead to sensitive data being leaked. To mitigate, consider
    using os.path.abspath or os.path.realpath or the pathlib library.
  metadata:
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://owasp.org/www-community/attacks/Path_Traversal
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name
    shortlink: https://sg.run/BkO2
    semgrep.dev:
      rule:
        r_id: 9507
        rv_id: 1263394
        rule_id: YGUR36
        version_id: 44TEjWJ
        url: https://semgrep.dev/playground/r/44TEjWJ/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name
        origin: community
  patterns:
  - pattern-inside: |
      def $F(...):
        ...
  - pattern-not-inside: |
      def $F(...):
        ...
        os.path.realpath(...)
        ...
  - pattern-not-inside: |
      def $F(...):
        ...
        os.path.abspath(...)
        ...
  - pattern-either:
    - pattern: |
        $V = request.$W.get($X)
        ...
        $FILE % ($V)
    - pattern: |
        $V = request.$W[$X]
        ...
        $FILE % ($V)
    - pattern: |
        $V = request.$W($X)
        ...
        $FILE % ($V)
    - pattern: |
        $V = request.$W
        ...
        $FILE % ($V)
        # match format use cases
    - pattern: |
        $V = request.$W.get($X)
        ...
        $FILE.format(..., $V, ...)
    - pattern: |
        $V = request.$W[$X]
        ...
        $FILE.format(..., $V, ...)
    - pattern: |
        $V = request.$W($X)
        ...
        $FILE.format(..., $V, ...)
    - pattern: |
        $V = request.$W
        ...
        $FILE.format(..., $V, ...)
  - metavariable-regex:
      metavariable: $FILE
      regex: .*\.(log|zip|txt|csv|xml|html).*
  languages:
  - python
  severity: WARNING
- id: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default
  message: '''$VAR'' is using the empty string as its default and is being used to
    set the password on ''$MODEL''. If you meant to set an unusable password, set
    the default value to ''None'' or call ''set_unusable_password()''.'
  metadata:
    cwe:
    - 'CWE-521: Weak Password Requirements'
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    references:
    - https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password
    category: security
    technology:
    - django
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default
    shortlink: https://sg.run/zvBW
    semgrep.dev:
      rule:
        r_id: 9517
        rv_id: 1263412
        rule_id: yyUn6Z
        version_id: RGT0LYX
        url: https://semgrep.dev/playground/r/RGT0LYX/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default
        origin: community
  languages:
  - python
  severity: ERROR
  patterns:
  - pattern-either:
    - pattern: |
        $VAR = request.$W.get($X, $EMPTY)
        ...
        $MODEL.set_password($VAR)
        ...
        $MODEL.save(...)
    - pattern: |
        def $F(..., $VAR=$EMPTY, ...):
          ...
          $MODEL.set_password($VAR)
  - metavariable-pattern:
      metavariable: $EMPTY
      pattern: '""'
  - focus-metavariable: $EMPTY
  fix: |
    None
- id: python.django.security.audit.xss.context-autoescape-off.context-autoescape-off
  message: 'Detected a Context with autoescape disabled. If you are rendering any
    web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities.
    Remove ''autoescape: False'' or set it to ''True''.'
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.1/ref/settings/#templates
    - https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off
    shortlink: https://sg.run/nd7Y
    semgrep.dev:
      rule:
        r_id: 9480
        rv_id: 1263370
        rule_id: 4bUknY
        version_id: X0Tzye3
        url: https://semgrep.dev/playground/r/X0Tzye3/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: |
        {..., "autoescape": $FALSE, ...}
    - pattern: |
        $D["autoescape"] = $FALSE
  - metavariable-pattern:
      metavariable: $FALSE
      pattern: |
        False
  - focus-metavariable: $FALSE
  fix: |
    True
- id: python.django.security.audit.xss.global-autoescape-off.global-autoescape-off
  message: 'Autoescape is globally disbaled for this Django application. If you are
    rendering any web pages, this exposes your application to cross-site scripting
    (XSS) vulnerabilities. Remove ''autoescape: False'' or set it to ''True''.'
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.1/ref/settings/#templates
    - https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off
    shortlink: https://sg.run/LwG6
    semgrep.dev:
      rule:
        r_id: 9483
        rv_id: 1263374
        rule_id: 5rUOXK
        version_id: yeTxp93
        url: https://semgrep.dev/playground/r/yeTxp93/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off
        origin: community
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern: |
      {..., 'BACKEND': ..., 'OPTIONS': {..., 'autoescape': $FALSE, ...}, ...}
  - metavariable-pattern:
      metavariable: $FALSE
      pattern: |
        False
  - focus-metavariable: $FALSE
  fix: |
    True
- id: python.django.security.audit.xss.template-autoescape-off.template-autoescape-off
  message: Detected a template block where autoescaping is explicitly disabled with
    '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn
    autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider
    instead, using `mark_safe` in Python code.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off
    shortlink: https://sg.run/Q5WZ
    semgrep.dev:
      rule:
        r_id: 9486
        rv_id: 1263377
        rule_id: AbUzAZ
        version_id: NdTzy0A
        url: https://semgrep.dev/playground/r/NdTzy0A/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off
        origin: community
  languages:
  - regex
  paths:
    include:
    - '*.html'
  severity: WARNING
  pattern-regex: '{%\s+autoescape\s+off\s+%}'
- id: python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape
  languages:
  - generic
  severity: INFO
  message: Translated strings will not be escaped when rendered in a template. This
    leads to a vulnerability where translators could include malicious script tags
    in their translations. Consider using `force_escape` to explicitly escape a translated
    text.
  patterns:
  - pattern-either:
    - pattern: |
        {% blocktranslate...%}
    - pattern: |
        {% blocktrans...%}
  - pattern-not-inside: |
      {%...filter...force_escape...%}
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      {%...endfilter...%}
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates
    - https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape
    shortlink: https://sg.run/3xpK
    semgrep.dev:
      rule:
        r_id: 9487
        rv_id: 1263378
        rule_id: BYUNwg
        version_id: kbTzG08
        url: https://semgrep.dev/playground/r/kbTzG08/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape
        origin: community
- id: python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape
  languages:
  - generic
  severity: INFO
  message: Translated strings will not be escaped when rendered in a template. This
    leads to a vulnerability where translators could include malicious script tags
    in their translations. Consider using `force_escape` to explicitly escape a translated
    text.
  patterns:
  - pattern-either:
    - pattern: |
        {% translate ... as $TRANS ... %}
        ...
        ...
        ...
        ...
        ...
        ...
        ...
        ...
        ...
        ...
        {{ ... $TRANS ... }}
    - pattern: |
        {% trans ... as $TRANS ... %}
        ...
        ...
        ...
        ...
        ...
        ...
        ...
        ...
        ...
        ...
        {{ ... $TRANS ... }}
  - pattern-not: |
      {% translate ... as $TRANS ... %}
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      {{ ... $TRANS ... | ... force_escape ... }}
  - pattern-not: |
      {% trans ... as $TRANS ... %}
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      {{ ... $TRANS ... | ... force_escape ... }}
  - pattern-not: |
      {% translate ... as $TRANS ... %}
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      {% filter force_escape %}
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      {{ ... $TRANS ... }}
  - pattern-not: |
      {% trans ... as $TRANS ... %}
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      {% filter force_escape %}
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      ...
      {{ ... $TRANS ... }}
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates
    - https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape
    shortlink: https://sg.run/PJDz
    semgrep.dev:
      rule:
        r_id: 9489
        rv_id: 1263379
        rule_id: WAUov9
        version_id: w8TRodj
        url: https://semgrep.dev/playground/r/w8TRodj/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape
        origin: community
- id: python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq
  message: Detected a template variable where autoescaping is explicitly disabled
    with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure
    no user data is rendered here, otherwise this is a cross-site scripting (XSS)
    vulnerability. If you must do this, use `mark_safe` in your Python code.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq
    shortlink: https://sg.run/5Q30
    semgrep.dev:
      rule:
        r_id: 9491
        rv_id: 1263380
        rule_id: KxUbdx
        version_id: xyTjzyG
        url: https://semgrep.dev/playground/r/xyTjzyG/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq
        origin: community
  languages:
  - regex
  paths:
    include:
    - '*.html'
  severity: WARNING
  pattern-regex: '{{.*?\|\s+safeseq(\s+}})?'
- id: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
  message: Running flask app with host 0.0.0.0 could expose the server publicly.
  metadata:
    cwe:
    - 'CWE-668: Exposure of Resource to Wrong Sphere'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    category: security
    technology:
    - flask
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
    shortlink: https://sg.run/eLby
    semgrep.dev:
      rule:
        r_id: 9532
        rv_id: 1263414
        rule_id: L1Uy1n
        version_id: BjTkZOY
        url: https://semgrep.dev/playground/r/BjTkZOY/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
        origin: community
  languages:
  - python
  severity: WARNING
  pattern-either:
  - pattern: app.run(..., host="0.0.0.0", ...)
  - pattern: app.run(..., "0.0.0.0", ...)
- id: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly
  patterns:
  - pattern-not-inside: |
      if __name__ == '__main__':
        ...
  - pattern-not-inside: |
      def $X(...):
        ...
  - pattern: app.run(...)
  message: top-level app.run(...) is ignored by flask. Consider putting app.run(...)
    behind a guard, like inside a function
  metadata:
    cwe:
    - 'CWE-668: Exposure of Resource to Wrong Sphere'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    category: security
    technology:
    - flask
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly
    shortlink: https://sg.run/vz5b
    semgrep.dev:
      rule:
        r_id: 9533
        rv_id: 1263415
        rule_id: 8GUjdX
        version_id: DkTRb4z
        url: https://semgrep.dev/playground/r/DkTRb4z/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.flask.security.audit.debug-enabled.debug-enabled
  patterns:
  - pattern-inside: |
      import flask
      ...
  - pattern: $APP.run(..., debug=True, ...)
  message: Detected Flask app with debug=True. Do not deploy to production with this
    flag enabled as it will leak sensitive information. Instead, consider using Flask
    configuration variables or setting 'debug' using system environment variables.
  metadata:
    cwe:
    - 'CWE-489: Active Debug Code'
    owasp: A06:2017 - Security Misconfiguration
    references:
    - https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/
    category: security
    technology:
    - flask
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Active Debug Code
    source: https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled
    shortlink: https://sg.run/dKrd
    semgrep.dev:
      rule:
        r_id: 9534
        rv_id: 946206
        rule_id: gxU1bd
        version_id: 8KTKjwR
        url: https://semgrep.dev/playground/r/8KTKjwR/python.flask.security.audit.debug-enabled.debug-enabled
        origin: community
  severity: WARNING
  languages:
  - python
- id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG
  message: Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment
    variable
  severity: WARNING
  metadata:
    likelihood: LOW
    impact: LOW
    confidence: LOW
    category: security
    cwe:
    - 'CWE-489: Active Debug Code'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    references:
    - https://bento.dev/checks/flask/avoid-hardcoded-config/
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features
    subcategory:
    - audit
    technology:
    - flask
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Active Debug Code
    source: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG
    shortlink: https://sg.run/LwPo
    semgrep.dev:
      rule:
        r_id: 9539
        rv_id: 1263422
        rule_id: JDUyJR
        version_id: 6xT29w6
        url: https://semgrep.dev/playground/r/6xT29w6/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG
        origin: community
  languages:
  - python
  pattern-either:
  - pattern: $M.update(DEBUG=True)
  - pattern: $M.update(DEBUG=False)
  - pattern: $M.config['DEBUG'] = True
  - pattern: $M.config['DEBUG'] = False
- id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV
  message: Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment
    variable
  severity: WARNING
  metadata:
    likelihood: LOW
    impact: LOW
    confidence: LOW
    category: security
    cwe:
    - 'CWE-489: Active Debug Code'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    references:
    - https://bento.dev/checks/flask/avoid-hardcoded-config/
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features
    subcategory:
    - audit
    technology:
    - flask
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Active Debug Code
    source: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV
    shortlink: https://sg.run/7oXW
    semgrep.dev:
      rule:
        r_id: 9538
        rv_id: 1263421
        rule_id: PeUZpr
        version_id: YDTZeKr
        url: https://semgrep.dev/playground/r/YDTZeKr/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV
        origin: community
  languages:
  - python
  pattern-either:
  - pattern: $M.update(ENV="=~/^development|production$/")
  - pattern: $M.config['ENV'] = "=~/^development|production$/"
- id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY
  message: Hardcoded variable `SECRET_KEY` detected. Use environment variables or
    config files instead
  severity: ERROR
  metadata:
    likelihood: LOW
    impact: LOW
    confidence: LOW
    category: security
    cwe:
    - 'CWE-489: Active Debug Code'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    references:
    - https://bento.dev/checks/flask/avoid-hardcoded-config/
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features
    subcategory:
    - audit
    technology:
    - flask
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Active Debug Code
    source: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY
    shortlink: https://sg.run/Ekde
    semgrep.dev:
      rule:
        r_id: 9537
        rv_id: 1263420
        rule_id: 4bUkX0
        version_id: l4TJRA9
        url: https://semgrep.dev/playground/r/l4TJRA9/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY
        origin: community
  languages:
  - python
  pattern-either:
  - pattern: $M.update(SECRET_KEY="=~/.*/")
  - pattern: $M.config['SECRET_KEY'] = "=~/.*/"
- id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING
  message: Hardcoded variable `TESTING` detected. Use environment variables or config
    files instead
  severity: WARNING
  metadata:
    likelihood: LOW
    impact: LOW
    confidence: LOW
    category: security
    cwe:
    - 'CWE-489: Active Debug Code'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    references:
    - https://bento.dev/checks/flask/avoid-hardcoded-config/
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features
    subcategory:
    - audit
    technology:
    - flask
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Active Debug Code
    source: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING
    shortlink: https://sg.run/ndZ2
    semgrep.dev:
      rule:
        r_id: 9536
        rv_id: 1263419
        rule_id: 3qUPoy
        version_id: qkTR7P1
        url: https://semgrep.dev/playground/r/qkTR7P1/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING
        origin: community
  languages:
  - python
  pattern-either:
  - pattern: $M.config['TESTING'] = True
  - pattern: $M.config['TESTING'] = False
  - pattern: $M.update(TESTING=True, ...)
  - pattern: $M.update(TESTING=False, ...)
- id: python.flask.security.audit.render-template-string.render-template-string
  pattern: flask.render_template_string(...)
  metadata:
    cwe:
    - 'CWE-96: Improper Neutralization of Directives in Statically Saved Code (''Static
      Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html
    category: security
    technology:
    - flask
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string
    shortlink: https://sg.run/8yjE
    semgrep.dev:
      rule:
        r_id: 9540
        rv_id: 1263423
        rule_id: 5rUOv1
        version_id: o5TbDp4
        url: https://semgrep.dev/playground/r/o5TbDp4/python.flask.security.audit.render-template-string.render-template-string
        origin: community
  message: Found a template created with string formatting. This is susceptible to
    server-side template injection and cross-site scripting attacks.
  languages:
  - python
  severity: WARNING
- id: python.flask.security.audit.secure-set-cookie.secure-set-cookie
  patterns:
  - pattern-either:
    - pattern-inside: |
        $RESP = flask.make_response(...)
        ...
    - pattern-inside: |
        $RESP = flask.Response(...)
        ...
  - pattern-not: $RESP.set_cookie(..., secure=$A, httponly=$B, samesite=$C, ...)
  - pattern-not: $RESP.set_cookie(..., **$A)
  - pattern: $RESP.set_cookie(...)
  message: Found a Flask cookie with insecurely configured properties.  By default
    the secure, httponly and samesite ar configured insecurely. cookies should be
    handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'`
    in response.set_cookie(...). If these parameters are not properly set, your cookies
    are not properly protected and are at risk of being stolen by an attacker. Include
    the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to
    be true in the Flask configuration.
  metadata:
    cwe:
    - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    references:
    - https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie
    - https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options
    category: security
    technology:
    - python
    - flask
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    functional-categories:
    - web::search::cookie-config::flask
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cookie Security
    source: https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie
    shortlink: https://sg.run/gLkZ
    semgrep.dev:
      rule:
        r_id: 9541
        rv_id: 1263424
        rule_id: GdU7GR
        version_id: zyTb20n
        url: https://semgrep.dev/playground/r/zyTb20n/python.flask.security.audit.secure-set-cookie.secure-set-cookie
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled
  message: Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection.
  options:
    symbolic_propagation: true
  metadata:
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://flask-wtf.readthedocs.io/en/1.2.x/csrf/
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    functional-categories:
    - web::search::csrf-config::flask
    - web::search::csrf-config::flask-wtf
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site Request Forgery (CSRF)
    source: https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled
    shortlink: https://sg.run/Q5AQ
    semgrep.dev:
      rule:
        r_id: 9542
        rv_id: 1263425
        rule_id: ReUgXz
        version_id: pZT034X
        url: https://semgrep.dev/playground/r/pZT034X/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled
        origin: community
  severity: WARNING
  languages:
  - python
  patterns:
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern: $APP.config["WTF_CSRF_ENABLED"] = $FALSE
        - pattern: $APP.config.WTF_CSRF_ENABLED = $FALSE
        - patterns:
          - pattern: |
              $APP.config.$UPDATE(
                ...,
                WTF_CSRF_ENABLED = $FALSE,
                ...
              )
          - pattern-not-inside: |
              $APP.config.$UPDATE(
                  ...,
                  TESTING=True,
                  ...
              )
          - pattern-not-inside: |
              $APP.config.$UPDATE(
                  ...,
                  DEBUG=True,
                  ...
              )
          - metavariable-regex:
              metavariable: $UPDATE
              regex: ^(update|from_mapping)$
        - pattern: |
            $OBJ = $CLASS()
            ...
            $OBJ.WTF_CSRF_ENABLED = $FALSE
            ...
            $APP.config.from_object($OBJ, ...)
        - pattern: |
            WTF_CSRF_ENABLED = $FALSE
            ...
            $APP.config.from_object(__name__)
      - metavariable-regex:
          metavariable: $FALSE
          regex: ^(False)$
      - focus-metavariable: $FALSE
  fix: 'True'
- id: python.flask.security.dangerous-template-string.dangerous-template-string
  message: Found a template created with string formatting. This is susceptible to
    server-side template injection and cross-site scripting attacks.
  metadata:
    cwe:
    - 'CWE-96: Improper Neutralization of Directives in Statically Saved Code (''Static
      Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html
    - https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti
    category: security
    technology:
    - flask
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string
    shortlink: https://sg.run/b79E
    semgrep.dev:
      rule:
        r_id: 9526
        rv_id: 1263427
        rule_id: v8UnZJ
        version_id: X0Tzy0L
        url: https://semgrep.dev/playground/r/X0Tzy0L/python.flask.security.dangerous-template-string.dangerous-template-string
        origin: community
  languages:
  - python
  severity: ERROR
  pattern-either:
  - pattern: |
      $V = "...".format(...)
      ...
      flask.render_template_string($V, ...)
  - pattern: |
      $V = "...".format(...)
      ...
      return flask.render_template_string($V, ...), $MORE
  - pattern: |
      $V = "..." % $S
      ...
      flask.render_template_string($V, ...)
  - pattern: |
      $V = "..." % $S
      ...
      return flask.render_template_string($V, ...), $MORE
  - pattern: |
      $V = "..."
      ...
      $V += $O
      ...
      flask.render_template_string($V, ...)
  - pattern: |
      $V = "..."
      ...
      $V += $O
      ...
      return flask.render_template_string($V, ...), $MORE
  - pattern: |
      $V = f"...{$X}..."
      ...
      flask.render_template_string($V, ...)
  - pattern: |
      $V = f"...{$X}..."
      ...
      return flask.render_template_string($V, ...), $CODE
- id: python.flask.security.injection.user-eval.eval-injection
  languages:
  - python
  severity: ERROR
  message: Detected user data flowing into eval. This is code injection and should
    be avoided.
  metadata:
    cwe:
    - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
      (''Eval Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html
    category: security
    technology:
    - flask
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection
    shortlink: https://sg.run/5QpX
    semgrep.dev:
      rule:
        r_id: 9547
        rv_id: 1263436
        rule_id: 0oU54W
        version_id: w8TRoB0
        url: https://semgrep.dev/playground/r/w8TRoB0/python.flask.security.injection.user-eval.eval-injection
        origin: community
  pattern-either:
  - patterns:
    - pattern: eval(...)
    - pattern-either:
      - pattern-inside: |
          @$APP.route($ROUTE, ...)
          def $FUNC(..., $ROUTEVAR, ...):
            ...
            eval(..., <... $ROUTEVAR ...>, ...)
      - pattern-inside: |
          @$APP.route($ROUTE, ...)
          def $FUNC(..., $ROUTEVAR, ...):
            ...
            $INTERM = <... $ROUTEVAR ...>
            ...
            eval(..., <... $INTERM ...>, ...)
  - pattern: eval(..., <... flask.request.$W.get(...) ...>, ...)
  - pattern: eval(..., <... flask.request.$W[...] ...>, ...)
  - pattern: eval(..., <... flask.request.$W(...) ...>, ...)
  - pattern: eval(..., <... flask.request.$W ...>, ...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W.get(...) ...>
        ...
        eval(..., <... $INTERM ...>, ...)
    - pattern: eval(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W[...] ...>
        ...
        eval(..., <... $INTERM ...>, ...)
    - pattern: eval(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W(...) ...>
        ...
        eval(..., <... $INTERM ...>, ...)
    - pattern: eval(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W ...>
        ...
        eval(..., <... $INTERM ...>, ...)
    - pattern: eval(...)
- id: python.flask.security.injection.user-exec.exec-injection
  languages:
  - python
  severity: ERROR
  message: Detected user data flowing into exec. This is code injection and should
    be avoided.
  metadata:
    cwe:
    - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
      (''Eval Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html
    category: security
    technology:
    - flask
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection
    shortlink: https://sg.run/Ge42
    semgrep.dev:
      rule:
        r_id: 9548
        rv_id: 1263437
        rule_id: KxUbl2
        version_id: xyTjzD9
        url: https://semgrep.dev/playground/r/xyTjzD9/python.flask.security.injection.user-exec.exec-injection
        origin: community
  pattern-either:
  - patterns:
    - pattern: exec(...)
    - pattern-either:
      - pattern-inside: |
          @$APP.route($ROUTE, ...)
          def $FUNC(..., $ROUTEVAR, ...):
            ...
            exec(..., <... $ROUTEVAR ...>, ...)
      - pattern-inside: |
          @$APP.route($ROUTE, ...)
          def $FUNC(..., $ROUTEVAR, ...):
            ...
            $INTERM = <... $ROUTEVAR ...>
            ...
            exec(..., <... $INTERM ...>, ...)
  - pattern: exec(..., <... flask.request.$W.get(...) ...>, ...)
  - pattern: exec(..., <... flask.request.$W[...] ...>, ...)
  - pattern: exec(..., <... flask.request.$W(...) ...>, ...)
  - pattern: exec(..., <... flask.request.$W ...>, ...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W.get(...) ...>
        ...
        exec(..., <... $INTERM ...>, ...)
    - pattern: exec(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W[...] ...>
        ...
        exec(..., <... $INTERM ...>, ...)
    - pattern: exec(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W(...) ...>
        ...
        exec(..., <... $INTERM ...>, ...)
    - pattern: exec(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W ...>
        ...
        exec(..., <... $INTERM ...>, ...)
    - pattern: exec(...)
- id: python.flask.security.insecure-deserialization.insecure-deserialization
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization
    shortlink: https://sg.run/N45z
    semgrep.dev:
      rule:
        r_id: 9527
        rv_id: 1263438
        rule_id: d8UjBO
        version_id: O9Tpx2r
        url: https://semgrep.dev/playground/r/O9Tpx2r/python.flask.security.insecure-deserialization.insecure-deserialization
        origin: community
  message: Detected the use of an insecure deserialization library in a Flask route.
    These libraries are prone to code execution vulnerabilities. Ensure user data
    does not enter this function. To fix this, try to avoid serializing whole objects.
    Consider instead using a serializer such as JSON.
  languages:
  - python
  severity: ERROR
  patterns:
  - pattern-inside: |
      @app.route(...)
      def $X(...):
        ...
  - pattern-not: $MODULE.$FUNC("...")
  - pattern-not: $MODULE.$FUNC(open("...", ...))
  - pattern-either:
    - pattern: pickle.$FUNC(...)
    - pattern: _pickle.$FUNC(...)
    - pattern: cPickle.$FUNC(...)
    - pattern: dill.$FUNC(...)
    - pattern: shelve.$FUNC(...)
    - pattern: yaml.load(...)
- id: python.flask.security.open-redirect.open-redirect
  patterns:
  - pattern-inside: |
      @$APP.route(...)
      def $X(...):
        ...
  - pattern-not-inside: |
      @$APP.route(...)
      def $X(...):
        ...
        if <... werkzeug.urls.url_parse($V) ...>:
          ...
  - pattern-either:
    - pattern: flask.redirect(<... flask.request.$W.get(...) ...>, ...)
    - pattern: flask.redirect(<... flask.request.$W[...] ...>, ...)
    - pattern: flask.redirect(<... flask.request.$W(...) ...>, ...)
    - pattern: flask.redirect(<... flask.request.$W ...>, ...)
    - pattern: |
        $V = flask.request.$W.get(...)
        ...
        flask.redirect(<... $V ...>, ...)
    - pattern: |
        $V = flask.request.$W[...]
        ...
        flask.redirect(<... $V ...>, ...)
    - pattern: |
        $V = flask.request.$W(...)
        ...
        flask.redirect(<... $V ...>, ...)
    - pattern: |
        $V = flask.request.$W
        ...
        flask.redirect(<... $V ...>, ...)
  - pattern-not: flask.redirect(flask.request.path)
  - pattern-not: flask.redirect(flask.request.path + ...)
  - pattern-not: flask.redirect(f"{flask.request.path}...")
  message: Data from request is passed to redirect(). This is an open redirect and
    could be exploited. Consider using 'url_for()' to generate links to known locations.
    If you must use a URL to unknown pages, consider using 'urlparse()' or similar
    and checking if the 'netloc' property is the same as your site's host name. See
    the references for more information.
  metadata:
    cwe:
    - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://flask-login.readthedocs.io/en/latest/#login-example
    - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1
    - https://docs.python.org/3/library/urllib.parse.html#url-parsing
    category: security
    technology:
    - flask
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Open Redirect
    source: https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect
    shortlink: https://sg.run/kXe2
    semgrep.dev:
      rule:
        r_id: 9528
        rv_id: 1263439
        rule_id: ZqU5LR
        version_id: e1Tyj2Y
        url: https://semgrep.dev/playground/r/e1Tyj2Y/python.flask.security.open-redirect.open-redirect
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization
  patterns:
  - pattern-inside: |
      @app.route(...)
      def $X(filename):
        ...
  - pattern: flask.send_file(filename, ...)
  message: Detected a user-controlled `filename` that could flow to `flask.send_file()`
    function. This could lead to an attacker reading arbitrary file from the system,
    leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`
  metadata:
    cwe:
    - 'CWE-73: External Control of File Name or Path'
    owasp:
    - A04:2021 - Insecure Design
    - A06:2025 - Insecure Design
    category: security
    technology:
    - flask
    references:
    - https://owasp.org/Top10/A04_2021-Insecure_Design
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization
    shortlink: https://sg.run/weGP
    semgrep.dev:
      rule:
        r_id: 9529
        rv_id: 1263440
        rule_id: nJUz6A
        version_id: vdT06Ab
        url: https://semgrep.dev/playground/r/vdT06Ab/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.flask.security.unescaped-template-extension.unescaped-template-extension
  message: Flask does not automatically escape Jinja templates unless they have .html,
    .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm,
    .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup
    for more information.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://pypi.org/project/flake8-flask/
    references:
    - https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup
    - https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/
    - https://bento.dev/checks/flask/unescaped-file-extension/
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension
    shortlink: https://sg.run/x1Rg
    semgrep.dev:
      rule:
        r_id: 9530
        rv_id: 1263441
        rule_id: EwU293
        version_id: d6Tyx52
        url: https://semgrep.dev/playground/r/d6Tyx52/python.flask.security.unescaped-template-extension.unescaped-template-extension
        origin: community
  patterns:
  - pattern-not: flask.render_template("=~/.+\.html$/", ...)
  - pattern-not: flask.render_template("=~/.+\.xml$/", ...)
  - pattern-not: flask.render_template("=~/.+\.htm$/", ...)
  - pattern-not: flask.render_template("=~/.+\.xhtml$/", ...)
  - pattern-not: flask.render_template($X + "=~/\.html$/", ...)
  - pattern-not: flask.render_template($X + "=~/\.xml$/", ...)
  - pattern-not: flask.render_template($X + "=~/\.htm$/", ...)
  - pattern-not: flask.render_template($X + "=~/\.xhtml$/", ...)
  - pattern-not: flask.render_template("=~/.+\.html$/" % $X, ...)
  - pattern-not: flask.render_template("=~/.+\.xml$/" % $X, ...)
  - pattern-not: flask.render_template("=~/.+\.htm$/" % $X, ...)
  - pattern-not: flask.render_template("=~/.+\.xhtml$/" % $X, ...)
  - pattern-not: flask.render_template("=~/.+\.html$/".format(...), ...)
  - pattern-not: flask.render_template("=~/.+\.xml$/".format(...), ...)
  - pattern-not: flask.render_template("=~/.+\.htm$/".format(...), ...)
  - pattern-not: flask.render_template("=~/.+\.xhtml$/".format(...), ...)
  - pattern-not: flask.render_template($TEMPLATE)
  - pattern-either:
    - pattern: flask.render_template("...", ...)
    - pattern: flask.render_template($X + "...", ...)
    - pattern: flask.render_template("..." % $Y, ...)
    - pattern: flask.render_template("...".format(...), ...)
  languages:
  - python
  severity: WARNING
- id: python.flask.security.unsanitized-input.response-contains-unsanitized-input
  message: Flask response reflects unsanitized user input. This could lead to a cross-site
    scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which
    an attacker causes arbitrary code to be executed in the user's browser. To prevent,
    please sanitize the user input, e.g. by rendering the response in a Jinja2 template
    (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/).
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://flask.palletsprojects.com/en/1.0.x/security/
    - https://owasp.org/www-community/attacks/xss/
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input
    shortlink: https://sg.run/OPGn
    semgrep.dev:
      rule:
        r_id: 9531
        rv_id: 1263442
        rule_id: 7KUQLl
        version_id: ZRTKAvv
        url: https://semgrep.dev/playground/r/ZRTKAvv/python.flask.security.unsanitized-input.response-contains-unsanitized-input
        origin: community
  languages:
  - python
  severity: WARNING
  pattern-either:
  - pattern: |
      $X = flask.request.args.get(...)
      ...
      flask.make_response("...".format($X))
  - pattern: |
      $X = flask.request.args.get(...)
      ...
      flask.make_response(f"...{$X}...")
  - pattern: |
      $X = flask.request.args.get(...)
      ...
      flask.make_response(f"...{$X}")
  - pattern: |
      $X = flask.request.args.get(...)
      ...
      flask.make_response(f"{$X}...")
- id: python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off
  message: Detected a segment of a Flask template where autoescaping is explicitly
    disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this
    segment. Ensure no user data is rendered here, otherwise this is a cross-site
    scripting (XSS) vulnerability, or turn autoescape on.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping
    - https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off
    shortlink: https://sg.run/Bkn2
    semgrep.dev:
      rule:
        r_id: 9551
        rv_id: 1263445
        rule_id: YGURo6
        version_id: 7ZTE3jd
        url: https://semgrep.dev/playground/r/7ZTE3jd/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off
        origin: community
  languages:
  - regex
  paths:
    include:
    - '*.html'
  severity: WARNING
  pattern-regex: '{%\s*autoescape\s+false\s*%}'
- id: python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe
  message: Detected a segment of a Flask template where autoescaping is explicitly
    disabled with '| safe' filter. This allows rendering of raw HTML in this segment.
    Ensure no user data is rendered here, otherwise this is a cross-site scripting
    (XSS) vulnerability.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe
    shortlink: https://sg.run/W8og
    semgrep.dev:
      rule:
        r_id: 9553
        rv_id: 1263446
        rule_id: oqUenz
        version_id: LjTkgoZ
        url: https://semgrep.dev/playground/r/LjTkgoZ/python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe
        origin: community
  languages:
  - regex
  paths:
    include:
    - '*.html'
  severity: WARNING
  pattern-regex: '{{.*?\|\s*safe(\s*}})?'
- id: python.lang.security.audit.conn_recv.multiprocessing-recv
  languages:
  - python
  message: 'The Connection.recv() method automatically unpickles the data it receives,
    which can be a security risk unless you can trust the process which sent the message.
    Therefore, unless the connection object was produced using Pipe() you should only
    use the recv() and send() methods after performing some sort of authentication.
    See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection'
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    references:
    - https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv
    shortlink: https://sg.run/x1lz
    semgrep.dev:
      rule:
        r_id: 9630
        rv_id: 1263455
        rule_id: nJUzeK
        version_id: GxTkeKQ
        url: https://semgrep.dev/playground/r/GxTkeKQ/python.lang.security.audit.conn_recv.multiprocessing-recv
        origin: community
  pattern-either:
  - pattern: multiprocessing.connection.Connection.recv(...)
  - pattern: multiprocessing.connection.Client.recv(...)
  - pattern: |
      $C = multiprocessing.connection.Client(...)
      ...
      $C.recv(...)
  severity: WARNING
- id: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected
  patterns:
  - pattern-not: urllib.$W("...")
  - pattern-not: urllib.request.$W("...")
  - pattern-not: $OPENER.$W("...")
  - pattern-either:
    - pattern: urllib.urlopen(...)
    - pattern: urllib.request.urlopen(...)
    - pattern: urllib.urlretrieve(...)
    - pattern: urllib.request.urlretrieve(...)
    - patterns:
      - pattern-either:
        - pattern-inside: |
            $OPENER = urllib.URLopener(...)
            ...
        - pattern-inside: |
            $OPENER = urllib.request.URLopener(...)
            ...
        - pattern-inside: |
            $OPENER = urllib.FancyURLopener(...)
            ...
        - pattern-inside: |
            $OPENER = urllib.request.FancyURLopener(...)
            ...
      - pattern-either:
        - pattern: $OPENER.open(...)
        - pattern: $OPENER.retrieve(...)
  message: Detected a dynamic value being used with urllib. urllib supports 'file://'
    schemes, so a dynamic value controlled by a malicious actor may allow them to
    read arbitrary files. Audit uses of urllib calls to ensure user data cannot control
    the URLs, or consider using the 'requests' library instead.
  metadata:
    cwe:
    - 'CWE-939: Improper Authorization in Handler for Custom URL Scheme'
    owasp: A01:2017 - Injection
    source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/blacklists/calls.py#L163
    bandit-code: B310
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.2.4 Dynamic Code Execution Features
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
      version: '4'
    category: security
    technology:
    - python
    references:
    - https://cwe.mitre.org/data/definitions/939.html
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authorization
    source: https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected
    shortlink: https://sg.run/dKZZ
    semgrep.dev:
      rule:
        r_id: 9634
        rv_id: 946340
        rule_id: 8GUj22
        version_id: w8TKJbO
        url: https://semgrep.dev/playground/r/w8TKJbO/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.lang.security.audit.eval-detected.eval-detected
  patterns:
  - pattern-not: eval(f"")
  - pattern-not: eval("...")
  - pattern: eval(...)
  message: Detected the use of eval(). eval() can be dangerous if used to evaluate
    dynamic content. If this content can be input from outside the program, this may
    be a code injection vulnerability. Ensure evaluated content is not definable by
    external sources.
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b307-eval
    cwe:
    - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
      (''Eval Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.2.4 Dyanmic Code Execution Features
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
      version: '4'
    category: security
    technology:
    - python
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected
    shortlink: https://sg.run/ZvrD
    semgrep.dev:
      rule:
        r_id: 9635
        rv_id: 1263477
        rule_id: gxU149
        version_id: bZT537Q
        url: https://semgrep.dev/playground/r/bZT537Q/python.lang.security.audit.eval-detected.eval-detected
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.lang.security.audit.exec-detected.exec-detected
  patterns:
  - pattern-not: exec("...")
  - pattern: exec(...)
  message: Detected the use of exec(). exec() can be dangerous if used to evaluate
    dynamic content. If this content can be input from outside the program, this may
    be a code injection vulnerability. Ensure evaluated content is not definable by
    external sources.
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b102_exec_used.html
    cwe:
    - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
      (''Eval Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.2.4 Dyanmic Code Execution Features
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
      version: '4'
    category: security
    technology:
    - python
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected
    shortlink: https://sg.run/ndRX
    semgrep.dev:
      rule:
        r_id: 9636
        rv_id: 1263478
        rule_id: QrUzKv
        version_id: NdTzyKJ
        url: https://semgrep.dev/playground/r/NdTzyKJ/python.lang.security.audit.exec-detected.exec-detected
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument
  message: Hardcoded password is used as a default argument to '$FUNC'. This could
    be dangerous if a real password is not supplied.
  languages:
  - python
  severity: WARNING
  patterns:
  - pattern: |
      def $FUNC(..., password="...", ...):
        ...
  - pattern-not: |
      def $FUNC(..., password="", ...):
        ...
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    category: security
    technology:
    - python
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    references:
    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument
    shortlink: https://sg.run/Lw9r
    semgrep.dev:
      rule:
        r_id: 9639
        rv_id: 1263480
        rule_id: PeUZAW
        version_id: w8TRoP0
        url: https://semgrep.dev/playground/r/w8TRoP0/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument
        origin: community
- id: python.lang.security.audit.httpsconnection-detected.httpsconnection-detected
  message: The HTTPSConnection API has changed frequently with minor releases of Python.
    Ensure you are using the API for your version of Python securely. For example,
    Python 3 versions prior to 3.4.3 will not verify SSL certificates by default.
    See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection
    for more information.
  metadata:
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    cwe:
    - 'CWE-295: Improper Certificate Validation'
    references:
    - https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection
    category: security
    technology:
    - python
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected
    shortlink: https://sg.run/8yby
    semgrep.dev:
      rule:
        r_id: 9640
        rv_id: 1263481
        rule_id: JDUy7y
        version_id: xyTjzg9
        url: https://semgrep.dev/playground/r/xyTjzg9/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected
        origin: community
  severity: WARNING
  languages:
  - python
  pattern-either:
  - pattern: httplib.HTTPSConnection(...)
  - pattern: http.client.HTTPSConnection(...)
  - pattern: six.moves.http_client.HTTPSConnection(...)
- id: python.lang.security.audit.logging.listeneval.listen-eval
  languages:
  - python
  message: Because portions of the logging configuration are passed through eval(),
    use of this function may open its users to a security risk. While the function
    only binds to a socket on localhost, and so does not accept connections from remote
    machines, there are scenarios where untrusted code could be run under the account
    of the process which calls listen(). To avoid this happening, use the `verify()`
    argument to `listen()` to prevent unrecognized configurations.
  metadata:
    cwe:
    - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
      (''Eval Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen
    category: security
    technology:
    - python
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval
    shortlink: https://sg.run/9okY
    semgrep.dev:
      rule:
        r_id: 9667
        rv_id: 1263500
        rule_id: wdUJQY
        version_id: RGT0L6X
        url: https://semgrep.dev/playground/r/RGT0L6X/python.lang.security.audit.logging.listeneval.listen-eval
        origin: community
  severity: WARNING
  pattern: logging.config.listen(...)
- id: python.lang.security.audit.mako-templates-detected.mako-templates-detected
  pattern: mako.template.Template(...)
  message: Mako templates do not provide a global HTML escaping mechanism. This means
    you must escape all sensitive data in your templates using '| u' for URL escaping
    or '| h' for HTML escaping. If you are using Mako to serve web content, consider
    using a system such as Jinja2 which enables global escaping.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/mako_templates.py
    references:
    - https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping
    - https://jinja.palletsprojects.com/en/2.11.x/intro/#
    category: security
    technology:
    - mako
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected
    shortlink: https://sg.run/Q5v4
    semgrep.dev:
      rule:
        r_id: 9642
        rv_id: 1263502
        rule_id: GdU79Z
        version_id: BjTkZgY
        url: https://semgrep.dev/playground/r/BjTkZgY/python.lang.security.audit.mako-templates-detected.mako-templates-detected
        origin: community
  languages:
  - python
  severity: INFO
- id: python.lang.security.audit.marshal.marshal-usage
  languages:
  - python
  message: 'The marshal module is not intended to be secure against erroneous or maliciously
    constructed data. Never unmarshal data received from an untrusted or unauthenticated
    source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security'
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    references:
    - https://docs.python.org/3/library/marshal.html?highlight=security
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage
    shortlink: https://sg.run/3xor
    semgrep.dev:
      rule:
        r_id: 9643
        rv_id: 1263503
        rule_id: ReUg13
        version_id: DkTRbPz
        url: https://semgrep.dev/playground/r/DkTRbPz/python.lang.security.audit.marshal.marshal-usage
        origin: community
  pattern-either:
  - pattern: marshal.dump(...)
  - pattern: marshal.dumps(...)
  - pattern: marshal.load(...)
  - pattern: marshal.loads(...)
  severity: WARNING
- id: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces
  message: Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose
    the server publicly as it binds to all available interfaces. Consider instead
    getting correct address from an environment variable or configuration file.
  metadata:
    cwe:
    - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    category: security
    technology:
    - python
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mishandled Sensitive Information
    source: https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces
    shortlink: https://sg.run/rdln
    semgrep.dev:
      rule:
        r_id: 9669
        rv_id: 1263505
        rule_id: OrU3og
        version_id: 0bTKzDL
        url: https://semgrep.dev/playground/r/0bTKzDL/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces
        origin: community
  languages:
  - python
  severity: INFO
  pattern-either:
  - pattern: |
      $S = socket.socket(...)
      ...
      $S.bind(("0.0.0.0", ...))
  - pattern: |
      $S = socket.socket(...)
      ...
      $S.bind(("::", ...))
  - pattern: |
      $S = socket.socket(...)
      ...
      $S.bind(("", ...))
- id: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection
  message: Detected HTTPConnectionPool. This will transmit data in cleartext. It is
    recommended to use HTTPSConnectionPool instead for to encrypt communications.
  metadata:
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    references:
    - https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool
    category: security
    technology:
    - python
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mishandled Sensitive Information
    source: https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection
    shortlink: https://sg.run/N4Np
    semgrep.dev:
      rule:
        r_id: 9671
        rv_id: 1263507
        rule_id: v8UnWQ
        version_id: qkTR7E1
        url: https://semgrep.dev/playground/r/qkTR7E1/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection
        origin: community
  languages:
  - python
  severity: ERROR
  pattern-either:
  - pattern: urllib3.HTTPConnectionPool(...)
  - pattern: urllib3.connectionpool.HTTPConnectionPool(...)
- id: python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key
  patterns:
  - pattern-inside: |
      $CLIENT = paramiko.client.SSHClient(...)
      ...
      $CLIENT.set_missing_host_key_policy(...)
  - pattern-either:
    - pattern: paramiko.client.AutoAddPolicy
    - pattern: paramiko.client.WarningPolicy
  message: Detected a paramiko host key policy that implicitly trusts a server's host
    key. Host keys should be verified to ensure the connection is not to a malicious
    server. Use RejectPolicy or a custom subclass instead.
  metadata:
    cwe:
    - 'CWE-322: Key Exchange without Entity Authentication'
    owasp:
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/ssh_no_host_key_verification.py
    references:
    - http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy
    category: security
    technology:
    - paramiko
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key
    shortlink: https://sg.run/4xpl
    semgrep.dev:
      rule:
        r_id: 9644
        rv_id: 1263510
        rule_id: AbUzbe
        version_id: JdTzxEQ
        url: https://semgrep.dev/playground/r/JdTzxEQ/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command
  patterns:
  - pattern-inside: |
      $CLIENT = paramiko.client.SSHClient(...)
      ...
  - pattern: $CLIENT.exec_command(...)
  - pattern-not: $CLIENT.exec_command("...", ...)
  message: Unverified SSL context detected. This will permit insecure connections
    without verifying SSL certificates. Use 'ssl.create_default_context()' instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    references:
    - http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command
    - https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py
    category: security
    technology:
    - paramiko
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command
    shortlink: https://sg.run/kXQ7
    semgrep.dev:
      rule:
        r_id: 9672
        rv_id: 1263509
        rule_id: d8Uj9x
        version_id: YDTZeBr
        url: https://semgrep.dev/playground/r/YDTZeBr/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command
        origin: community
  severity: ERROR
  languages:
  - python
- id: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated
  pattern: ssl.wrap_socket(...)
  message: '''ssl.wrap_socket()'' is deprecated. This function creates an insecure
    socket without server name indication or hostname matching. Instead, create an
    SSL context using ''ssl.SSLContext()'' and use that to wrap a socket.'
  metadata:
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    references:
    - https://docs.python.org/3/library/ssl.html#ssl.wrap_socket
    - https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket
    category: security
    technology:
    - python
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated
    shortlink: https://sg.run/PJOY
    semgrep.dev:
      rule:
        r_id: 9645
        rv_id: 1263516
        rule_id: BYUN2e
        version_id: DkTRbgn
        url: https://semgrep.dev/playground/r/DkTRbgn/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
  patterns:
  - pattern: subprocess.$FUNC(..., shell=$TRUE, ...)
  - metavariable-pattern:
      metavariable: $TRUE
      pattern: "True \n"
  - pattern-not: subprocess.$FUNC("...", shell=True, ...)
  - focus-metavariable: $TRUE
  message: Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous
    because this call will spawn the command using a shell process. Doing so propagates
    current shell settings and variables, which makes it much easier for a malicious
    actor to execute commands. Use 'shell=False' instead.
  fix: |
    False
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    references:
    - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess
    - https://docs.python.org/3/library/subprocess.html
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - secure default
    likelihood: HIGH
    impact: LOW
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
    shortlink: https://sg.run/J92w
    semgrep.dev:
      rule:
        r_id: 9646
        rv_id: 1263518
        rule_id: DbUpz2
        version_id: 0bTKzDK
        url: https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
        origin: community
  languages:
  - python
  severity: ERROR
- id: python.lang.security.audit.system-wildcard-detected.system-wildcard-detected
  patterns:
  - pattern-either:
    - pattern-inside: os.system("...")
    - pattern-inside: os.popen("...")
    - pattern-inside: os.popen2("...")
    - pattern-inside: os.popen3("...")
    - pattern-inside: os.popen4("...")
    - pattern-inside: subprocess.$W(..., shell=True, ...)
  - pattern-regex: (tar|chmod|chown|rsync)(.*?)\*
  message: Detected use of the wildcard character in a system call that spawns a shell.
    This subjects the wildcard to normal shell expansion, which can have unintended
    consequences if there exist any non-standard file names. Consider a file named
    '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt
    for more information.
  metadata:
    cwe:
    - 'CWE-155: Improper Neutralization of Wildcards or Matching Symbols'
    owasp: A01:2017 - Injection
    source-url-open: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/injection_wildcard.py
    references:
    - https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt
    category: security
    technology:
    - python
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected
    shortlink: https://sg.run/5QXA
    semgrep.dev:
      rule:
        r_id: 9647
        rv_id: 946383
        rule_id: WAUorE
        version_id: 6xTxj9B
        url: https://semgrep.dev/playground/r/6xTxj9B/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected
        origin: community
  languages:
  - python
  severity: WARNING
- id: python.lang.security.audit.telnetlib.telnetlib
  pattern: telnetlib.$ANYTHING(...)
  message: Telnet does not encrypt communications. Use SSH instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L208
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    bandit-code: B312
    references:
    - https://docs.python.org/3/library/telnetlib.html
    category: security
    technology:
    - python
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mishandled Sensitive Information
    source: https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib
    shortlink: https://sg.run/Gelp
    semgrep.dev:
      rule:
        r_id: 9648
        rv_id: 1263519
        rule_id: 0oU5Wl
        version_id: K3TKkZo
        url: https://semgrep.dev/playground/r/K3TKkZo/python.lang.security.audit.telnetlib.telnetlib
        origin: community
  severity: WARNING
  languages:
  - python
- id: python.lang.security.audit.weak-ssl-version.weak-ssl-version
  message: An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL
    versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2'
    or higher.
  metadata:
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/insecure_ssl_tls.py#L30
    asvs:
      section: V9 Communications Verification Requirements
      control_id: 9.1.3 Weak TLS
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements
      version: '4'
    references:
    - https://tools.ietf.org/html/rfc7568
    - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html
    - https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2
    category: security
    technology:
    - python
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version
    shortlink: https://sg.run/RoZO
    semgrep.dev:
      rule:
        r_id: 9649
        rv_id: 1263520
        rule_id: KxUbNG
        version_id: qkTR7Ev
        url: https://semgrep.dev/playground/r/qkTR7Ev/python.lang.security.audit.weak-ssl-version.weak-ssl-version
        origin: community
  languages:
  - python
  severity: WARNING
  pattern-either:
  - pattern: ssl.PROTOCOL_SSLv2
  - pattern: ssl.PROTOCOL_SSLv3
  - pattern: ssl.PROTOCOL_TLSv1
  - pattern: ssl.PROTOCOL_TLSv1_1
  - pattern: pyOpenSSL.SSL.SSLv2_METHOD
  - pattern: pyOpenSSL.SSL.SSLv23_METHOD
  - pattern: pyOpenSSL.SSL.SSLv3_METHOD
  - pattern: pyOpenSSL.SSL.TLSv1_METHOD
  - pattern: pyOpenSSL.SSL.TLSv1_1_METHOD
- id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
    - https://nvd.nist.gov/vuln/detail/CVE-2017-18342
    category: security
    technology:
    - pyyaml
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
    shortlink: https://sg.run/we9Y
    semgrep.dev:
      rule:
        r_id: 9673
        rv_id: 1263530
        rule_id: ZqU5jZ
        version_id: 1QTyprw
        url: https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
        origin: community
  languages:
  - python
  message: Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`,
    `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe
    methods of deserializing YAML. An attacker with control over the YAML input could
    create special YAML input that allows the attacker to run arbitrary Python code.
    This would allow the attacker to steal files, download and install malware, or
    otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead.
  fix-regex:
    regex: unsafe_load
    replacement: safe_load
    count: 1
  severity: ERROR
  patterns:
  - pattern-inside: |
      import yaml
      ...
  - pattern-not-inside: |
      $YAML = ruamel.yaml.YAML(...)
      ...
  - pattern-either:
    - pattern: yaml.unsafe_load(...)
    - pattern: yaml.load(..., Loader=yaml.Loader, ...)
    - pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...)
    - pattern: yaml.load(..., Loader=yaml.CLoader, ...)
    - pattern: yaml.load_all(..., Loader=yaml.Loader, ...)
    - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...)
    - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...)
- id: python.lang.security.deserialization.pickle.avoid-cPickle
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle
    shortlink: https://sg.run/eLxb
    semgrep.dev:
      rule:
        r_id: 9676
        rv_id: 1263533
        rule_id: 7KUQNL
        version_id: rxTAKEq
        url: https://semgrep.dev/playground/r/rxTAKEq/python.lang.security.deserialization.pickle.avoid-cPickle
        origin: community
  languages:
  - python
  message: Avoid using `cPickle`, which is known to lead to code execution vulnerabilities.
    When unpickling, the serialized data could be manipulated to run arbitrary code.
    Instead, consider serializing the relevant data as JSON or a similar text-based
    serialization format.
  severity: WARNING
  patterns:
  - pattern: cPickle.$FUNC(...)
  - pattern-not: cPickle.$FUNC("...")
- id: python.lang.security.deserialization.pickle.avoid-dill
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill
    shortlink: https://sg.run/vzjA
    semgrep.dev:
      rule:
        r_id: 9677
        rv_id: 1263534
        rule_id: L1Uy60
        version_id: bZT53np
        url: https://semgrep.dev/playground/r/bZT53np/python.lang.security.deserialization.pickle.avoid-dill
        origin: community
  languages:
  - python
  message: Avoid using `dill`, which uses `pickle`, which is known to lead to code
    execution vulnerabilities. When unpickling, the serialized data could be manipulated
    to run arbitrary code. Instead, consider serializing the relevant data as JSON
    or a similar text-based serialization format.
  severity: WARNING
  patterns:
  - pattern: dill.$FUNC(...)
  - pattern-not: dill.$FUNC("...")
- id: python.lang.security.deserialization.pickle.avoid-pickle
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle
    shortlink: https://sg.run/OPwB
    semgrep.dev:
      rule:
        r_id: 9675
        rv_id: 1263532
        rule_id: EwU2BJ
        version_id: yeTxpEE
        url: https://semgrep.dev/playground/r/yeTxpEE/python.lang.security.deserialization.pickle.avoid-pickle
        origin: community
  languages:
  - python
  message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities.
    When unpickling, the serialized data could be manipulated to run arbitrary code.
    Instead, consider serializing the relevant data as JSON or a similar text-based
    serialization format.
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: pickle.$FUNC(...)
    - pattern: _pickle.$FUNC(...)
  - pattern-not: pickle.$FUNC("...")
  - pattern-not: _pickle.$FUNC("...")
- id: python.lang.security.deserialization.pickle.avoid-shelve
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve
    shortlink: https://sg.run/dKkZ
    semgrep.dev:
      rule:
        r_id: 9678
        rv_id: 1263535
        rule_id: 8GUje2
        version_id: NdTzyb4
        url: https://semgrep.dev/playground/r/NdTzyb4/python.lang.security.deserialization.pickle.avoid-shelve
        origin: community
  languages:
  - python
  message: Avoid using `shelve`, which uses `pickle`, which is known to lead to code
    execution vulnerabilities. When unpickling, the serialized data could be manipulated
    to run arbitrary code. Instead, consider serializing the relevant data as JSON
    or a similar text-based serialization format.
  severity: WARNING
  pattern: shelve.$FUNC(...)
- id: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
  pattern: hashlib.sha1(...)
  fix-regex:
    regex: sha1
    replacement: sha256
  message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
    collision resistant and is therefore not suitable as a cryptographic signature.
    Use SHA256 or SHA3 instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    bandit-code: B303
    asvs:
      section: V6 Stored Cryptography Verification Requirements
      control_id: 6.2.2 Insecure Custom Algorithm
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
      version: '4'
    references:
    - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
    - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
    - http://2012.sharcs.org/slides/stevens.pdf
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    category: security
    technology:
    - python
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
    shortlink: https://sg.run/ydYx
    semgrep.dev:
      rule:
        r_id: 9624
        rv_id: 1263537
        rule_id: x8UnBk
        version_id: w8TRoE7
        url: https://semgrep.dev/playground/r/w8TRoE7/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
        origin: community
  severity: WARNING
  languages:
  - python
- id: python.lang.security.insecure-hash-function.insecure-hash-function
  message: Detected use of an insecure MD4 or MD5 hash function. These functions have
    known vulnerabilities and are considered deprecated. Consider using 'SHA256' or
    a similar function instead.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/hashlib_new_insecure_functions.py
    asvs:
      section: V6 Stored Cryptography Verification Requirements
      control_id: 6.2.2 Insecure Custom Algorithm
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
      version: '4'
    references:
    - https://tools.ietf.org/html/rfc6151
    - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    category: security
    technology:
    - python
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function
    shortlink: https://sg.run/rdBn
    semgrep.dev:
      rule:
        r_id: 9625
        rv_id: 1263538
        rule_id: OrU30g
        version_id: xyTjzEe
        url: https://semgrep.dev/playground/r/xyTjzEe/python.lang.security.insecure-hash-function.insecure-hash-function
        origin: community
  languages:
  - python
  severity: WARNING
  pattern-either:
  - pattern: hashlib.new("=~/[M|m][D|d][4|5]/", ...)
  - pattern: hashlib.new(..., name="=~/[M|m][D|d][4|5]/", ...)
- id: python.lang.security.unverified-ssl-context.unverified-ssl-context
  patterns:
  - pattern-either:
    - pattern: ssl._create_unverified_context(...)
    - pattern: ssl._create_default_https_context = ssl._create_unverified_context
  fix-regex:
    regex: _create_unverified_context
    replacement: create_default_context
  message: Unverified SSL context detected. This will permit insecure connections
    without verifying SSL certificates. Use 'ssl.create_default_context' instead.
  metadata:
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    cwe:
    - 'CWE-295: Improper Certificate Validation'
    references:
    - https://docs.python.org/3/library/ssl.html#ssl-security
    - https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection
    category: security
    technology:
    - python
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context
    shortlink: https://sg.run/N4lp
    semgrep.dev:
      rule:
        r_id: 9627
        rv_id: 1263540
        rule_id: v8UnkQ
        version_id: e1Tyjlj
        url: https://semgrep.dev/playground/r/e1Tyjlj/python.lang.security.unverified-ssl-context.unverified-ssl-context
        origin: community
  severity: ERROR
  languages:
  - python
- id: python.lang.security.use-defused-xml.use-defused-xml
  metadata:
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    references:
    - https://docs.python.org/3/library/xml.html
    - https://github.com/tiran/defusedxml
    - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
    category: security
    technology:
    - python
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/python.lang.security.use-defused-xml.use-defused-xml
    shortlink: https://sg.run/kX47
    semgrep.dev:
      rule:
        r_id: 9628
        rv_id: 1263542
        rule_id: d8UjRx
        version_id: d6TyxoZ
        url: https://semgrep.dev/playground/r/d6TyxoZ/python.lang.security.use-defused-xml.use-defused-xml
        origin: community
  message: The Python documentation recommends using `defusedxml` instead of `xml`
    because the native Python `xml` library is vulnerable to XML External Entity (XXE)
    attacks. These attacks can leak confidential data and "XML bombs" can cause denial
    of service.
  languages:
  - python
  severity: ERROR
  pattern: import xml
- id: python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc
  pattern-either:
  - pattern: import xmlrpclib
  - pattern: import SimpleXMLRPCServer
  - pattern: import xmlrpc
  message: Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities.
    Use defusedxml.xmlrpc instead.
  metadata:
    cwe:
    - 'CWE-776: Improper Restriction of Recursive Entity References in DTDs (''XML
      Entity Expansion'')'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    source-rule-url: https://github.com/PyCQA/bandit/blob/07f84cb5f5e7c1055e6feaa0fe93afa471de0ac3/bandit/blacklists/imports.py#L160
    references:
    - https://pypi.org/project/defusedxml/
    - https://docs.python.org/3/library/xml.html#xml-vulnerabilities
    category: security
    technology:
    - python
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XML Injection
    source: https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc
    shortlink: https://sg.run/weqY
    semgrep.dev:
      rule:
        r_id: 9629
        rv_id: 1263543
        rule_id: ZqU5EZ
        version_id: ZRTKA8z
        url: https://semgrep.dev/playground/r/ZRTKA8z/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc
        origin: community
  severity: ERROR
  languages:
  - python
- id: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor
  message: Detected XOR cipher algorithm which is considered insecure. This algorithm
    is not cryptographically secure and can be reversed easily. Use AES instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    bandit-code: B304
    references:
    - https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption
    category: security
    technology:
    - pycryptodome
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor
    shortlink: https://sg.run/L0yr
    semgrep.dev:
      rule:
        r_id: 9683
        rv_id: 1263549
        rule_id: PeUk5W
        version_id: gETB7j3
        url: https://semgrep.dev/playground/r/gETB7j3/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor
        origin: community
  severity: WARNING
  languages:
  - python
  pattern-either:
  - pattern: Cryptodome.Cipher.XOR.new(...)
  - pattern: Crypto.Cipher.XOR.new(...)
- id: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1
  message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
    collision resistant and is therefore not suitable as a cryptographic signature.
    Use SHA256 or SHA3 instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    references:
    - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
    - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
    - http://2012.sharcs.org/slides/stevens.pdf
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    category: security
    technology:
    - pycryptodome
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1
    shortlink: https://sg.run/3ALr
    semgrep.dev:
      rule:
        r_id: 9687
        rv_id: 1263553
        rule_id: ReUPO3
        version_id: PkTR3vk
        url: https://semgrep.dev/playground/r/PkTR3vk/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1
        origin: community
  severity: WARNING
  languages:
  - python
  pattern-either:
  - pattern: Crypto.Hash.SHA.new(...)
  - pattern: Cryptodome.Hash.SHA.new (...)
- id: python.requests.security.disabled-cert-validation.disabled-cert-validation
  message: Certificate verification has been explicitly disabled. This permits insecure
    connections to insecure servers. Re-enable certification validation.
  metadata:
    cwe:
    - 'CWE-295: Improper Certificate Validation'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    references:
    - https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib
    category: security
    technology:
    - requests
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation
    shortlink: https://sg.run/AlYp
    semgrep.dev:
      rule:
        r_id: 9694
        rv_id: 1263574
        rule_id: qNUoYR
        version_id: 1QTypBw
        url: https://semgrep.dev/playground/r/1QTypBw/python.requests.security.disabled-cert-validation.disabled-cert-validation
        origin: community
  languages:
  - python
  severity: ERROR
  pattern-either:
  - pattern: requests.put(..., verify=False, ...)
  - pattern: requests.patch(..., verify=False, ...)
  - pattern: requests.delete(..., verify=False, ...)
  - pattern: requests.head(..., verify=False, ...)
  - pattern: requests.options(..., verify=False, ...)
  - pattern: requests.request(..., verify=False, ...)
  - pattern: requests.get(..., verify=False, ...)
  - pattern: requests.post(..., verify=False, ...)
  fix-regex:
    regex: verify(\s)*=(\s)*False
    replacement: verify=True
- id: python.requests.security.no-auth-over-http.no-auth-over-http
  fix-regex:
    regex: http:\/\/
    replacement: https://
    count: 1
  message: Authentication detected over HTTP. HTTP does not provide any encryption
    or protection for these authentication credentials. This may expose these credentials
    to unauthorized parties. Use 'https://' instead.
  metadata:
    cwe:
    - 'CWE-523: Unprotected Transport of Credentials'
    owasp:
    - A02:2017 - Broken Authentication
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://pypi.org/project/flake8-flask/
    references:
    - https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/
    - https://bento.dev/checks/requests/no-auth-over-http/
    category: security
    technology:
    - requests
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mishandled Sensitive Information
    source: https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http
    shortlink: https://sg.run/B4NW
    semgrep.dev:
      rule:
        r_id: 9695
        rv_id: 1263575
        rule_id: lBUdQZ
        version_id: 9lT4b2G
        url: https://semgrep.dev/playground/r/9lT4b2G/python.requests.security.no-auth-over-http.no-auth-over-http
        origin: community
  languages:
  - python
  severity: ERROR
  pattern-either:
  - pattern: requests.$W("=~/http:\/\/.*/", ..., auth=$X, ...)
  - pattern: |
      $URL = "=~/http:\/\/.../"
      ...
      requests.$W($URL, ..., auth=$X, ...)
- id: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection
  patterns:
  - pattern-either:
    - pattern: |
        def $FUNC(...,$VAR,...):
          ...
          $SESSION.query(...).$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
    - pattern: |
        def $FUNC(...,$VAR,...):
          ...
          $SESSION.query.join(...).$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
    - pattern: |
        def $FUNC(...,$VAR,...):
          ...
          $SESSION.query.$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
    - pattern: |
        def $FUNC(...,$VAR,...):
          ...
          query.$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
  - metavariable-regex:
      metavariable: $SQLFUNC
      regex: (group_by|order_by|distinct|having|filter)
  - metavariable-regex:
      metavariable: $FORMATFUNC
      regex: (?!bindparams)
  message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause
    sql injections if the developer inputs raw SQL into the before-mentioned clauses.
    This pattern captures relevant cases in which the developer inputs raw SQL into
    the distinct, having, group_by, order_by or filter clauses and injects user-input
    into the raw SQL with any function besides "bindparams". Use bindParams to securely
    bind user-input to SQL statements.
  fix-regex:
    regex: format
    replacement: bindparams
  languages:
  - python
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    category: security
    technology:
    - sqlalchemy
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection
    shortlink: https://sg.run/J3Xo
    semgrep.dev:
      rule:
        r_id: 9702
        rv_id: 1263579
        rule_id: BYUBWo
        version_id: NdTzyL4
        url: https://semgrep.dev/playground/r/NdTzyL4/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection
        origin: community
- id: ruby.lang.security.filter-skipping.filter-skipping
  patterns:
  - pattern-not: |
      $CALL "=~/.*(/:action.*).*/", $ACTION
  - pattern: |
      $CALL "=~/.*(/:action.*).*/"
  message: Checks for use of action in Ruby routes. This can cause Rails to render
    an arbitrary view if an attacker creates an URL accurately. Affects 3.0 applications.
    Can avoid the vulnerability by providing additional constraints.
  metadata:
    cwe:
    - 'CWE-1021: Improper Restriction of Rendered UI Layers or Frames'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_filter_skipping.rb
    - https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY
    category: security
    technology:
    - ruby
    owasp:
    - A04:2021 - Insecure Design
    - A06:2025 - Insecure Design
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/ruby.lang.security.filter-skipping.filter-skipping
    shortlink: https://sg.run/ljNL
    semgrep.dev:
      rule:
        r_id: 9713
        rv_id: 1263604
        rule_id: pKUGP7
        version_id: DkTRbln
        url: https://semgrep.dev/playground/r/DkTRbln/ruby.lang.security.filter-skipping.filter-skipping
        origin: community
  languages:
  - ruby
  severity: ERROR
- id: ruby.lang.security.bad-deserialization.bad-deserialization
  mode: taint
  pattern-sources:
  - pattern-either:
    - pattern: params
    - pattern: cookies
  pattern-sinks:
  - pattern-either:
    - pattern: |
        CSV.load(...)
    - pattern: |
        Marshal.load(...)
    - pattern: |
        Marshal.restore(...)
    - pattern: |
        Oj.object_load(...)
    - pattern: |
        Oj.load($X)
  message: Checks for unsafe deserialization. Objects in Ruby can be serialized into
    strings, then later loaded from strings. However, uses of load and object_load
    can cause remote code execution. Loading user input with MARSHAL or CSV can potentially
    be dangerous. Use JSON in a secure fashion instead.
  metadata:
    references:
    - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb
    category: security
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    technology:
    - ruby
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - 'Insecure Deserialization '
    source: https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization
    shortlink: https://sg.run/DJj2
    semgrep.dev:
      rule:
        r_id: 9708
        rv_id: 1263595
        rule_id: lBUdQg
        version_id: 3ZT4Xqp
        url: https://semgrep.dev/playground/r/3ZT4Xqp/ruby.lang.security.bad-deserialization.bad-deserialization
        origin: community
  languages:
  - ruby
  severity: ERROR
- id: ruby.lang.security.divide-by-zero.divide-by-zero
  message: Detected a possible ZeroDivisionError.
  metadata:
    cwe:
    - 'CWE-369: Divide By Zero'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb
    category: security
    technology:
    - ruby
    confidence: MEDIUM
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero
    shortlink: https://sg.run/KWpP
    semgrep.dev:
      rule:
        r_id: 9711
        rv_id: 946476
        rule_id: oqUzXA
        version_id: BjT1NPZ
        url: https://semgrep.dev/playground/r/BjT1NPZ/ruby.lang.security.divide-by-zero.divide-by-zero
        origin: community
  languages:
  - ruby
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: $VAR
    - metavariable-regex:
        metavariable: $VAR
        regex: ^\d*(?!\.)$
  pattern-sinks:
  - patterns:
    - pattern-inside: $NUMER / 0
    - pattern: $NUMER
- id: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
  patterns:
  - pattern-inside: |
      class $CONTROLLER < ApplicationController
        ...
        http_basic_authenticate_with ..., :password => "$SECRET", ...
      end
  - focus-metavariable: $SECRET
  message: Detected hardcoded password used in basic authentication in a controller
    class. Including this password in version control could expose this credential.
    Consider refactoring to use environment variables or configuration files.
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/basic_auth/index.markdown
    category: security
    technology:
    - ruby
    - secrets
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Hard-coded Secrets
    source: https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
    shortlink: https://sg.run/6r0w
    semgrep.dev:
      rule:
        r_id: 9715
        rv_id: 1263606
        rule_id: X5UZWK
        version_id: 0bTKzNK
        url: https://semgrep.dev/playground/r/0bTKzNK/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
        origin: community
  languages:
  - ruby
- id: ruby.lang.security.force-ssl-false.force-ssl-false
  message: Checks for configuration setting of force_ssl to false. Force_ssl forces
    usage of HTTPS, which could lead to network interception of unencrypted application
    traffic. To fix, set config.force_ssl = true.
  metadata:
    cwe:
    - 'CWE-311: Missing Encryption of Sensitive Data'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb
    category: security
    technology:
    - ruby
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A04:2021 - Insecure Design
    - A06:2025 - Insecure Design
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false
    shortlink: https://sg.run/YgkW
    semgrep.dev:
      rule:
        r_id: 9714
        rv_id: 1263605
        rule_id: 2ZU4lx
        version_id: WrTqKB3
        url: https://semgrep.dev/playground/r/WrTqKB3/ruby.lang.security.force-ssl-false.force-ssl-false
        origin: community
  languages:
  - ruby
  severity: WARNING
  pattern: config.force_ssl = false
  fix-regex:
    regex: =\s*false
    replacement: = true
- id: ruby.lang.security.cookie-serialization.cookie-serialization
  message: Checks if code allows cookies to be deserialized using Marshal. If the
    attacker can craft a valid cookie, this could lead to remote code execution. The
    hybrid check is just to warn users to migrate to :json for best practice.
  metadata:
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb
    - https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/
    category: security
    technology:
    - ruby
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe2022-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization
    shortlink: https://sg.run/Wg3y
    semgrep.dev:
      rule:
        r_id: 9709
        rv_id: 1263596
        rule_id: YGUrq5
        version_id: 44TEj4k
        url: https://semgrep.dev/playground/r/44TEj4k/ruby.lang.security.cookie-serialization.cookie-serialization
        origin: community
  languages:
  - ruby
  severity: ERROR
  pattern-either:
  - pattern: |
      Rails.application.config.action_dispatch.cookies_serializer = :marshal
  - pattern: |
      Rails.application.config.action_dispatch.cookies_serializer = :hybrid
- id: ruby.lang.security.file-disclosure.file-disclosure
  message: Special requests can determine whether a file exists on a filesystem that's
    outside the Rails app's root directory. To fix this, set config.serve_static_assets
    = false.
  metadata:
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb
    - https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ
    category: security
    technology:
    - ruby
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure
    shortlink: https://sg.run/qrR1
    semgrep.dev:
      rule:
        r_id: 9712
        rv_id: 1263603
        rule_id: zdUyqE
        version_id: BjTkZq1
        url: https://semgrep.dev/playground/r/BjTkZq1/ruby.lang.security.file-disclosure.file-disclosure
        origin: community
  languages:
  - ruby
  severity: ERROR
  pattern: config.serve_static_assets = true
  fix-regex:
    regex: =(\s)*true
    replacement: = false
- id: ruby.lang.security.create-with.create-with
  patterns:
  - pattern-not: |
      $FUNC.create_with($PARAMSB.permit(...))
  - pattern: |
      $FUNC.create_with($PARAMSA)
  message: Checks for strong parameter bypass through usage of create_with. Create_with
    bypasses strong parameter protection, which could allow attackers to set arbitrary
    attributes on models. To fix this vulnerability, either remove all create_with
    calls or use the permit function to specify tags that are allowed to be set.
  metadata:
    cwe:
    - 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
      Attributes'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb
    - https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ
    category: security
    technology:
    - ruby
    owasp:
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mass Assignment
    source: https://semgrep.dev/r/ruby.lang.security.create-with.create-with
    shortlink: https://sg.run/0nLk
    semgrep.dev:
      rule:
        r_id: 9710
        rv_id: 1263597
        rule_id: 6JUqbn
        version_id: PkTR34k
        url: https://semgrep.dev/playground/r/PkTR34k/ruby.lang.security.create-with.create-with
        origin: community
  languages:
  - ruby
  severity: ERROR
- id: ruby.lang.security.no-send.bad-send
  message: Checks for unsafe use of Object#send, try, __send__, and public_send. These
    only account for unsafe use of a method, not target. This can lead to arbitrary
    calling of exit, along with arbitrary code execution. Please be sure to sanitize
    input in order to avoid this.
  metadata:
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb
    - https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html
    category: security
    technology:
    - ruby
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe2022-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/ruby.lang.security.no-send.bad-send
    shortlink: https://sg.run/Nrbx
    semgrep.dev:
      rule:
        r_id: 9727
        rv_id: 1263616
        rule_id: eqUv0L
        version_id: BjTkZqj
        url: https://semgrep.dev/playground/r/BjTkZqj/ruby.lang.security.no-send.bad-send
        origin: community
  languages:
  - ruby
  severity: ERROR
  pattern-either:
  - pattern: |
      $PARAM = params[...]
      ...
      $RES = $MOD.send($PARAM.$FUNC)
  - pattern: |
      $PARAM = params[...]
      ...
      $RES = $MOD.try($PARAM.$FUNC)
  - pattern: |
      $PARAM = params[...]
      ...
      $RES = $MOD.__send__($PARAM.$FUNC)
  - pattern: |-
      $PARAM = params[...]
      ...
      $RES = $MOD.public_send($PARAM.$FUNC)
- id: ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled
  pattern: $MODEL.new(params[...], ..., :without_protection => true, ...)
  message: Mass assignment protection disabled for '$MODEL'. This could permit assignment
    to sensitive model fields without intention. Instead, use 'attr_accessible' for
    the model or disable mass assigment using 'config.active_record.whitelist_attributes
    = true'. ':without_protection => true' must be removed for this to take effect.
  metadata:
    cwe:
    - 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
      Attributes'
    owasp:
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/mass_assignment/index.markdown
    category: security
    technology:
    - ruby
    references:
    - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mass Assignment
    source: https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled
    shortlink: https://sg.run/2byz
    semgrep.dev:
      rule:
        r_id: 9719
        rv_id: 1263610
        rule_id: yyUvkJ
        version_id: YDTZeW4
        url: https://semgrep.dev/playground/r/YDTZeW4/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled
        origin: community
  severity: WARNING
  languages:
  - ruby
- id: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify
  pattern: OpenSSL::SSL::VERIFY_NONE
  message: Detected SSL that will accept an unverified connection. This makes the
    connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER'
    instead.
  fix-regex:
    regex: VERIFY_NONE
    replacement: VERIFY_PEER
  severity: WARNING
  languages:
  - ruby
  metadata:
    cwe:
    - 'CWE-295: Improper Certificate Validation'
    category: security
    technology:
    - ruby
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    references:
    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authentication
    source: https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify
    shortlink: https://sg.run/kLxX
    semgrep.dev:
      rule:
        r_id: 9728
        rv_id: 1263617
        rule_id: v8U5Yn
        version_id: DkTRbl4
        url: https://semgrep.dev/playground/r/DkTRbl4/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify
        origin: community
- id: ruby.lang.security.missing-csrf-protection.missing-csrf-protection
  patterns:
  - pattern: |
      class $CONTROLLER < ActionController::Base
        ...
      end
  - pattern-not: |
      class $CONTROLLER < ActionController::Base
        ...
        protect_from_forgery :with => :exception
      end
  - pattern-not: |
      class $CONTROLLER < ActionController::Base
        ...
        protect_from_forgery prepend: true, with: :exception
      end
  message: Detected controller which does not enable cross-site request forgery protections
    using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to
    your controller class.
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross-site_request_forgery/index.markdown
    category: security
    technology:
    - ruby
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site Request Forgery (CSRF)
    source: https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection
    shortlink: https://sg.run/XLel
    semgrep.dev:
      rule:
        r_id: 9720
        rv_id: 1263612
        rule_id: r6UkO5
        version_id: 5PTo1WY
        url: https://semgrep.dev/playground/r/5PTo1WY/ruby.lang.security.missing-csrf-protection.missing-csrf-protection
        origin: community
  languages:
  - ruby
- id: ruby.lang.security.weak-hashes-md5.weak-hashes-md5
  message: Should not use md5 to generate hashes. md5 is proven to be vulnerable through
    the use of brute-force attacks. Could also result in collisions, leading to potential
    collision attacks. Use SHA256 or other hashing functions instead.
  metadata:
    cwe:
    - 'CWE-328: Use of Weak Hash'
    references:
    - https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575
    category: security
    technology:
    - ruby
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Insecure Hashing Algorithm
    source: https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5
    shortlink: https://sg.run/O1re
    semgrep.dev:
      rule:
        r_id: 9731
        rv_id: 1263619
        rule_id: nJUYxZ
        version_id: 0bTKzN8
        url: https://semgrep.dev/playground/r/0bTKzN8/ruby.lang.security.weak-hashes-md5.weak-hashes-md5
        origin: community
  languages:
  - ruby
  severity: WARNING
  pattern-either:
  - pattern: Digest::MD5.base64digest $X
  - pattern: Digest::MD5.hexdigest $X
  - pattern: Digest::MD5.digest $X
  - pattern: Digest::MD5.new
  - pattern: OpenSSL::Digest::MD5.base64digest $X
  - pattern: OpenSSL::Digest::MD5.hexdigest $X
  - pattern: OpenSSL::Digest::MD5.digest $X
  - pattern: OpenSSL::Digest::MD5.new
- id: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1
  message: Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision
    by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing
    functions instead.
  metadata:
    cwe:
    - 'CWE-328: Use of Weak Hash'
    references:
    - https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html
    - https://shattered.io/
    category: security
    technology:
    - ruby
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Insecure Hashing Algorithm
    source: https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1
    shortlink: https://sg.run/e4qX
    semgrep.dev:
      rule:
        r_id: 9732
        rv_id: 1263620
        rule_id: EwU4jq
        version_id: K3TKkEZ
        url: https://semgrep.dev/playground/r/K3TKkEZ/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1
        origin: community
  languages:
  - ruby
  severity: WARNING
  pattern-either:
  - pattern: Digest::SHA1.$FUNC
  - pattern: OpenSSL::Digest::SHA1.$FUNC
  - pattern: OpenSSL::HMAC.$FUNC("sha1",...)
- id: ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln
  patterns:
  - pattern-either:
    - pattern: |
        $MOD.new(params[$CODE])
    - pattern: |
        $MOD.new(..., params[$CODE], :without_protection => true, ...)
  - pattern-not-inside: |
      attr_accessible $VAR
      ...
      $MOD.new(params[$CODE])
  message: 'Checks for calls to without_protection during mass assignment (which allows
    record creation from hash values). This can lead to users bypassing permissions
    protections. For Rails 4 and higher, mass protection is on by default. Fix: Don''t
    use :without_protection => true. Instead, configure attr_accessible to control
    attribute access.'
  metadata:
    owasp:
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
      Attributes'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb
    - https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/
    category: security
    technology:
    - ruby
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mass Assignment
    source: https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln
    shortlink: https://sg.run/xY8e
    semgrep.dev:
      rule:
        r_id: 9730
        rv_id: 1263618
        rule_id: ZqUqQg
        version_id: WrTqKBA
        url: https://semgrep.dev/playground/r/WrTqKBA/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln
        origin: community
  languages:
  - ruby
  severity: WARNING
- id: typescript.react.security.react-insecure-request.react-insecure-request
  message: Unencrypted request over HTTP detected.
  metadata:
    vulnerability: Insecure Transport
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    references:
    - https://www.npmjs.com/package/axios
    category: security
    technology:
    - react
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mishandled Sensitive Information
    source: https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request
    shortlink: https://sg.run/1n0b
    semgrep.dev:
      rule:
        r_id: 9766
        rv_id: 1263918
        rule_id: NbUA3O
        version_id: A8Tgd2p
        url: https://semgrep.dev/playground/r/A8Tgd2p/typescript.react.security.react-insecure-request.react-insecure-request
        origin: community
  languages:
  - typescript
  - javascript
  severity: ERROR
  patterns:
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern-inside: |
            import $AXIOS from 'axios';
            ...
            $AXIOS.$METHOD(...)
        - pattern-inside: |
            $AXIOS = require('axios');
            ...
            $AXIOS.$METHOD(...)
      - pattern: $AXIOS.$VERB("$URL",...)
      - metavariable-regex:
          metavariable: $VERB
          regex: ^(get|post|delete|head|patch|put|options)
    - patterns:
      - pattern-either:
        - pattern-inside: |
            import $AXIOS from 'axios';
            ...
            $AXIOS(...)
        - pattern-inside: |
            $AXIOS = require('axios');
            ...
            $AXIOS(...)
      - pattern-either:
        - pattern: '$AXIOS({url: "$URL"}, ...)'
        - pattern: |
            $OPTS = {url: "$URL"}
            ...
            $AXIOS($OPTS, ...)
    - pattern: fetch("$URL", ...)
  - metavariable-regex:
      metavariable: $URL
      regex: ^([Hh][Tt][Tt][Pp]:\/\/(?!localhost).*)
- id: typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html
  message: Overwriting `transformLinkUri` or `transformImageUri` to something insecure,
    or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the
    code up to XSS vectors.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://www.npmjs.com/package/react-markdown#security
    category: security
    technology:
    - react
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html
    shortlink: https://sg.run/9qAk
    semgrep.dev:
      rule:
        r_id: 9767
        rv_id: 1263919
        rule_id: kxURd4
        version_id: BjTkZA8
        url: https://semgrep.dev/playground/r/BjTkZA8/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html
        origin: community
  languages:
  - typescript
  - javascript
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern-inside: |
        $X = require('react-markdown/with-html');
        ...
    - pattern-inside: |
        $X = require('react-markdown');
        ...
    - pattern-inside: |
        import 'react-markdown/with-html';
        ...
    - pattern-inside: |
        import 'react-markdown';
        ...
  - pattern-either:
    - pattern: |
        <$EL allowDangerousHtml />
    - pattern: |
        <$EL escapeHtml={false} />
    - pattern: |
        <$EL transformLinkUri=... />
    - pattern: |
        <$EL transformImageUri=... />
- id: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml
  message: Detection of dangerouslySetInnerHTML from non-constant definition. This
    can inadvertently expose users to cross-site scripting (XSS) attacks if this comes
    from user-provided input. If you have to use dangerouslySetInnerHTML, consider
    using a sanitization library such as DOMPurify to sanitize your HTML.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html
    category: security
    confidence: MEDIUM
    technology:
    - react
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml
    shortlink: https://sg.run/rAx6
    semgrep.dev:
      rule:
        r_id: 9769
        rv_id: 1263912
        rule_id: x8UWvK
        version_id: l4TJR0v
        url: https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml
        origin: community
  languages:
  - typescript
  - javascript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          function ...({..., $X, ...}) { ... }
      - pattern-inside: |
          function ...(..., $X, ...) { ... }
    - focus-metavariable: $X
    - pattern-not-inside: |
        $F. ... .$SANITIZEUNC(...)
  pattern-sinks:
  - patterns:
    - focus-metavariable: $X
    - pattern-either:
      - pattern: |
          {...,dangerouslySetInnerHTML: {__html: $X},...}
      - pattern: |
          <$Y ... dangerouslySetInnerHTML={{__html: $X}} />
    - pattern-not: |
        <$Y ... dangerouslySetInnerHTML={{__html: "..."}} />
    - pattern-not: |
        {...,dangerouslySetInnerHTML:{__html: "..."},...}
    - metavariable-pattern:
        patterns:
        - pattern-not: |
            {...}
        metavariable: $X
    - pattern-not: |
        <... {__html: "..."} ...>
    - pattern-not: |
        <... {__html: `...`} ...>
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          import * as $S from "underscore.string"
          ...
      - pattern-inside: |
          import $S from "underscore.string"
          ...
      - pattern-inside: |
          $S = require("underscore.string")
          ...
    - pattern-either:
      - pattern: $S.escapeHTML(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from "dompurify"
          ...
      - pattern-inside: |
          import { ..., $S,... } from "dompurify"
          ...
      - pattern-inside: |
          import * as $S from "dompurify"
          ...
      - pattern-inside: |
          $S = require("dompurify")
          ...
      - pattern-inside: |
          import $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          import * as $S from "isomorphic-dompurify"
          ...
      - pattern-inside: |
          $S = require("isomorphic-dompurify")
          ...
    - pattern-either:
      - patterns:
        - pattern-inside: |
            $VALUE = $S(...)
            ...
        - pattern: $VALUE.sanitize(...)
      - patterns:
        - pattern-inside: |
            $VALUE = $S.sanitize
            ...
        - pattern: $S(...)
      - pattern: $S.sanitize(...)
      - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'xss';
          ...
      - pattern-inside: |
          import * as $S from 'xss';
          ...
      - pattern-inside: |
          $S = require("xss")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $S from 'sanitize-html';
          ...
      - pattern-inside: |
          import * as $S from "sanitize-html";
          ...
      - pattern-inside: |
          $S = require("sanitize-html")
          ...
    - pattern: $S(...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $S = new Remarkable()
          ...
    - pattern: $S.render(...)
- id: json.aws.security.public-s3-policy-statement.public-s3-policy-statement
  pattern: |
    {
      "Effect": "Allow",
      "Principal": "*",
      "Resource": [
        ..., "=~/arn:aws:s3.*/", ...
      ],
      ...
    }
  message: Detected public S3 bucket policy. This policy allows anyone to access certain
    properties of or items in the bucket. Do not do this unless you will never have
    sensitive data inside the bucket.
  metadata:
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe:
    - 'CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls'
    references:
    - https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html
    category: security
    technology:
    - aws
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Authorization
    source: https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement
    shortlink: https://sg.run/Yv1d
    semgrep.dev:
      rule:
        r_id: 9358
        rv_id: 1263255
        rule_id: 9AU1br
        version_id: A8Tgdxq
        url: https://semgrep.dev/playground/r/A8Tgdxq/json.aws.security.public-s3-policy-statement.public-s3-policy-statement
        origin: community
  severity: WARNING
  languages:
  - json
- id: terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled
  patterns:
  - pattern: |
      resource
  - pattern-inside: |
      resource "aws_eks_cluster" "..." {...}
  - pattern-not-inside: |
      resource "aws_eks_cluster" "..."{
        ...
        vpc_config{
          ...
          endpoint_public_access = false
          ...
        }
        ...
      }
  languages:
  - hcl
  message: The vpc_config resource inside the eks cluster has not explicitly disabled
    public endpoint access
  severity: WARNING
  metadata:
    category: security
    cwe:
    - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    technology:
    - terraform
    - aws
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mishandled Sensitive Information
    source: https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled
    shortlink: https://sg.run/Albg
    semgrep.dev:
      rule:
        r_id: 9750
        rv_id: 1263887
        rule_id: KxU4v6
        version_id: e1TyjjB
        url: https://semgrep.dev/playground/r/e1TyjjB/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled
        origin: community
- id: terraform.lang.security.s3-cors-all-origins.all-origins-allowed
  patterns:
  - pattern-inside: cors_rule { ... }
  - pattern: allowed_origins = ["*"]
  languages:
  - hcl
  severity: WARNING
  message: CORS rule on bucket permits any origin
  metadata:
    references:
    - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors
    cwe:
    - 'CWE-942: Permissive Cross-domain Policy with Untrusted Domains'
    category: security
    technology:
    - terraform
    - aws
    owasp:
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Validation
    source: https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed
    shortlink: https://sg.run/DJb2
    semgrep.dev:
      rule:
        r_id: 9752
        rv_id: 1263898
        rule_id: lBUd4g
        version_id: 3ZT4XXJ
        url: https://semgrep.dev/playground/r/3ZT4XXJ/terraform.lang.security.s3-cors-all-origins.all-origins-allowed
        origin: community
- id: terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket
  pattern: acl = "public-read-write"
  languages:
  - hcl
  severity: ERROR
  message: S3 bucket with public read-write access detected.
  metadata:
    references:
    - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl
    - https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl
    cwe:
    - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    category: security
    technology:
    - terraform
    - aws
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mishandled Sensitive Information
    source: https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket
    shortlink: https://sg.run/0nok
    semgrep.dev:
      rule:
        r_id: 9754
        rv_id: 1263900
        rule_id: 6JUqvn
        version_id: PkTR3y5
        url: https://semgrep.dev/playground/r/PkTR3y5/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket
        origin: community
- id: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var
  message: 'Detected a unquoted template variable as an attribute. If unquoted, a
    malicious actor could inject custom JavaScript handlers. To fix this, add quotes
    around the template expression, like this: "{{ expr }}".'
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss
    category: security
    technology:
    - html-templates
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var
    shortlink: https://sg.run/weNX
    semgrep.dev:
      rule:
        r_id: 9029
        rv_id: 1262666
        rule_id: gxU1jy
        version_id: 9lT4bZK
        url: https://semgrep.dev/playground/r/9lT4bZK/generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var
        origin: community
  languages:
  - generic
  paths:
    include:
    - '*.html'
    - '*.mustache'
    - '*.hbs'
  severity: WARNING
  patterns:
  - pattern-inside: <$TAG ...>
  - pattern-not-inside: ="..."
  - pattern-not-inside: ='...'
  - pattern: '{{ ... }}'
  fix-regex:
    regex: '{{(.*?)}}'
    replacement: '"{{\1}}"'
- id: generic.html-templates.security.var-in-href.var-in-href
  message: Detected a template variable used in an anchor tag with the 'href' attribute.
    This allows a malicious actor to input the 'javascript:' URI and is subject to
    cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely
    generate a URL. If using Django, use the 'url' filter to safely generate a URL.
    If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable
    for relative links (`href="/{{link}}"`). You may also consider setting the Content
    Security Policy (CSP) header.
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI
    - https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#url
    - https://github.com/pugjs/pug/issues/2952
    - https://content-security-policy.com/
    category: security
    technology:
    - html-templates
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/generic.html-templates.security.var-in-href.var-in-href
    shortlink: https://sg.run/x1kP
    semgrep.dev:
      rule:
        r_id: 9030
        rv_id: 1262667
        rule_id: QrUzD1
        version_id: yeTxpAw
        url: https://semgrep.dev/playground/r/yeTxpAw/generic.html-templates.security.var-in-href.var-in-href
        origin: community
  languages:
  - generic
  paths:
    include:
    - '*.html'
    - '*.mustache'
    - '*.hbs'
  severity: WARNING
  patterns:
  - pattern-inside: <a ...>
  - pattern-either:
    - pattern: href = {{ ... }}
    - pattern: href = "{{ ... }}"
    - pattern: href = '{{ ... }}'
  - pattern-not-inside: href = {{ url_for(...) ... }}
  - pattern-not-inside: href = "{{ url_for(...) ... }}"
  - pattern-not-inside: href = '{{ url_for(...) ... }}'
  - pattern-not-inside: href = "/{{ ... }}"
  - pattern-not-inside: href = '/{{ ... }}'
- id: generic.html-templates.security.var-in-script-tag.var-in-script-tag
  message: Detected a template variable used in a script tag. Although template variables
    are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS)
    attacks when used directly in JavaScript. If you need this data on the rendered
    page, consider placing it in the HTML portion (outside of a script tag). Alternatively,
    use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For
    Django, you may also consider using the 'json_script' template tag and retrieving
    the data in your script by using the element ID (e.g., `document.getElementById`).
  metadata:
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://adamj.eu/tech/2020/02/18/safely-including-data-for-javascript-in-a-django-template/?utm_campaign=Django%2BNewsletter&utm_medium=rss&utm_source=Django_Newsletter_12A
    - https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough
    - https://github.com/ESAPI/owasp-esapi-js
    category: security
    technology:
    - html-templates
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/generic.html-templates.security.var-in-script-tag.var-in-script-tag
    shortlink: https://sg.run/eLWE
    semgrep.dev:
      rule:
        r_id: 9032
        rv_id: 1262669
        rule_id: 4bUkpl
        version_id: bZT53Bb
        url: https://semgrep.dev/playground/r/bZT53Bb/generic.html-templates.security.var-in-script-tag.var-in-script-tag
        origin: community
  languages:
  - generic
  paths:
    include:
    - '*.mustache'
    - '*.hbs'
    - '*.html'
  severity: WARNING
  patterns:
  - pattern-inside: <script ...> ... </script>
  - pattern-not-inside: <script ... $ATTR = "..." ...>
  - pattern-not-inside: <script ... $ATTR = '...' ...>
  - pattern: '{{ ... }}'
- id: generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host
  paths:
    include:
    - '*.conf'
    - '*.vhost'
    - '**/sites-available/*'
    - '**/sites-enabled/*'
  languages:
  - generic
  severity: WARNING
  message: The host for this proxy URL is dynamically determined. This can be dangerous
    if the host can be injected by an attacker because it may forcibly alter destination
    of the proxy. Consider hardcoding acceptable destinations and retrieving them
    with 'map' or something similar.
  metadata:
    source-rule-url: https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md
    references:
    - https://nginx.org/en/docs/http/ngx_http_map_module.html
    category: security
    technology:
    - nginx
    confidence: MEDIUM
    cwe:
    - 'CWE-441: Unintended Proxy or Intermediary (''Confused Deputy'')'
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Server-Side Request Forgery (SSRF)
    source: https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host
    shortlink: https://sg.run/ndpb
    semgrep.dev:
      rule:
        r_id: 9036
        rv_id: 1262671
        rule_id: GdU7yl
        version_id: kbTzG2j
        url: https://semgrep.dev/playground/r/kbTzG2j/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host
        origin: community
  pattern-either:
  - pattern: proxy_pass $SCHEME://$$HOST ...;
  - pattern: proxy_pass $$SCHEME://$$HOST ...;
- id: generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme
  paths:
    include:
    - '*.conf'
    - '*.vhost'
    - '**/sites-available/*'
    - '**/sites-enabled/*'
  languages:
  - generic
  severity: WARNING
  message: The protocol scheme for this proxy is dynamically determined. This can
    be dangerous if the scheme can be injected by an attacker because it may forcibly
    alter the connection scheme. Consider hardcoding a scheme for this proxy.
  metadata:
    cwe:
    - 'CWE-16: CWE CATEGORY: Configuration'
    references:
    - https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md
    category: security
    technology:
    - nginx
    confidence: MEDIUM
    owasp:
    - A06:2017 - Security Misconfiguration
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme
    shortlink: https://sg.run/EkAo
    semgrep.dev:
      rule:
        r_id: 9037
        rv_id: 1262672
        rule_id: ReUg7n
        version_id: w8TRoAJ
        url: https://semgrep.dev/playground/r/w8TRoAJ/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme
        origin: community
  pattern: proxy_pass $$SCHEME:// ...;
- id: generic.nginx.security.header-injection.header-injection
  pattern: |
    location ... <$VARIABLE> ... {
      ...
      add_header ... $$VARIABLE
      ...
    }
  paths:
    include:
    - '*.conf'
    - '*.vhost'
    - '**/sites-available/*'
    - '**/sites-enabled/*'
  languages:
  - generic
  severity: ERROR
  message: 'The $$VARIABLE path parameter is added as a header in the response. This
    could allow an attacker to inject a newline and add a new header into the response.
    This is called HTTP response splitting. To fix, do not allow whitespace in the
    path parameter: ''[^\s]+''.'
  metadata:
    cwe:
    - 'CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (''HTTP
      Request/Response Splitting'')'
    references:
    - https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md
    - https://owasp.org/www-community/attacks/HTTP_Response_Splitting
    category: security
    technology:
    - nginx
    confidence: MEDIUM
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Improper Validation
    source: https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection
    shortlink: https://sg.run/7oj4
    semgrep.dev:
      rule:
        r_id: 9038
        rv_id: 1262673
        rule_id: AbUz8p
        version_id: xyTjzNW
        url: https://semgrep.dev/playground/r/xyTjzNW/generic.nginx.security.header-injection.header-injection
        origin: community
- id: generic.nginx.security.header-redefinition.header-redefinition
  patterns:
  - pattern-inside: |
      server {
        ...
        add_header ...;
        ...
        ...
      }
  - pattern-inside: |
      location ... {
        ...
        ...
      }
  - pattern: add_header ...;
  paths:
    include:
    - '*.conf'
    - '*.vhost'
    - '**/sites-available/*'
    - '**/sites-enabled/*'
  languages:
  - generic
  severity: WARNING
  message: The 'add_header' directive is called in a 'location' block after headers
    have been set at the server block. Calling 'add_header' in the location block
    will actually overwrite the headers defined in the server block, no matter which
    headers are set. To fix this, explicitly set all headers or set all headers in
    the server block.
  metadata:
    cwe:
    - 'CWE-16: CWE CATEGORY: Configuration'
    references:
    - https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md
    category: security
    technology:
    - nginx
    confidence: LOW
    owasp:
    - A06:2017 - Security Misconfiguration
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition
    shortlink: https://sg.run/Lwl7
    semgrep.dev:
      rule:
        r_id: 9039
        rv_id: 1262674
        rule_id: BYUN58
        version_id: O9TpxJD
        url: https://semgrep.dev/playground/r/O9TpxJD/generic.nginx.security.header-redefinition.header-redefinition
        origin: community
- id: generic.nginx.security.insecure-redirect.insecure-redirect
  patterns:
  - pattern-either:
    - pattern: rewrite ... redirect
    - pattern: rewrite ... permanent
  - pattern-not-inside: rewrite ... https ... $host ... redirect
  - pattern-not-inside: rewrite ... https ... $host ... permanent
  - pattern-not-regex: (?i)https:\/\/
  paths:
    include:
    - '*.conf'
    - '*.vhost'
    - '**/sites-available/*'
    - '**/sites-enabled/*'
  message: Detected an insecure redirect in this nginx configuration. If no scheme
    is specified, nginx will forward the request with the incoming scheme. This could
    result in unencrypted communications. To fix this, include the 'https' scheme.
  languages:
  - generic
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    category: security
    technology:
    - nginx
    confidence: LOW
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Mishandled Sensitive Information
    source: https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect
    shortlink: https://sg.run/8y14
    semgrep.dev:
      rule:
        r_id: 9040
        rv_id: 1262675
        rule_id: DbUpJe
        version_id: e1TyjDz
        url: https://semgrep.dev/playground/r/e1TyjDz/generic.nginx.security.insecure-redirect.insecure-redirect
        origin: community
- id: generic.nginx.security.insecure-ssl-version.insecure-ssl-version
  patterns:
  - pattern-not: ssl_protocols TLSv1.2 TLSv1.3;
  - pattern-not: ssl_protocols TLSv1.3 TLSv1.2;
  - pattern-not: ssl_protocols TLSv1.2;
  - pattern-not: ssl_protocols TLSv1.3;
  - pattern: ssl_protocols ...;
  paths:
    include:
    - '*.conf'
    - '*.vhost'
    - '**/sites-available/*'
    - '**/sites-enabled/*'
  languages:
  - generic
  severity: WARNING
  message: Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2
    and TLS1.3; older versions are known to be broken and are susceptible to attacks.
    Prefer use of TLSv1.2 or later.
  metadata:
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    references:
    - https://www.acunetix.com/blog/web-security-zone/hardening-nginx/
    - https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/
    category: security
    technology:
    - nginx
    confidence: HIGH
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version
    shortlink: https://sg.run/gLKy
    semgrep.dev:
      rule:
        r_id: 9041
        rv_id: 1262676
        rule_id: WAUo9k
        version_id: vdT06O4
        url: https://semgrep.dev/playground/r/vdT06O4/generic.nginx.security.insecure-ssl-version.insecure-ssl-version
        origin: community
- id: generic.nginx.security.missing-internal.missing-internal
  options:
    generic_ellipsis_max_span: 0
    generic_engine: aliengrep
  patterns:
  - pattern-inside: |
      location ... {
        ....
        ....
      }
  - pattern-not-inside: |
      location ... {
        ....
        internal;
        ....
      }
  - pattern: proxy_pass $...URL;
  - metavariable-regex:
      metavariable: $...URL
      regex: (.*\$.*)
  paths:
    include:
    - '*.conf'
    - '*.vhost'
    - '**/sites-available/*'
    - '**/sites-enabled/*'
  languages:
  - generic
  severity: WARNING
  message: This location block contains a 'proxy_pass' directive but does not contain
    the 'internal' directive. The 'internal' directive restricts access to this location
    to internal requests. Without 'internal', an attacker could use your server for
    server-side request forgeries (SSRF). Include the 'internal' directive in this
    block to limit exposure.
  metadata:
    cwe:
    - 'CWE-16: CWE CATEGORY: Configuration'
    references:
    - https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md
    - https://nginx.org/en/docs/http/ngx_http_core_module.html#internal
    category: security
    technology:
    - nginx
    confidence: LOW
    owasp:
    - A06:2017 - Security Misconfiguration
    - A05:2021 - Security Misconfiguration
    - A02:2025 - Security Misconfiguration
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal
    shortlink: https://sg.run/Q5px
    semgrep.dev:
      rule:
        r_id: 9042
        rv_id: 1262677
        rule_id: 0oU5BZ
        version_id: d6TyxKK
        url: https://semgrep.dev/playground/r/d6TyxKK/generic.nginx.security.missing-internal.missing-internal
        origin: community
- id: generic.nginx.security.missing-ssl-version.missing-ssl-version
  patterns:
  - pattern: server { ... listen $PORT ssl; ... }
  - pattern-not-inside: server { ... ssl_protocols ... }
  paths:
    include:
    - '*.conf'
    - '*.vhost'
    - '**/sites-available/*'
    - '**/sites-enabled/*'
  languages:
  - generic
  severity: WARNING
  message: This server configuration is missing the 'ssl_protocols' directive. By
    default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions
    older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2
    TLSv1.3' to use secure TLS versions.
  metadata:
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    references:
    - https://www.acunetix.com/blog/web-security-zone/hardening-nginx/
    - https://nginx.org/en/docs/http/configuring_https_servers.html
    category: security
    technology:
    - nginx
    confidence: MEDIUM
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version
    shortlink: https://sg.run/3xzl
    semgrep.dev:
      rule:
        r_id: 9043
        rv_id: 1262678
        rule_id: KxUbeA
        version_id: ZRTKAle
        url: https://semgrep.dev/playground/r/ZRTKAle/generic.nginx.security.missing-ssl-version.missing-ssl-version
        origin: community
- id: generic.nginx.security.alias-path-traversal.alias-path-traversal
  patterns:
  - pattern: |
      location $...LOCATION {
        ...
        alias .../;
        ...
      }
  - metavariable-pattern:
      metavariable: $...LOCATION
      pattern-regex: ^.*[^/]$
  paths:
    include:
    - '*.conf'
    - '*.vhost'
    - '**/sites-available/*'
    - '**/sites-enabled/*'
  fix-regex:
    regex: location\s+([A-Za-z0-9/-_\.]+)
    replacement: location \1/
  languages:
  - generic
  severity: WARNING
  message: The alias in this location block is subject to a path traversal because
    the location path does not end in a path separator (e.g., '/'). To fix, add a
    path separator to the end of the path.
  metadata:
    cwe:
    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
      Traversal'')'
    source-rule-url: https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md
    category: security
    technology:
    - nginx
    confidence: LOW
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    - https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/
    - https://www.youtube.com/watch?v=CIhHpkybYsY
    - https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Path Traversal
    source: https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal
    shortlink: https://sg.run/ZvNL
    semgrep.dev:
      rule:
        r_id: 9035
        rv_id: 1262670
        rule_id: 5rUOjq
        version_id: NdTzyBg
        url: https://semgrep.dev/playground/r/NdTzyBg/generic.nginx.security.alias-path-traversal.alias-path-traversal
        origin: community
- id: java.lang.security.audit.crypto.weak-random.weak-random
  message: Detected use of the functions `Math.random()` or `java.util.Random()`.
    These are both not cryptographically strong random number generators (RNGs). If
    you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom`
    instead.
  languages:
  - java
  severity: WARNING
  metadata:
    functional-categories:
    - crypto::search::randomness::java.security
    owasp:
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    cwe:
    - 'CWE-330: Use of Insufficiently Random Values'
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random
    shortlink: https://sg.run/NwBp
    semgrep.dev:
      rule:
        r_id: 17327
        rv_id: 1263018
        rule_id: lBUW5D
        version_id: 6xT29RK
        url: https://semgrep.dev/playground/r/6xT29RK/java.lang.security.audit.crypto.weak-random.weak-random
        origin: community
  pattern-either:
  - pattern: |
      new java.util.Random(...).$FUNC(...)
  - pattern: |
      java.lang.Math.random(...)
- id: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer
  message: Detected a request with potential user-input going into a OutputStream
    or Writer object. This bypasses any view or template environments, including HTML
    escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities.
    Consider using a view technology such as JavaServer Faces (JSFs) which automatically
    escapes HTML views.
  severity: WARNING
  options:
    interfile: true
  metadata:
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe:
    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
      Scripting'')'
    cwe2021-top25: true
    cwe2022-top25: true
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html
    subcategory:
    - vuln
    technology:
    - java
    - servlets
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cross-Site-Scripting (XSS)
    source: https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer
    shortlink: https://sg.run/KlRL
    semgrep.dev:
      rule:
        r_id: 9211
        rv_id: 1263055
        rule_id: j2Uv7B
        version_id: DkTRbXy
        url: https://semgrep.dev/playground/r/DkTRbXy/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer
        origin: community
  languages:
  - java
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletRequest $REQ).$REQFUNC(...)
      - pattern: "(ServletRequest $REQ).$REQFUNC(...) \n"
    - metavariable-regex:
        metavariable: $REQFUNC
        regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletResponse $RESPONSE).getWriter(...).$WRITE(...)
      - pattern: |
          (HttpServletResponse $RESPONSE).getOutputStream(...).$WRITE(...)
      - pattern: |
          (java.io.PrintWriter $WRITER).$WRITE(...)
      - pattern: |
          (PrintWriter $WRITER).$WRITE(...)
      - pattern: |
          (javax.servlet.ServletOutputStream $WRITER).$WRITE(...)
      - pattern: |
          (ServletOutputStream $WRITER).$WRITE(...)
      - pattern: |
          (java.io.OutputStream $WRITER).$WRITE(...)
      - pattern: |
          (OutputStream $WRITER).$WRITE(...)
  pattern-sanitizers:
  - pattern-either:
    - pattern: Encode.forHtml(...)
    - pattern: (PolicyFactory $POLICY).sanitize(...)
    - pattern: (AntiSamy $AS).scan(...)
    - pattern: JSoup.clean(...)
    - pattern: org.apache.commons.lang.StringEscapeUtils.escapeHtml(...)
    - pattern: org.springframework.web.util.HtmlUtils.htmlEscape(...)
    - pattern: org.owasp.esapi.ESAPI.encoder().encodeForHTML(...)
- id: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1
  message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
    collision resistant and is therefore not suitable as a cryptographic signature.
    Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function
    applications.
  languages:
  - java
  severity: WARNING
  metadata:
    functional-categories:
    - crypto::search::hash-algorithm::javax.crypto
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    cwe:
    - 'CWE-328: Use of Weak Hash'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1
    asvs:
      section: V6 Stored Cryptography Verification Requirements
      control_id: 6.2.5 Insecure Algorithm
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
      version: '4'
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Insecure Hashing Algorithm
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1
    shortlink: https://sg.run/bXNp
    semgrep.dev:
      rule:
        r_id: 17326
        rv_id: 1263016
        rule_id: qNUWNn
        version_id: l4TJRpL
        url: https://semgrep.dev/playground/r/l4TJRpL/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1
        origin: community
  pattern-either:
  - patterns:
    - pattern: |
        java.security.MessageDigest.getInstance("$ALGO", ...);
    - metavariable-regex:
        metavariable: $ALGO
        regex: (SHA1|SHA-1)
  - pattern: |
      $DU.getSha1Digest().digest(...)
- id: java.lang.security.audit.crypto.use-of-md5.use-of-md5
  message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
    resistant and is therefore not suitable as a cryptographic signature. Use HMAC
    instead.
  languages:
  - java
  severity: WARNING
  metadata:
    functional-categories:
    - crypto::search::hash-algorithm::java.security
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    cwe:
    - 'CWE-328: Use of Weak Hash'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Insecure Hashing Algorithm
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5
    shortlink: https://sg.run/ryJn
    semgrep.dev:
      rule:
        r_id: 17325
        rv_id: 1263013
        rule_id: KxU5lW
        version_id: 0bTKzGX
        url: https://semgrep.dev/playground/r/0bTKzGX/java.lang.security.audit.crypto.use-of-md5.use-of-md5
        origin: community
  patterns:
  - pattern: |
      java.security.MessageDigest.getInstance($ALGO, ...);
  - metavariable-regex:
      metavariable: $ALGO
      regex: (?i)(.MD5.)
  - focus-metavariable: $ALGO
  fix: |
    "SHA-512"
- id: java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request
  message: Detected input from a HTTPServletRequest going into an LDAP query. This
    could lead to LDAP injection if the input is not properly sanitized, which could
    result in attackers modifying objects in the LDAP tree structure. Ensure data
    passed to an LDAP query is not controllable or properly sanitize the data.
  metadata:
    cwe:
    - 'CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (''LDAP
      Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection
    category: security
    technology:
    - java
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - LDAP Injection
    source: https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request
    shortlink: https://sg.run/gRg0
    semgrep.dev:
      rule:
        r_id: 18241
        rv_id: 1409392
        rule_id: pKUXAv
        version_id: 8KT3Pe6
        url: https://semgrep.dev/playground/r/8KT3Pe6/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request
        origin: community
  severity: WARNING
  languages:
  - java
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: (HttpServletRequest $REQ)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          (javax.naming.directory.InitialDirContext $IDC).search(...)
      - pattern: |
          (javax.naming.directory.DirContext $CTX).search(...)
    - pattern-not: |
        (javax.naming.directory.InitialDirContext $IDC).search($Y, "...", ...)
    - pattern-not: |
        (javax.naming.directory.DirContext $CTX).search($Y, "...", ...)
- id: java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request
  message: Detected input from a HTTPServletRequest going into a session command,
    like `setAttribute`. User input into such a command could lead to an attacker
    inputting malicious code into your session parameters, blurring the line between
    what's trusted and untrusted, and therefore leading to a trust boundary violation.
    This could lead to programmers trusting unvalidated data. Instead, thoroughly
    sanitize user input before passing it into such function calls.
  languages:
  - java
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: |
            (HttpServletRequest $REQ).$FUNC(...)
        - pattern-not: |
            (HttpServletRequest $REQ).getSession()
      - patterns:
        - pattern-inside: |
            (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
            ...
            for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
              ...
            }
        - pattern: |
            $COOKIE.getValue(...)
      - patterns:
        - pattern-inside: |
            $TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(... );
            ...
        - pattern: |
            $PARAM = $VALS[$INDEX];
      - patterns:
        - pattern-inside: |
            $HEADERS = (HttpServletRequest $REQ).getHeaders(...);
            ...
            $PARAM = $HEADERS.$FUNC(...);
            ...
        - pattern: |
            java.net.URLDecoder.decode($PARAM, ...)
  pattern-sinks:
  - patterns:
    - pattern: (HttpServletRequest $REQ).getSession().$FUNC($NAME, $VALUE);
    - metavariable-regex:
        metavariable: $FUNC
        regex: ^(putValue|setAttribute)$
    - focus-metavariable: $VALUE
  options:
    interfile: true
  metadata:
    category: security
    technology:
    - java
    cwe:
    - 'CWE-501: Trust Boundary Violation'
    owasp:
    - A04:2021 - Insecure Design
    - A06:2025 - Insecure Design
    references:
    - https://owasp.org/Top10/A04_2021-Insecure_Design
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
    confidence: MEDIUM
    interfile: true
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Other
    source: https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request
    shortlink: https://sg.run/QbDZ
    semgrep.dev:
      rule:
        r_id: 18242
        rv_id: 1409393
        rule_id: 2ZU7Eo
        version_id: gETrv9j
        url: https://semgrep.dev/playground/r/gETrv9j/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request
        origin: community
- id: java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request
  message: Detected input from a HTTPServletRequest going into a XPath evaluate or
    compile command. This could lead to xpath injection if variables passed into the
    evaluate or compile commands are not properly sanitized. Xpath injection could
    lead to unauthorized access to sensitive information in XML documents. Instead,
    thoroughly sanitize user input or use parameterized xpath queries if you can.
  languages:
  - java
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: |
        (HttpServletRequest $REQ).$FUNC(...)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          (javax.xml.xpath.XPath $XP).evaluate(...)
      - pattern: |
          (javax.xml.xpath.XPath $XP).compile(...).evaluate(...)
  metadata:
    category: security
    technology:
    - java
    cwe:
    - 'CWE-643: Improper Neutralization of Data within XPath Expressions (''XPath
      Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - XPath Injection
    source: https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request
    shortlink: https://sg.run/3BvK
    semgrep.dev:
      rule:
        r_id: 18243
        rv_id: 1409394
        rule_id: X5U5nj
        version_id: QkTERKP
        url: https://semgrep.dev/playground/r/QkTERKP/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request
        origin: community
- id: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
  message: Detected input from a HTTPServletRequest going into a SQL sink or statement.
    This could lead to SQL injection if variables in the SQL statement are not properly
    sanitized. Use parameterized SQL queries or properly sanitize user input instead.
  severity: WARNING
  metadata:
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    category: security
    cwe:
    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
      (''SQL Injection'')'
    cwe2021-top25: true
    cwe2022-top25: true
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
    - https://owasp.org/www-community/attacks/SQL_Injection
    subcategory:
    - vuln
    technology:
    - sql
    - java
    - servlets
    - spring
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - SQL Injection
    source: https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
    shortlink: https://sg.run/Lg56
    semgrep.dev:
      rule:
        r_id: 18239
        rv_id: 1409390
        rule_id: oqUBJG
        version_id: 7ZTKJNj
        url: https://semgrep.dev/playground/r/7ZTKJNj/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
        origin: community
  languages:
  - java
  mode: taint
  options:
    taint_assume_safe_numbers: true
    taint_assume_safe_booleans: true
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletRequest $REQ).$REQFUNC(...)
      - pattern: "(ServletRequest $REQ).$REQFUNC(...) \n"
    - metavariable-regex:
        metavariable: $REQFUNC
        regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: "(java.sql.CallableStatement $STMT) = ...; \n"
      - pattern: |
          (java.sql.Statement $STMT) = ...;
          ...
          $OUTPUT = $STMT.$FUNC(...);
      - pattern: |
          (java.sql.PreparedStatement $STMT) = ...;
      - pattern: |
          $VAR = $CONN.prepareStatement(...)
      - pattern: |
          $PATH.queryForObject(...);
      - pattern: |
          (java.util.Map<String, Object> $STMT) = $PATH.queryForMap(...);
      - pattern: |
          (org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...;
      - pattern: |
          (org.springframework.jdbc.core.JdbcTemplate $TEMPL).batchUpdate(...)
      - patterns:
        - pattern-inside: |
            (String $SQL) = "$SQLSTR" + ...;
            ...
        - pattern: $PATH.$SQLCMD(..., $SQL, ...);
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*)
        - metavariable-regex:
            metavariable: $SQLCMD
            regex: (execute|query|executeUpdate|batchUpdate)
- id: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request
  message: Detected input from a HTTPServletRequest going into a 'ProcessBuilder'
    or 'exec' command. This could lead to command injection if variables passed into
    the exec commands are not properly sanitized. Instead, avoid using these OS commands
    with user-supplied input, or, if you must use these commands, use a whitelist
    of specific values.
  languages:
  - java
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          (HttpServletRequest $REQ)
      - patterns:
        - pattern-inside: |
            (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
            ...
            for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
              ...
            }
        - pattern: |
            $COOKIE.getValue(...)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: |
          (ProcessBuilder $PB) = ...;
      - patterns:
        - pattern: |
            (Process $P) = ...;
        - pattern-not: |
            (Process $P) = (java.lang.Runtime $R).exec(...);
      - patterns:
        - pattern: (java.lang.Runtime $R).exec($CMD, ...);
        - focus-metavariable: $CMD
      - patterns:
        - pattern-either:
          - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...;  \n...\n(ProcessBuilder
              $PB) = ...;\n...\n$PB.command($ARGLIST);\n"
          - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...;  \n...\n(ProcessBuilder
              $PB) = ...;\n"
          - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...;  \n...\n(Process
              $P) = ...;\n"
        - pattern: |
            $ARGLIST.add(...);
  metadata:
    category: security
    technology:
    - java
    cwe:
    - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
      Command Injection'')'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Command Injection
    source: https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request
    shortlink: https://sg.run/8zPN
    semgrep.dev:
      rule:
        r_id: 18240
        rv_id: 1263042
        rule_id: zdUWrg
        version_id: LjTkg9J
        url: https://semgrep.dev/playground/r/LjTkg9J/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request
        origin: community
- id: c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn
  pattern: scanf(...)
  message: Avoid using 'scanf()'. This function, when used improperly, does not consider
    buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for
    reading input.
  metadata:
    cwe:
    - 'CWE-676: Use of Potentially Dangerous Function'
    references:
    - http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html
    category: security
    technology:
    - c
    confidence: LOW
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Dangerous Method or Function
    source: https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn
    shortlink: https://sg.run/nd1g
    semgrep.dev:
      rule:
        r_id: 8836
        rv_id: 945173
        rule_id: AbUzPd
        version_id: zyTlkWW
        url: https://semgrep.dev/playground/r/zyTlkWW/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn
        origin: community
  languages:
  - c
  severity: WARNING
- id: java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#CUSTOM_MESSAGE_DIGEST
    asvs:
      section: V6 Stored Cryptography Verification Requirements
      control_id: 6.2.2 Insecure Custom Algorithm
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
      version: '4'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms
    category: security
    technology:
    - java
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Cryptographic Issues
    source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests
    shortlink: https://sg.run/PJ0p
    semgrep.dev:
      rule:
        r_id: 9201
        rv_id: 1263004
        rule_id: KxUbW4
        version_id: YDTZewB
        url: https://semgrep.dev/playground/r/YDTZewB/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests
        origin: community
  message: 'Cryptographic algorithms are notoriously difficult to get right. By implementing
    a custom message digest, you risk introducing security issues into your program.
    Use one of the many sound message digests already available to you: MessageDigest
    sha256Digest = MessageDigest.getInstance("SHA256");'
  severity: WARNING
  languages:
  - java
  pattern: |-
    class $CLASS extends MessageDigest {
      ...
    }
- id: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn
  pattern-either:
  - pattern: strcpy(...)
  - pattern: strncpy(...)
  message: Finding triggers whenever there is a strcpy or strncpy used. This is an
    issue because strcpy does not affirm the size of the destination array and strncpy
    will not automatically NULL-terminate strings. This can lead to buffer overflows,
    which can cause program crashes and potentially let an attacker inject code in
    the program. Fix this by using strcpy_s instead (although note that strcpy_s is
    an optional part of the C11 standard, and so may not be available).
  metadata:
    cwe:
    - 'CWE-676: Use of Potentially Dangerous Function'
    references:
    - https://cwe.mitre.org/data/definitions/676
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11365
    category: security
    technology:
    - c
    confidence: LOW
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Dangerous Method or Function
    source: https://semgrep.dev/r/c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn
    shortlink: https://sg.run/7oNk
    semgrep.dev:
      rule:
        r_id: 8838
        rv_id: 945175
        rule_id: DbUpo5
        version_id: 2KTYb7Y
        url: https://semgrep.dev/playground/r/2KTYb7Y/c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn
        origin: community
  languages:
  - c
  severity: WARNING
- id: ruby.lang.security.no-eval.ruby-eval
  message: Use of eval with user-controllable input detected. This can lead  to attackers
    running arbitrary code. Ensure external data does not  reach here, otherwise this
    is a security vulnerability. Consider  other ways to do this without eval.
  severity: WARNING
  metadata:
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe2022-top25: true
    cwe2021-top25: true
    cwe:
    - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_evaluation.rb
    subcategory:
    - vuln
    technology:
    - ruby
    - rails
    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
    vulnerability_class:
    - Code Injection
    source: https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval
    shortlink: https://sg.run/bDwZ
    semgrep.dev:
      rule:
        r_id: 9726
        rv_id: 1263615
        rule_id: OrUGNk
        version_id: A8TgdDv
        url: https://semgrep.dev/playground/r/A8TgdDv/ruby.lang.security.no-eval.ruby-eval
        origin: community
  languages:
  - ruby
  mode: taint
  pattern-sources:
  - pattern-either:
    - pattern: params
    - pattern: cookies
    - patterns:
      - pattern: |
          RubyVM::InstructionSequence.compile(...)
      - pattern-not: |
          RubyVM::InstructionSequence.compile("...")
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: $X.eval
      - pattern: $X.class_eval
      - pattern: $X.instance_eval
      - pattern: $X.module_eval
      - pattern: $X.eval(...)
      - pattern: $X.class_eval(...)
      - pattern: $X.instance_eval(...)
      - pattern: $X.module_eval(...)
      - pattern: eval(...)
      - pattern: class_eval(...)
      - pattern: module_eval(...)
      - pattern: instance_eval(...)
    - pattern-not: $M("...",...)